0

If you have a registered security trimmer, it gets loaded into an instance of w3wp.exe running as Network Service. My trimmer needs to connect to and authenticate to a remote service, so I'd like it to run as a domain account. I've found the app pool for this w3wp, but IIS admin says that there are 12 applications running in the app pool. Without knowing what else is running in that app pool, it's hard to know the effects of changing its account.

Is it possible to move the trimmer to its own app pool? Is there another way to change the account that my trimmer runs under?

1
  • "trimmer needs to connect to and authenticate to a remote service" -Are you trying to connect to this service in CheckAccess() method? Oct 18, 2011 at 7:36

2 Answers 2

0

Remote services usually have an option to provide appropriate credentials. For example, web service proxy classes have Credentials property for that:

Service1 myProxy = new Service1();
myProxy.Credentials = System.Net.CredentialCache.DefaultCredentials;
var result = myProxy.HelloWorld();
4
  • I'm not sure I follow. Won't that code authenticate as the current Windows identity? That's what I'm trying to change, and ideally I'd like to do it in such a way that SharePoint/IIS manages the credentials (e.g. in an app pool identity) rather than me having to handle plaintext login credentials.
    – bmm6o
    Oct 17, 2011 at 17:26
  • I'm afraid you'll have to deal with plain login data in this particular situation, as it is the most appropriate way here. Btw, even if you eventually will change app pool user, you will need to provide his login and password anyway. I don't see much difference between these two approaches, except of that providing credentials to particular webservice is much more flexible (tommorow you'll get another webservice, and it will need another user) :) Oct 17, 2011 at 17:56
  • And yep, DefaultCredentials are just for example here. You'll need to create your own CredentialsCache object and pass appropriate credentials. Oct 17, 2011 at 17:57
  • Example of doing this could be found on MSDN: msdn.microsoft.com/en-us/library/… Oct 17, 2011 at 18:01
0

From the Central Administration page, choose "Configure service accounts". You can change the account for "Service Application Pool - SharePoint Web Services Default", which is what hosts the Search Service Application. This pool hosts all 12 services listed, and it seems like they can't run as different accounts. As long as there is a single account that is appropriate to host all of these components, having SharePoint manage the credentials is far cleaner than managing it yourself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.