如何在 IIS 7.5 中授予网站创建更多网站的权限？
我正在 IIS 7.5（使用 Windows 7）中创建一个网站，需要能够创建更多网站。我编写了使用 Microsoft. Web.Administration 以编程方式创建网站，当我以管理员身份运行它时，效果很好。
现在我尝试在我的 Web 应用程序上下文中使用相同的代码。它因错误而失败
错误：由于权限不足，无法读取配置文件
文件redirection.config 的权限不足，无法读取配置文件（据我所知，该文件位于%WinDir%/System32/inetsrv/config 中）。
我尝试为此特定网站创建一个新的应用程序池，在 IIS AppPool[AppPoolName] 身份下运行。然后，我尝试授予该身份权限来编辑 IIS 配置，
ManagementAuthorization.Grant(@"IIS AppPool\MyAppPool", "Default Web Site", false);
但仍然遇到相同的错误。
我还应该尝试什么？
I'm creating a website in IIS 7.5 (with Windows 7) that needs to be able to create further websites. I've written code that uses Microsoft.Web.Administration to create the website programmatically, and this works fine when I run it as administrator.
Now I'm trying to use the same code in the context of my web application. It fails with the error
Error: Cannot read configuration file due to insufficient permissions
for the file redirection.config (which I understand is located in %WinDir%/System32/inetsrv/config).
I've tried creating a new apppool for this specific website, running under the IIS AppPool[AppPoolName] identity. I've then tried to grant that identity permission to edit the IIS config using
ManagementAuthorization.Grant(@"IIS AppPool\MyAppPool", "Default Web Site", false);
but I still get the same error.
What else should I try?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
从安全角度来看，这可能不是最明智的方法。如果该网站被劫持，那么您的攻击者将能够干扰这些文件（没有任何好处），甚至只是删除它们。
我们解决这个问题的方法是将网站创建任务分离到一个 Windows 服务中，该服务以正确的权限运行来执行这些活动。此服务中有一个远程处理端点（尽管现在您可能希望使用 WCF）。
然后，我们创建了一个在 GAC 中签名和注册的代理程序集（如果您以低于完全信任的方式运行，还需要使用 APTCA 属性进行标记）。该程序集将相关调用从管理 Web 应用程序/服务传递到 Windows 服务中的远程处理端点。
这使我们能够以至少特权和部分信任模式运行管理站点。通过站点管理任务可以完成的工作范围因 Windows 服务应用程序中公开的任何功能而有所缩小。
这是一种称为沙箱的技术。
This probably isn't the wisest approach from a security viewpoint. If this site is hijacked then your attackers will be able to interfere with those files (to no good purpose) or even just delete them.
The way we approached this was to separate website creation tasks into a windows service running with the correct rights to perform these activities. In this service is a remoting end point (although these days you'd probably want to use WCF).
We then created a proxy assembly that is signed and registered in the GAC (it would also need to be marked with the APTCA attribute if you're running at less than Full Trust). This assembly passes on the relevant calls to the remoting endpoint in the windows service from the admin web app/service.
This allows us to run the admin site at least privilege and in partial trust mode. The scope of what can be done by way of site admin tasks is narrowed somewhat by whatever functionality is exposed in the windows service application.
This is a technique known as sandboxing.
我已经找到了一种方法，但我非常想听听专家的意见，看看这是否是明智之举。
我将 IIS AppPool\MyAppPool 帐户的修改和写入权限授予 %WinDir%/System32/inetsrv/config 及其中的三个 .config 文件。
I've found a way to do it, but I would very much like to hear expert opinion on whether this is a wise thing to do.
I granted Modify and Write permissions for the IIS AppPool\MyAppPool account to %WinDir%/System32/inetsrv/config and the three .config files inside it.