I've just installed .Net 1.1 and upgraded to 3.0 on my W2K3 server and I
want to lock down ASP.Net so that my hosted users can't see each others
folders on disk. The disk is already secured via NTFS with separate user
and anonymous accounts for each hosted customer. But I don't want ASP.Net
to run as the "ASP.NET" user - I want it to run as a different user per
customer that I specify.

Can anyone point me at some documentation on how to do this?

[quoted text, click to view]



Two basic choices for identity-based security on Windows platform -
User Impersonation Identity or User Process Identity.

You are asking for User Process Identity:
1. Configure IIS6 to run in "Worker Process Isolation Mode", not "IIS5
Compatibility Mode".
2. Create one application pool per customer and set its the
Application Pool's Identity per customer. Make sure the user account
is in IIS_WPG.
3. Configure each hosted user's application(s) in their own
Application Pool

Caveat: This can limit the number of remote users you can have on a
machine because by default you can only have around 64 simultaneous
worker processes with different identities running simultaneously
before exhausting the Desktop Heap unless you toggle another registry
switch (I forget the name at the moment, but you can find it under
W3SVC in the list of Registry Key switches for IIS) which is meant for
hosting by using one Desktop Heap at the cost of a little security
(but you're hosting and there is always tradeoff of performance,
capacity, vs absolute security).

Search for documentation on Microsoft.com on how to do all of the
above.

In other words, isolating by worker process identity is pretty iron-
clad solution but it's not cheap. .Net Framework is expensive in terms
of memory/CPU resources on a per-process basis, so isolating them by
process is not cheap. Thus, you must make the tradeoff between iron-
clad security vs performance/scalability it terms of the amount of
system resources

Alternatively, you can isolate by impersonation (instead of worker
process identity), which is very cheap on memory/CPU resources, but
then depending on your configuration of security policy of .Net user
applications, including ASP.Net's default behavior to not impersonate,
may still be able to RevertToSelf() and get access to other user's
folders that way.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang