IIS - Error 403.19 with IIS 6 and CGI file

Asked By philalber

12-Feb-07 12:39 PM

Hi,

I'm trying to run a .cgi file on my web site, but i'm getting the
error 403.19 in the log file.
I think the user running the app pool might not have all the necessary
rights or something but i can't find which one it should have.
Anyone that can help me out?

Thanks
Phil

16-Feb-07 06:19 PM

The two required user privileges for a custom user identity to run a
CGI are listed in IIS documentation online, under the section on
configuring Application Pool Identity.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

19-Feb-07 12:39 PM

My problem is fixed. I called Microsoft support this morning and
here's what they done.
They had me run this command: Cscript adsutil.vbs set W3Svc/
CreateProcessAsUser false
If i understand it right, this will make the cgi script use the user
currently logged.

Thanks for your blog link David, it's very interesting.

19-Feb-07 02:28 PM

The command the that PSS had you run makes all CGI on IIS run as the
Application Pool's process identity instead of the Impersonated
identity through authentication. It removes the need to add those two
permissions onto the Application Pool identity by making all CGIs run
with different permissions.

So yes, it works, but is it what you want to do? Or do you not know/
care, just as long as the CGI runs?


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

19-Feb-07 02:53 PM

Well if i can run those CGI it's good, but if it's not the best way to
make it happen i would like to know how to do it.
If i understand you correctly, there's 2 permissions i need to give my
application identity to make it work?
Sorry but i'm new to all of this...

Thanks
Phil

19-Feb-07 06:04 PM

Actually, I'm saying that there are multiple ways to accomplish the
task of "make CGI run on IIS6" with different consequences, and I am
asking you what you want to accomplish.

The difference between them is this -- in one instance, the CGI always
runs with the Application Pool's identity. In the other, the CGI
always runs with the identity obtained through authentication.

So, one way to choose between them is if you need to know the
authenticated user or behave differently for different users. There
can be other reasons; once again, you need to understand and come up
with the requirement.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

20-Feb-07 09:52 AM

I think the way it is wet right now if fine. Am i correct to say that
it is now, after changing the CreateProcessAsUser to false,   running
all CGI with the application pool's identidy?

Thanks