Improving Web Application Security: Threats and - CGISecurity

Chapter 20: Hosting Multiple Web Applications 595Anonymous Account ImpersonationWith anonymous account impersonation, your application impersonates theanonymous account specified by IIS and configured for your application’s virtualdirectory. You can use this approach if your application authenticates usersindependently of IIS, for example, by using Forms or Microsoft Passportauthentication. In these scenarios, you can isolate the application by using a fixedanonymous account. Once the caller is authenticated and roles are checked, thetrusted server model can be used for downstream resource access, where theconfigured anonymous account provides the trusted identity.To support this approach, the application’s virtual directories in IIS must supportanonymous access and a separate anonymous account must be configured for eachapplication. The application must then be configured for impersonation. Thisapproach is shown in Figure 20.3. Local and remote resource access assumes thesecurity context of the impersonated anonymous account.Web ServerIIS(inetinfo.exe)ASP. NET(aspnet_wp.exe)RemoteComputer(s)v-dir1IUSR_1AppDomain1IUSR_1RemoteResourcev-dir2IUSR_2AppDomain2IUSR_2RemoteResourcev-dir3IUSR_3AppDomain3IUSR_3RemoteResourceAnonymousAuthenticationImpersonationFigure 20.3Multiple anonymous accounts used for each application