David
Fri Jan 21 17:16:25 CST 2005
ISAPI Filter is loaded by and executes as the configured Application Pool
process identity (unless the filter chooses to impersonate) -- so giving
IUSR/IWAM permissions is really unnecessary.
This is different from ISAPI Extensions, as those DLLs are loaded and
executed by the impersonated identity -- which can be IUSR for anonymous
access.
IWAM is simply a legacy user identity for COM+ Process model -- the
predecessor to IIS6 Application Pool process model -- and since ISAPI
Filters never load out-of-process, you would never need to ACL it for access
by IWAM.
So bottom line, you should:
1. ACL the ISAPI Filter DLL and its parent folder/paths to allow
read/execute access to the IIS_WPG security group.
2. Remove any other ACLs on ISAPI Filter DLL
--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Jay Hulslander" <jdh34@cornell.edu.REMOVETHIS> wrote in message
news:csrpvv$91i$1@news01.cit.cornell.edu...
Hi all,
I have a windows 2003 server with IIS 6 installed. I have loaded an
ISAPI filter onto a website. Everything is running fine as expected.
I have another windows 2003 server with IIS 6 installed. I am trying to
load the same ISAPI filter onto a site on this box. The problem is, this
second server will not load my filter. I have been tracking this problem as
that there is a security issue going on. Such as the IIS users do not have
access to the DLL. I have verified that the IIS users (iusr and iwam) have
access to the filter dll and it's config file. What other reasons would
prevent a filter from loading? Keep in mind, the filter loads fine on my
other windows 2003 server.
Thanks for your help,
Jay