shared folder access

Ask a Question related to ASP.NET Security, Design and Development.

  1. sundeeps@niit.com #1

    Default shared folder access

    hi, i have a web application residing on a web server [w]
    and a file server [s]. Both the servers are part of same
    domain [d].

    now, i want to access shared folders from my web
    application but the access should be given to only those
    users who has permission on shared folder.

    I set up impersonate in my system and m using windows
    authentication, but still i get access denied error.

    Need help
    sundeeps@niit.com Guest
    Reply With Quote Reply With Quote

    2. Similar Questions and Discussions

    1. Unable to Access Shared Folder (The Next Day)
      Have a windows 2003 server with AD, and a few shared folders. After sharing a directory, client is able to access (share) the same day. However,...
    2. access to sql server from shared folder security error
      hi all i generated windows application by vb.net file that connect to sql server . when copy exe file to shared folder and after run it...
    3. Limit on access to shared folder
      You have reached the limit for Windows XP Pro. Windows XP Home is hardwired to a limit of 5. Windows XP Pro is hardwired to a limit of 10....
    4. Mapping networked shared folder to local folder
      Hello. I am setting-up a "cad server" (basically a shared folder located, \\cad\eoi\) for my draftspeople. The problem lies within the cad...
    5. Can I have local Shared Documents folder *NOT* shared on the Local Network
      I finally have my local network working well enough (Thanks Steve W.!). I think I have learned that "network connection" does not get you anything...
  2. Steve Jansen #2

    Default Re: shared folder access

    I suggest reading the Patterns & Practices whitepaper "Authentication in
    ASP.NET: .NET Security Guidance":
    [url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/authaspdotnet.asp[/url]

    Impersonation is not enough to accomplish what you want. You require
    account delegation from your physical server running IIS to your physical
    server hosting the file share.

    Option 1
    ---------
    Your first option is to use Basic Authentication in IIS over SSL. This way,
    the inetinfo.exe process has your credentials in plaintext and can logon to
    the remote file server on the end-users behalf.

    Option 2
    ---------
    Alternatively I have gotten this to work before with Windows Authenticaion,
    but, it is not straightforward:
    1) Enable Windows Authentication in IIS for your web app
    2) If you create a virtual directory that maps to your UNC share, manually
    delete the UNCUserName and UNCPassword metabase values using adsutil.vbs.
    This will remove the UNC user token credentials (something that cannot be
    done through inetmgr.exe). Doing so causes IIS to attempt delegation using
    the current logon credentials.
    3) Even though inetinfo.exe runs as LocalSystem, I had to create an AD
    Service Principal Name. First, I had to set the option "Trust this computer
    for delegation" for the IIS Computer AD object. Then, I had to issue the
    setspn.exe command, which I remember being :

    setspn -A HTTP/myhost.mydomain.com myserver


    4) For IE clients, I had to add myhost.mydomain.com to the LocalIntranet
    zone. I would guess this caused IE to use Kerberos authentication instead
    of NTLM. It may have also had something to do with "Automatic Logon in
    Intranet Zone only"

    Connected IE clients should then browse the remote file share using their
    credentials and appropriate ACLs. You should be able to confirm this by
    enabling complete auditing of file access for your share and checking the
    event viewer. I believe there are major performance implications for this,
    due to the increased network activity of IIS performing delegation and UNC
    file operations.

    Option 3
    ---------
    You can also set the UNCAuthenticationPassthrough metabase attribute to True
    to accomplish this. The article @
    [url]http://msdn.microsoft.com/msdnmag/issues/0700/websecure2/default.aspx[/url]
    provides a good discussion of this setting. However, the KB 286401 states
    that this setting is not supported by MS.

    -Steve Jansen

    "sundeeps@niit.com" <anonymous@discussions.microsoft.com> wrote in message
    news:06d601c39315$9f30aef0$a001280a@phx.gbl...
    > hi, i have a web application residing on a web server [w]
    > and a file server [s]. Both the servers are part of same
    > domain [d].
    >
    > now, i want to access shared folders from my web
    > application but the access should be given to only those
    > users who has permission on shared folder.
    >
    > I set up impersonate in my system and m using windows
    > authentication, but still i get access denied error.
    >
    > Need help

    Steve Jansen Guest
    Reply With Quote Reply With Quote
  3. #3

    Default Re: shared folder access

    Thanks Steve. Your options are really logical. However, i
    tried with the basic autjentication as we r on intranet
    and its ok for us to pass in plain text too.. but seems it
    doesn't work.

    also, i am not able to delete the UNC parameters too as
    you did..
    >-----Original Message-----
    >I suggest reading the Patterns & Practices
    whitepaper "Authentication in
    >ASP.NET: .NET Security Guidance":
    >[url]http://msdn.microsoft.com/library/default.asp?[/url]
    url=/library/en-us/dnbda/html/authaspdotnet.asp
    >
    >Impersonation is not enough to accomplish what you want.
    You require
    >account delegation from your physical server running IIS
    to your physical
    >server hosting the file share.
    >
    >Option 1
    >---------
    >Your first option is to use Basic Authentication in IIS
    over SSL. This way,
    >the inetinfo.exe process has your credentials in
    plaintext and can logon to
    >the remote file server on the end-users behalf.
    >
    >Option 2
    >---------
    >Alternatively I have gotten this to work before with
    Windows Authenticaion,
    >but, it is not straightforward:
    >1) Enable Windows Authentication in IIS for your web app
    >2) If you create a virtual directory that maps to your
    UNC share, manually
    >delete the UNCUserName and UNCPassword metabase values
    using adsutil.vbs.
    >This will remove the UNC user token credentials
    (something that cannot be
    >done through inetmgr.exe). Doing so causes IIS to
    attempt delegation using
    >the current logon credentials.
    >3) Even though inetinfo.exe runs as LocalSystem, I had
    to create an AD
    >Service Principal Name. First, I had to set the
    option "Trust this computer
    >for delegation" for the IIS Computer AD object. Then, I
    had to issue the
    >setspn.exe command, which I remember being :
    >
    >setspn -A HTTP/myhost.mydomain.com myserver
    >
    >
    >4) For IE clients, I had to add myhost.mydomain.com to
    the LocalIntranet
    >zone. I would guess this caused IE to use Kerberos
    authentication instead
    >of NTLM. It may have also had something to do
    with "Automatic Logon in
    >Intranet Zone only"
    >
    >Connected IE clients should then browse the remote file
    share using their
    >credentials and appropriate ACLs. You should be able to
    confirm this by
    >enabling complete auditing of file access for your share
    and checking the
    >event viewer. I believe there are major performance
    implications for this,
    >due to the increased network activity of IIS performing
    delegation and UNC
    >file operations.
    >
    >Option 3
    >---------
    >You can also set the UNCAuthenticationPassthrough
    metabase attribute to True
    >to accomplish this. The article @
    >[url]http://msdn.microsoft.com/msdnmag/issues/0700/websecure2/d[/url]
    efault.aspx
    >provides a good discussion of this setting. However, the
    KB 286401 states
    >that this setting is not supported by MS.
    >
    >-Steve Jansen
    >
    >"sundeeps@niit.com" <anonymous@discussions.microsoft.com>
    wrote in message
    >news:06d601c39315$9f30aef0$a001280a@phx.gbl...
    >> hi, i have a web application residing on a web server
    [w]
    >> and a file server [s]. Both the servers are part of same
    >> domain [d].
    >>
    >> now, i want to access shared folders from my web
    >> application but the access should be given to only those
    >> users who has permission on shared folder.
    >>
    >> I set up impersonate in my system and m using windows
    >> authentication, but still i get access denied error.
    >>
    >> Need help
    >
    >
    >.
    >
    Guest
    Reply With Quote Reply With Quote
  4. Steve Jansen #4

    Default Re: shared folder access

    Did you use adsutil.vbs to delete the UNC parameters, or did you try to use
    the GUI tool (inetmgr.exe)?

    <anonymous@discussions.microsoft.com> wrote in message
    news:0b0001c393ae$591ea900$a301280a@phx.gbl...
    > Thanks Steve. Your options are really logical. However, i
    > tried with the basic autjentication as we r on intranet
    > and its ok for us to pass in plain text too.. but seems it
    > doesn't work.
    >
    > also, i am not able to delete the UNC parameters too as
    > you did..
    >
    > >-----Original Message-----
    > >I suggest reading the Patterns & Practices
    > whitepaper "Authentication in
    > >ASP.NET: .NET Security Guidance":
    > >[url]http://msdn.microsoft.com/library/default.asp?[/url]
    > url=/library/en-us/dnbda/html/authaspdotnet.asp
    > >
    > >Impersonation is not enough to accomplish what you want.
    > You require
    > >account delegation from your physical server running IIS
    > to your physical
    > >server hosting the file share.
    > >
    > >Option 1
    > >---------
    > >Your first option is to use Basic Authentication in IIS
    > over SSL. This way,
    > >the inetinfo.exe process has your credentials in
    > plaintext and can logon to
    > >the remote file server on the end-users behalf.
    > >
    > >Option 2
    > >---------
    > >Alternatively I have gotten this to work before with
    > Windows Authenticaion,
    > >but, it is not straightforward:
    > >1) Enable Windows Authentication in IIS for your web app
    > >2) If you create a virtual directory that maps to your
    > UNC share, manually
    > >delete the UNCUserName and UNCPassword metabase values
    > using adsutil.vbs.
    > >This will remove the UNC user token credentials
    > (something that cannot be
    > >done through inetmgr.exe). Doing so causes IIS to
    > attempt delegation using
    > >the current logon credentials.
    > >3) Even though inetinfo.exe runs as LocalSystem, I had
    > to create an AD
    > >Service Principal Name. First, I had to set the
    > option "Trust this computer
    > >for delegation" for the IIS Computer AD object. Then, I
    > had to issue the
    > >setspn.exe command, which I remember being :
    > >
    > >setspn -A HTTP/myhost.mydomain.com myserver
    > >
    > >
    > >4) For IE clients, I had to add myhost.mydomain.com to
    > the LocalIntranet
    > >zone. I would guess this caused IE to use Kerberos
    > authentication instead
    > >of NTLM. It may have also had something to do
    > with "Automatic Logon in
    > >Intranet Zone only"
    > >
    > >Connected IE clients should then browse the remote file
    > share using their
    > >credentials and appropriate ACLs. You should be able to
    > confirm this by
    > >enabling complete auditing of file access for your share
    > and checking the
    > >event viewer. I believe there are major performance
    > implications for this,
    > >due to the increased network activity of IIS performing
    > delegation and UNC
    > >file operations.
    > >
    > >Option 3
    > >---------
    > >You can also set the UNCAuthenticationPassthrough
    > metabase attribute to True
    > >to accomplish this. The article @
    > >[url]http://msdn.microsoft.com/msdnmag/issues/0700/websecure2/d[/url]
    > efault.aspx
    > >provides a good discussion of this setting. However, the
    > KB 286401 states
    > >that this setting is not supported by MS.
    > >
    > >-Steve Jansen
    > >
    > >"sundeeps@niit.com" <anonymous@discussions.microsoft.com>
    > wrote in message
    > >news:06d601c39315$9f30aef0$a001280a@phx.gbl...
    > >> hi, i have a web application residing on a web server
    > [w]
    > >> and a file server [s]. Both the servers are part of same
    > >> domain [d].
    > >>
    > >> now, i want to access shared folders from my web
    > >> application but the access should be given to only those
    > >> users who has permission on shared folder.
    > >>
    > >> I set up impersonate in my system and m using windows
    > >> authentication, but still i get access denied error.
    > >>
    > >> Need help
    > >
    > >
    > >.
    > >

    Steve Jansen Guest
    Reply With Quote Reply With Quote
  5. sandy #5

    Default Re: shared folder access

    i tried using adsutil.vbs !
    >-----Original Message-----
    >Did you use adsutil.vbs to delete the UNC parameters, or
    did you try to use
    >the GUI tool (inetmgr.exe)?
    >
    ><anonymous@discussions.microsoft.com> wrote in message
    >news:0b0001c393ae$591ea900$a301280a@phx.gbl...
    >> Thanks Steve. Your options are really logical. However,
    i
    >> tried with the basic autjentication as we r on intranet
    >> and its ok for us to pass in plain text too.. but seems
    it
    >> doesn't work.
    >>
    >> also, i am not able to delete the UNC parameters too as
    >> you did..
    >>
    >> >-----Original Message-----
    >> >I suggest reading the Patterns & Practices
    >> whitepaper "Authentication in
    >> >ASP.NET: .NET Security Guidance":
    >> >[url]http://msdn.microsoft.com/library/default.asp?[/url]
    >> url=/library/en-us/dnbda/html/authaspdotnet.asp
    >> >
    >> >Impersonation is not enough to accomplish what you
    want.
    >> You require
    >> >account delegation from your physical server running
    IIS
    >> to your physical
    >> >server hosting the file share.
    >> >
    >> >Option 1
    >> >---------
    >> >Your first option is to use Basic Authentication in IIS
    >> over SSL. This way,
    >> >the inetinfo.exe process has your credentials in
    >> plaintext and can logon to
    >> >the remote file server on the end-users behalf.
    >> >
    >> >Option 2
    >> >---------
    >> >Alternatively I have gotten this to work before with
    >> Windows Authenticaion,
    >> >but, it is not straightforward:
    >> >1) Enable Windows Authentication in IIS for your web
    app
    >> >2) If you create a virtual directory that maps to your
    >> UNC share, manually
    >> >delete the UNCUserName and UNCPassword metabase values
    >> using adsutil.vbs.
    >> >This will remove the UNC user token credentials
    >> (something that cannot be
    >> >done through inetmgr.exe). Doing so causes IIS to
    >> attempt delegation using
    >> >the current logon credentials.
    >> >3) Even though inetinfo.exe runs as LocalSystem, I had
    >> to create an AD
    >> >Service Principal Name. First, I had to set the
    >> option "Trust this computer
    >> >for delegation" for the IIS Computer AD object. Then,
    I
    >> had to issue the
    >> >setspn.exe command, which I remember being :
    >> >
    >> >setspn -A HTTP/myhost.mydomain.com myserver
    >> >
    >> >
    >> >4) For IE clients, I had to add myhost.mydomain.com to
    >> the LocalIntranet
    >> >zone. I would guess this caused IE to use Kerberos
    >> authentication instead
    >> >of NTLM. It may have also had something to do
    >> with "Automatic Logon in
    >> >Intranet Zone only"
    >> >
    >> >Connected IE clients should then browse the remote file
    >> share using their
    >> >credentials and appropriate ACLs. You should be able
    to
    >> confirm this by
    >> >enabling complete auditing of file access for your
    share
    >> and checking the
    >> >event viewer. I believe there are major performance
    >> implications for this,
    >> >due to the increased network activity of IIS performing
    >> delegation and UNC
    >> >file operations.
    >> >
    >> >Option 3
    >> >---------
    >> >You can also set the UNCAuthenticationPassthrough
    >> metabase attribute to True
    >> >to accomplish this. The article @
    >>
    >[url]http://msdn.microsoft.com/msdnmag/issues/0700/websecure2/d[/url]
    >> efault.aspx
    >> >provides a good discussion of this setting. However,
    the
    >> KB 286401 states
    >> >that this setting is not supported by MS.
    >> >
    >> >-Steve Jansen
    >> >
    >> >"sundeeps@niit.com"
    <anonymous@discussions.microsoft.com>
    >> wrote in message
    >> >news:06d601c39315$9f30aef0$a001280a@phx.gbl...
    >> >> hi, i have a web application residing on a web server
    >> [w]
    >> >> and a file server [s]. Both the servers are part of
    same
    >> >> domain [d].
    >> >>
    >> >> now, i want to access shared folders from my web
    >> >> application but the access should be given to only
    those
    >> >> users who has permission on shared folder.
    >> >>
    >> >> I set up impersonate in my system and m using windows
    >> >> authentication, but still i get access denied error.
    >> >>
    >> >> Need help
    >> >
    >> >
    >> >.
    >> >
    >
    >
    >.
    >
    sandy Guest
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may post replies
  • You may not post attachments
  • You may not edit your posts

Forum Rules


1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139