I have an ASP app that reads data files and creates pdf and text files on a win 2000 web server. I have the read/write permissions set for the folder being accessed on my development server. Now that I'm ready to publish my application to the web, my IT support person (who does the actual publishing of my files) has informed me that setting the read/write permissions for the necessary folders on the web server is to dangerous (security issues) and he won't do it. He wants me to find a way to set the user permissions on the fly, then remove them once the pdf files are written, or find some other method.

I can make a login page, however I haven't been able to find code examples of setting permissions. I'm not sure if this can be done, and if it can, would I do it in an asp script or write an activeX DLL. I'd like to avoid making user's create and save logon id's, I'd rather generate some session ID or something with code and then destroy it once the session is closed.

Finally, is this really a security issue? Does any of the WROX books have any good examples to help me do this? Anyone have any ideas?

Thanks for your help.

IMO, as long as you read/write only thorugh your ASP application, it is not harm setting read/write permissions for those folders. Actually that is set only for the IUSR_yourMachine account, and that does no harm.

But you should be sure that you separate the folders that you use for creating text/pdf files from your other folders, so that permission is set only to these folders, not to the entire web app folder.

Hope that helps.
Cheers!

_________________________
-Vijay G
Strive for Perfection

Another possible solution is to generate the files in a folder outside the Web root, e.g. C:\MyGeneratedPDFs. This way, the system is allowed to create the files, but the "outside world" cannot access the writable folder.

Then in IIS, you can map a new read-only Virtual Directory to the folder, so your users can access the PDFs like /Downloads, for example.

HtH,

Imar
---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.

Imar, that's a very good idea. I'll give it a try.
Thanks