如何设置IIS Web应用程序，使其无需AD即可访问网络共享？

Question

I have three Windows Server 2012 R2 without any AD in a DMZ network. Two servers are front end web servers with ASP.NET and one have SQL Server and a network share that both front end servers use for shared data.

My problem is how do I configure the Application Pool identity and the Network Share so the ASP.NET application can read and write to the network share?

This is simple with an AD available when you can use domain accounts for the application pool identity but there is no AD available in this setup.

Answer 1

I will answer my own question since I succeeded to setup the server. This is what I did:

1) Create an account with the same username and password on all three servers. Make sure that does not expire or must be changed.

2) Create a Network Share and give the new account read/write rights. I also tested that I could connect from the front end servers using the new account to verify that no firewalls are in the way.

3) Included the user in the IIS_IUSRS group that indirectly gives it Logon as Batch Job rights.

4) Run the following command to grant rights to the user

aspnet_regiis -ga <your_app_pool_user>

See more: How To: Create a Service Account for an ASP.NET 2.0 Application (MSDN)

5) Restarted WAS and IIS to make sure the changes to the accounts group membership takes hold if tried to use the account.

C:> net stop was /y
C:> net start w3svc

6) Create an Application Pool and set the Identity.

This is the part where I got stuck with error messages when trying to set the identity.

From IIS Manager I got the following error dialog: "There was an error while performing this operation. Details: Value does not fall within the expected range."

Trying to set the App Pool identity from the command line I receive a similar error:

C:> appcmd set config /section:applicationPools 
     /[name='test-pool'].processModel.identityType:SpecificUser 
     /[name='test-pool'].processModel.userName:MyAccountName 
     /[name='test-pool'].processModel.password:P@ssw0rd

ERROR ( hresult:80070057, message:Failed to commit configuration changes.
  The parameter is incorrect.
 )

When I remove the last parameter, password, the command will succeed changing identity type and setting the username but I did never figure out why I could not set the password so I retorted to editing my applicationHost.config file directly. Unfortunately with the the password ending up in clear text.

<configuration>
   ...
    <system.applicationHost>
        <applicationPools>
            ...
            <add name="test-pool" managedRuntimeVersion="v4.0">
                <processModel identityType="SpecificUser" 
                  userName="MyAccountName" password="P@ssw0rd" />
            </add>
            ...
        </applicationPools>
        ...
    </system.applicationHost>
    ...
</configuration>

7) Finally I set my Web Application to use the application and it could access the Network Share without any issues.

Answer 2

I had the same problem but couldn't let the password in clear text so I dig a little further and found this article : http://social.technet.microsoft.com/wiki/contents/articles/30344.custom-iis-app-pool-identity-value-does-not-fall-within-the-expected-range.aspx

The key step to diagnose is to look at the right events :

To figure out how to resolve this, I went into the event viewer. There was nothing in the Application log, so I headed down to Applications and Services Logs => Microsoft => Windows => IIS-Configuration. The logs in here are disabled by default, so they have to be enabled. (To do so, right click the log, and choose Enable log.) Once enabled, re-run the attempt to set the identity, and refresh the view (Actions pane or F5), and voila!, now we have some more information on the error. In the results were two Errors (event ID 42 and 43).

I had the same event errors as in the article :

ID 42: Failed to initialize the 'IISWASOnlyAesProvider' encryption provider in '\\?\\C:\\windows\\system32\\inetsrv\\config\\applicationHost.config'. Please check your configuration.

ID 43: Failed to encrypt attribute 'Microsoft.ApplicationHost.AesProtectedConfigurationProvider'.

Then I did the following :

• restore an old version of the ConfigEncKey.key file (to c:\\windows\\System32\\inetsrv\\config )
• replace the <configProtectedData><providers> section by an old one (in c:\\windows\\System32\\inetsrv\\config\\applicationHost.config )

Then I can again set a custom identity to the application pool.

Answer 3

Had similar problem. Reinstalled the IIS Manager and got a new applicationHost.config When I did the WinDiff on the new and old files I noticed that the SessionKey were different. Works now. AesProvider and IISWASOnlyAesProvider