I am using IIS 7.5 and I want to impersonate users for my different applications in an intranet environnement. To do so, I am considering using the asp.net mechanism with the user/password in the web.config (encrypted), but I'm unsure about some possible threats. I'll explain it with a concept (I know my example is useless but it represents my situation so please bear with me)

Let's say that I have 2 directories:

  • One empty directory (DirectoryA) that permits access to all users (ntfs permissions) and that contains a web.config that impersonates UserA

  • One directory (DirectoryB) containing a web site that I want to restrict access to, which also contains a web.config that impersonates UserA (same user as DirectoryA, not a typo)

To have the impersonation going on DirectoryB, I need to give ntfs permission allowing UserA in DirectoryB.

My question is: is it possible for someone to access DirectoryA (which will impersonate him as UserA) and then somehow access the site on DirectoryB using the impersonated UserA? If it is, how?

Thanks for any insight

  • when both directories impersonate as U_A, how does it matter if the user is coming from D_A or D_B? i don't get the question i guess ;)
    – santa
    Apr 16, 2013 at 7:22
  • 2
    maybe try to ask your question over at serverfault :D
    – santa
    Apr 16, 2013 at 7:23
  • Well, this is because D_A allows everyone to enter but it is an empty directory. My understanding is that (this is where I'm unsure), since it is empty, this request shouldn't go anywhere else even if the user got impersonated to U_A. Could someone somehow redirect the request to D_B (which only allow access to certain users AND U_A) and gain access to D_B by "proxying" a request by D_A? I already stated that this example is kind of dumb, but it perfectly represents my question. Cheers
    – ChG
    Apr 16, 2013 at 10:41
  • normally a webserver shouldn't allow someone to evade its configured root. as soon as the webserver hands over control to usercode such evasions happen frequently (e.g. quack for "directory traversal") so i'd say it should be safe (as long as no one's got the right iis-exploit at his hands). but why not use an dedicated "anonymous" context in the first place?
    – santa
    Apr 16, 2013 at 19:14

2 Answers 2


IIS 7.5 should keep both sites independant even if the user is the same. I would advise to run the sites in different application pools. :)

But both sites will have access where the user is defined to have access.

So if your web application is not strong enough it might exist the possibility of trying to navigate to the other directory.

"Use ASP.NET impersonation when you want to run your ASP.NET application under a security context different from the default security context for ASP.NET application.

If you enable impersonation for an ASP.NET application, that application can run in one of two different contexts: either as the user authenticated by IIS 7 or as an arbitrary account that you set up. For example, if you were using Anonymous authentication and chose to run the ASP.NET application as the authenticated user, the application would run under an account set up for anonymous users (typically, IUSR). Likewise, if you chose to run the application under an arbitrary account, it would run under whatever security context was set up for that account."

source: http://technet.microsoft.com/pt-pt/library/cc730708(v=ws.10).aspx


I have no "Comment" button, so forgive me if this is not a full answer. Maybe a moderator can convert it to a comment if necessary. But at least I can partially answer your question.

You ask "is it possible for someone to access DirectoryA...". Per default directory browsing is not enabled and you say the directory is empty. This means nothing will be returned and you get a 404 not found error when accessing DirectoryA.

If a user makes a second request (afterwards) and accesses DirectoryB, and userA has access there, you get access. There's no difference if you access DirectoryB or A first.

You are talking about an encrypted user/password in web.config. I'm not sure what you're talking about there, maybe the database connection? In IIS, Basic Settings, Connect As, you define how IIS accesses the files. That can be either "pass through" or a specific user. You talked about a specific user, so that user must have access to the files then. On the other hand you say DirectoryB is restricted, so then you have to use pass through, so that you can limit the permissions on the files.

As a tag you mention ASP.NET. That's another topic. If you're doing authentication via any .NET method, then that's an application question. In any case your question is kinda fuzzy, so it's not clear what to answer to. Maybe you provide some more details or be more clear on what you want to know.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .