Assigning permission to an IIS application

Question

I have a .NET C# WebAPI running on IIS. The API is served on port 80 and, as part of its duties, connects to a local database service on a very specific port.

By default IIS assigns the built in account ApplicationPoolIdentity but it turned out to be too limited in terms of privileges: the app couldn't connect to the local database service.

I tried setting a custom account, an administrator, and it worked

I don't like the idea of having an IIS app running as administator. Is it possible to elevate the privileges of the ApplicationPoolIdentity user and give to it the bare minimum to work properly?

How can I specify the user to use on the web.config file?

Answer 1

Assuming SQL Server is running on the same machine and you aren't using a domain user account to set up the app pool, then you can elevate the permissions of the default app pool identity in SQL Server (or any app pool identity for that matter). The default app pool user should be 'IIS AppPool\\DefaultAppPool'. Replace the 'DefaultAppPool' with whatever app pool name you want if you don't want to use the default.