How do I deal with web role .aspx page running under a restricted user?

Question

Turns out the web role.aspx page and web role code run in two separate processes with the default "Full IIS" mode. The problem for the application I'm to port is that.aspx handler needs access to the local filesystem and since it now runs under MachineName\\NETWORK SERVICE account it has no such access.

AFAIK I could do one of the following.

First, I could grant access to necessary subfolders to user MachineName\\NETWORK SERVICE while in an startup task. That will work, but looks insecure - anything running under MachineName\\NETWORK SERVICE will get the same access and this can introdude a vulnerability.

Second, I could somehow force IIS to run the role website in a dedicated pool running under a dedicated user and grant access to that user. That sounds good, but I'm not sure I can do that (specifically force IIS to create a dedicated pool running under a specific user) automatically - either within a role configuration file or within a startup task.

Third, I could move all dealing with the filesystem onto the code that belongs to the role and is running inside WaIISHost.exe . That will require some redesign.

Which option of the above is most convenient and follows best practices most closely? What other options are there? How do I address the situation?

Answer 1

Second, I could somehow force IIS to run the role website in a dedicated pool running under a dedicated user and grant access to that user. That sounds good, but I'm not sure I can do that (specifically force IIS to create a dedicated pool running under a specific user) automatically - either within a role configuration file or within a startup task.

Wade Wenger's blog is brilliant for this type of question

Here's how to setup the web role under a specific user:

http://www.wadewegner.com/2011/01/programmatically-changing-the-apppool-identity-in-a-windows-azure-web-role/