IIS Express 中所有静态请求的基本身份验证均出现错误模仿
我们正在尝试在项目中使用基本身份验证，该身份验证通常在我们的集成和 QA 环境中运行良好，甚至可以在 IIS 7.5 本地运行。但在 IIS Express 本地运行时，我们会遇到一些非常奇怪的问题 - 任何静态请求都会导致神秘的 HTTP 500 错误，告诉我们访问该资源时出现错误，可能是由于许多与权限相关的原因，错误代码为 0x80070542。同时，在 ASP.NET 中呈现的任何内容都会变得完美。
粗略搜索表明，该问题通常源于 IIS 帐户无法访问这些资源。这是运行下来的，IUSER 绝对可以访问资源——事实上，完全相同的文件夹在 IIS 7.5 中工作得很好；只有 IIS Express 会吐。并且只有当我们启用基本身份验证时——如果我们启用 Windows 身份验证，所有请求都会完美通过。
我们最终尝试运行 sysinternals procmon 来确定我们是否正在查看正确的用户以及是否是其他原因导致失败，并且我们发现失败的原因是“不良冒充”。但试图找出谁在冒充什么却毫无结果。据我们所知，考虑到在生产模式下与 IIS 一起工作以及任何类型的访问测试通过，IUSER / NETWORK SERVICE / 默认帐户确实具有适当的访问级别。运行 IIS Express 的帐户都是本地管理员，并且应该有权模拟。在本地安全策略中手动添加该权限没有任何区别。我只是看不到一种方法来解决这个问题，即明确定义一个模拟用户，而我确实不需要这样做。
那么，是否有正确的方法使 IIS Express 能够处理基本身份验证和静态请求？
We are attempting to use Basic Authentication in a project, which generally works fine in our integration and QA environment or even running locally with IIS 7.5. But running locally in IIS Express we get some very strange issues -- any static requests result in cryptic HTTP 500 errors telling us that there was an error accessing that resource, perhaps for a number of permissions related reasons, with an error code of 0x80070542. At the same time, anything rendered in ASP.NET comes out perfect.
Cursory searches indicate that the issue typically stems from IIS' account not being able to access these resources. This was run down and IUSERs definitely can access the resources -- in fact, the exact same folder works perfectly in IIS 7.5; only IIS Express barfs. And only when we enable basic authentication -- if we enable windows authentication all requests pass perfectly.
We finally tried running sysinternals procmon in an effort to figure out if we were looking at the correct user and if it was something else that was failing and we found that things were failing with a result of BAD IMPERSONATION. But trying to figure out who is impersonating what has been fruitless. From what we can tell, the IUSER / NETWORK SERVICE / default accounts do have appropriate levels of access, given things work with IIS in production mode and any sort of access test passes. The accounts running IIS express are all local admins and should have access to impersonation. Manually adding that right in local security policy has made no difference. I just can't see a way to fix this short of explicitly defining an impersonation user which I really shouldn't need to do.
So, is there a correct way to make IIS Express work with basic auth and static requests?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
IIS Express 以当前登录用户身份运行，并且不进行模拟。可能只是为了测试，您可以尝试将当前登录的用户帐户添加到 IIS IUser 组，看看是否有任何技巧。
IIS Express runs as current logged on user and does not do impersonation. Probably just for testing, could you try adding current logged on user account to IIS IUser group and see if that does any trick.
我终于得到了权威人士的更新，基本身份验证的深层内容在 IIS Express 8 中被破坏，这是一个已知的错误，不会在该版本中得到解决，但可能会在未来的版本中得到解决。
我们已经有了开发配置，所以我们只是使用 Windows 身份验证进行本地开发，因为这不会改变我们的应用程序的任何内容，并且我们已经有了独立的开发配置，但这可能不适用于所有情况。
I finally got updated on good authority that something deep within basic auth is/was broken in IIS Express 8 and this was a known bug that would not be addressed in that version but might be addressed in a future version.
We've already got development configs so we are just using windows auth for local development since that doesn't change anything for our apps and we've already got independent development configurations but that might not work in all cases.