Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > ASP .Net > Security question.

Reply
Thread Tools

Security question.

 
 
J-T
Guest
Posts: n/a
 
      07-13-2005
We have an asp.net application with <identity impersonate="true"/> and
<authentication mode="Windows" /> in our web config and we are using Windows
integrated in IIS and also NT AUTHORITY\NETWORK SERVICE account in its
application pool. I create an object in Global.asax which monitors a folder
for upcoming files.What is the security context of the object since there is
no user (Domain\Username) requesting this object.Is it running under the
security context of AUTHORITY\NETWORK SERVICE account ?

Thanks in advance


 
Reply With Quote
 
 
 
 
Bruce Barker
Guest
Posts: n/a
 
      07-13-2005
objects don't have a security context, only threads do. if you access the
the object in global.asax before authentication, then you run under the app
pool account. if you call the object after the authentication event, then
you will run under the impersonated account

-- bruce (sqlwork.com)


"J-T" <> wrote in message
news:...
> We have an asp.net application with <identity impersonate="true"/> and
> <authentication mode="Windows" /> in our web config and we are using
> Windows integrated in IIS and also NT AUTHORITY\NETWORK SERVICE account
> in its application pool. I create an object in Global.asax which monitors
> a folder for upcoming files.What is the security context of the object
> since there is no user (Domain\Username) requesting this object.Is it
> running under the security context of AUTHORITY\NETWORK SERVICE account ?
>
> Thanks in advance
>



 
Reply With Quote
 
 
 
 
J-T
Guest
Posts: n/a
 
      07-13-2005
In that object I'd like to gain access to the file system of a windows 200
which is not in our domain,so I was thinking to set up our application pool
to run under a local aacount and then duplicate that account in windows 2000
server and give it right NTFS permission sets then for our database access I
create a sql server acount with the same name and password and I use this
connection string in my web.config

<add key="Main.ConnectionString"
value="Server=db-d;Database=vcad;Min Pool Size=5;Trusted_Connection=True"/>
OR
<add key="Main.ConnectionString" value="Data Source=db-d;Min
Pool Size=5;Initial Catalog=vcad;Integrated Security=SSPI;"/>

and also this:

identity impersonate="true" username="MyUser" password="123"/>
<authentication mode="Windows" />


Note: MyUser is a local account to each server and is the one which my
application pool is setup under.

Thanks a lot

"Bruce Barker" <brubar_nospamplease_@safeco.com> wrote in message
news:O7HQRf%...
> objects don't have a security context, only threads do. if you access the
> the object in global.asax before authentication, then you run under the
> app pool account. if you call the object after the authentication event,
> then you will run under the impersonated account
>
> -- bruce (sqlwork.com)
>
>
> "J-T" <> wrote in message
> news:...
>> We have an asp.net application with <identity impersonate="true"/> and
>> <authentication mode="Windows" /> in our web config and we are using
>> Windows integrated in IIS and also NT AUTHORITY\NETWORK SERVICE account
>> in its application pool. I create an object in Global.asax which monitors
>> a folder for upcoming files.What is the security context of the object
>> since there is no user (Domain\Username) requesting this object.Is it
>> running under the security context of AUTHORITY\NETWORK SERVICE account ?
>>
>> Thanks in advance
>>

>
>



 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Accessing higher security level from higher security level nderose@gmail.com Cisco 0 07-11-2005 10:20 PM
Going from higher security level interface to lower security interface- HELP!!! - AM Cisco 4 12-28-2004 09:52 PM
IT-Security, Security, e-security COMSOLIT Messmer Computer Support 0 09-05-2003 08:34 AM
How secure is the security from my security form? Aaron Java 1 08-04-2003 06:16 PM
MCSA: Security MCSE: Security question Rick Sears MCSE 0 07-29-2003 08:02 PM



Advertisments
 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57