trying to post to aspx anonyomously is blocked?

L

Larry

I have written a webform page to respond to a users post on the web site.
This worked on the test site which had anonymous turned off. I then moved it
to the regular web site (copied the files, reinstalled the FP extension) and
chaged the setting for anonymous use. but when I try to post the form
results to the aspx page I keep getting the windows authentication dialog.
If I go ahead and give the credentials the page goes ahead and works but I
want this page to work without having need a log in.

I've tried everything I can think of concerning the permissions (which to my
way of thinking must be the problem) on the files and directories that the
aspx page resides in, and the various dotnet directories (per the setting up
an ASPUSER account KB). I've tried adding IUSR_machine to all of them, and I
still get the log-on challenge.

Someone (from the usoft support center) told me once that the NETWORK,
SYSTEM and INTERACTIVE accounts have to have full control on all the
directories, so I check and in some cases modified those to have full
access, still the same behavior. (BTW is there a white paper or something
that explains the purpose of these accounts, when they need to be present
and what permissions they need have when present? The security articles keep
saying remove any unnessecary accounts from various directories but never a
word of if these are needed or are they like the "everyone" account;
automatically added giving unwarrented access to things.)

My server is a win2K server and needs to run IIS (with FPextensions and
dotnet), exchange, SQL, and activedirectory. I know this is not the
recommended configuration but I don't have the billions of dollars usoft has
to run a seperate server for each function. Obviously system admin is not my
forte so I would appreciate as much detailed help as you can give me in
getting the premissions and other security setting set up correctly.

oh yes one other note of interest; I do have the aspx's web.config set to
windows authentication with impersonate set to true.

-Larry
 
M

[MSFT]

Hi Larry,

In Machine.config <ProcessModal> section, did you used the "machine" or
"system" account? If you use "machine" so far, you may try "System"
account", it is desired to have more permission than "machine" (ASPNET).

Additionally, you may take following test to see what is the result:

1. On the web server, create a new virtual folder and add a simple (Blank)
ASPX page, and same web.config. Will the problem also occur with the ASPX
page?
2. In web.config, remove impersonate=true. Does this help?


Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
 
L

Larry

I had already tried the items you suggested with no luck. After a few more
hours with filemon and the support staff at MS we found the offending items.

For those that might be following the solution was having to change the
permissions for the system32 directory, and the assembly directory. I had
thought about the assembly directory but I didn't know how to access the
permission settings or about having to unregister/register that directory.
These accesses were caused by my use of CDONTS object. Something that the
examples and documentation I referenced never mentioned were these resources
reside and that I would need to grant additional access channels to the
afore named directories.

It's becoming one of my beef's with MS documentation that very little if any
mentioned is made of what resources (ie files) using these objects in dotnet
programs are used and which child services and objects they depend on, so
one can know were to grant permissions or safely remove or disable unused
items. A good tool is needed that would map out all the modules and services
any given application uses, and what permissions are required. So those of
use that don't live (or want to have to live) administrating servers can
focus on writing applications.

thanks for responding though.

-Larry
 
M

[MSFT]

Hi Larry,

CDONTS will require addtional permission. You may refer to following
articles to see if they will help:

PRB: Permission Denied While Using CDONTS to Send Mail with Exchange
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q228465


XIMS: Minimum NTFS Permissions Required to Use CDONTS
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q260985

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

No members online now.

Forum statistics

Threads
473,768
Messages
2,569,574
Members
45,051
Latest member
CarleyMcCr

Latest Threads

Top