I have an ASP.NET MVC 5 application running on IIS 8.0. Application pool is running under domain user, f.i. IISPoolUser. Anonymous authentication uses this identity as well.
I gave full control permissions on root pool folder (C:\inetpub\wwwroot
) and everything worked fine.
Now, I want to enable Windows authentication. When someone (f.i., WebUser) tries to access this application, he gets login prompt dialog and then gets 401 Unathorized - "Access is denied due to invalid credentials" error. A browser sends proper authentication headers - the problem is related to directory access.
If I give permission to user WebUser to folder C:\inetpub\wwwroot
, then it works fine. ASP.NET impersonation is disabled.
Why does IIS uses WebUser identity to access directory? I want IIS to access this folder as application pool identity - IISPoolUser. How to make it do this? I don't want to add Everyone to directory permissions, because it sounds wrong, in general - I want only allow to modify this directory through my IIS application.