CODEWITHSUNDEEP
.netasp.net
Beta033
Beta033

Reputation: 2013

Uploading files across domains in ASP.NET

Having a little trouble and i wanted to see what you'd all suggest. Thanks for your input.

We have an ASP.NET website, one feature is that this website will allow users to upload files and then the server saves them to a UNC path.

Some of our users cannot upload the files. I think this would likely be security issues as these users are in a different domain and therefore cannot access the UNC path to where the system is trying to save the file.

The web site uses Windows authentication to validate users. The file server and the webserver are 2 separate machines but are located within one domain the users are coming from another domain

the system is using System.Web.HttpPostedFile.SaveAs(String SaveLocation) to save the file

what i can't figure out is why the file is not being saved using the AppPool's settings and how to configure this to not try to use the client credentials to save the files.

EDIT: I thought if it was controlled by the app pool than ALL of our users would be having troubles. but it seems to just be the ones outside the domain that has the fileserver.

Any thoughts?

Thanks for the insight.

Upvotes: 1

Views: 1886

Answers (3)

Rubens Farias
Rubens Farias

Reputation: 57926

Do you have <identity impersonate="true" /> in your web.config?

If so, you're using your client user credential to save that file; in this case, probably will be better if you could use just you application pool account and grant it with proper file system permissions.

You can define credentials this way:

<identity impersonate="true" 
          userName="domain\username"
          password="password"/>

Upvotes: 1

Russ Bradberry
Russ Bradberry

Reputation: 10865

In IIS under Properties-->Directory Security-->Authentication Access and Control In the "Enable Anonymous Access" box, change the username to a domain account with access rights

to elaborate, the app pool is the account the process runs under, the "Authentication Access and Control" account is the username the anonymous users are actually running as. This would make sense as your domain users (probably using Integrated Authentication) already have access.

EDIT Here is a pretty image too: alt text

Upvotes: 1

Darin Dimitrov
Darin Dimitrov

Reputation: 1038710

You could try configuring a fixed identity in the Appllication Pool settings that has sufficient permissions to write to the UNC share.

alt text

Upvotes: 0

Related Questions