0

I am having specific issues in regards to IIS 8.5, Permissions, and Auditing. I have a PHP application running under KanboardPool identity and I've properly set permssions on the application 'data' folder to 'IIS APPPOOL\KanboardPool' to full control.

In addition, I've set IIS_IUSRS to Read, execute, and list on the same folder including parent. Regardless; I still get permission denied failures.

I've try to AUDIT file access failures without much luck: First through GPO Domain Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Advance Auditing -> Audit File Access Success and Failure. Which didn't log any Audit Failures. Same procedure through Domain Controller Policy and at last through Local Policy for whatever reason. Audit Policy Change is added then removed later in succession.

Through ACL, I ran a Effective Access test on selected Principal 'IIS APPPOOL\KanboardPool' which passed with flying colors. Now I am just stumped?

0

What made this issue particualy difficult to diagnose is that this wasn't reproducible under Default Web Site. When I placed the same application under C:\inetpub\wwwroot\subfoldeer\phpapplication under DefaultAppPool identity.

It was very easy for me to simply add Full Control to C:\inetpub\wwwroot\subfolder\phpapplication\data for DefaultAppPool and it simply worked.

After reading http://www.iis.net/learn/get-started/planning-for-security/secure-content-in-iis-through-file-system-acls; with fcgi.impersonate turned on in php.ini; it will automatically impersonate the authenticated user. Viola, turning this feature off, the PHP process assumed the AppPoolIdentity and work as expected.

Which explain why I wasn't getting file access failures for KanboardPool. However it doesn't explain while fcgi.impersonate that was turned on under Default Web Site initially wasn't reproducing the same behavior.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.