I was trying to get security impersonation working in an ASP.NET app so that database access would work correctly. For reference, to impersonate a user, add this to the web.config file:
The password is stored in plain text format, this is a bit scary but that looks like the way to do it. There must also be a way of using IIS to do the impersonation but I couldn’t get that up.
Now that the app is impersonating the MyDatabaseUser account, it no longer has access rights to the temporary ASP.NET folder. This gives a yellow screen of death with the following error:
Access to the path "C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\Temporary ASP.NET Files\\MyApplication\\XXXX\\XXXX\\hash.web" is denied.
To resolve this, the account needs to be given write permission to the temporary folder. Browse to "C:\[windows]\Microsoft.NET\Framework\[.net version]", open properties for the Temporary ASP.NET Files folder and go the Security tab. Add your database user account and give it the same permissions as the NETWORK SERVICE user (full control). Once this is applied the user (and therefore the application) will have access to the temporary folder root. Now you can move on to the next YSOD.