I created a stand-alone version of the FileManager module (c#) and added the app to an existing .Net web site. Everything works fine, all the pages render correctly, etc., only I can't upload or edit files. I keep getting a 'permission denied' error.

I made sure that Anonymous browsing was disabled in the folder where the FileManager pages are, and that the account I'm logging in with has FullControl within the directory structure of the web site. Still no help. The only way I can upload/edit is by giving the I_USER account FullControl within the folders. If I understand things correctly, when Anonymous browsing is disabled (I have Windows Authentication selected), any code that executes on the server does so with the rights of the authenticated user. Am I worng? If so, how do I get edit/upload to work without giving the Anonymous User FullControl access?

TIA

Michael Caruso
MMAC Webmaster
Oklahoma City, OK

You need to select "Windows Integrated" authentication in IIS, and enable impersonation in your web.config:
<identity impersonate="true"/>

If you do not specify a name attribute, then ASP.NET will use the identity passed to it by IIS, which will be the network identity of the user.

You are correct that you must not give "full control" to IUSR_Machinename if you are counting on Windows Authentication to protect your files. Only the correct Windows users should have "full control".

http://msdn.microsoft.com/library/de...ersonation.asp

Eric

That did it. Works great. Mostly.:)

My real real goal was to add this to a web site in our DMZ, where the content is hosted on a file server behind the firewall. Any suggestions?

Michael Caruso
MMAC Webmaster
Oklahoma City, OK

If you're using Active Directory to hold user accounts, you can put a hive in the DMZ to surface the accounts there. However, this isn't very easy unless you have someone who is good at AD, and it can be a security risk if it's not set up right.

The easy solution is to use Forms security, and you can use a cookie to persist user sessions on their own computers. This way they don't have to log in each day.

You could also ensure that all users come from the right IP range *AND* they have a cookie. That's a good double set of checks.

Eric