IIS 7.5, Multiple Application Pools, and URL Rewriting (403.18 — Forbidden)

application-poolsiis-7.5isapi-rewrite

Is there any way to configure IIS 7.5 to perform URL rewrites to different application pools on the same site without running into a 403.18 error?

We're using Helicon ISAPI Rewrite 3 on IIS 6 and it's working like a charm. The root-level "application" is running under it's own application pool, and on IIS 6 we have no problems doing URL rewrites from that application pool to any one of the other four application pools. But when I copy the same server configuration information over to IIS 7.5 the URL rewrites to any of the other application pools fail with a "403.18 — Forbidden" error.

The weird bit is that the IIS 6 is not (at least as far as I can tell, by looking at the site Service configuration dialog) running under IIS 5 emulation mode, so somehow the rewrites aren't throwing 403.18 errors. So something must be different… but whatever it is, I sure haven't been able to figure it out.

Btw, we're not married to Helicon ISAPI Rewrite. If there's another way to preserve our current rewrite configuration rules using another module or method I'd be more than happy to use it.

Best Answer

In IIS you cannot just route request from one application to another. Applications are isolated, that is why you are getting 403 error.

You can proxy requests using either ISAPI_Rewrite, Ape or ARR - it does not matter because request will be passed to another application using local HTTP request anyway. This solution is quite stable, but you will lose some performance.

Redirect is probably not an option here, because it will generate two request to the server anyway, but since request will be generated by the user with slow connection performance may drop significantly.

Related Solutions

IIS 7.5 One Application Pool works, a second one doesn’t work

You are connecting to a SQL-Server with integrated Security right? It seems the second pool identity does not have access to your SQL-Server/database.

Using ApplicationPoolIdentity, your app is connecting to SQL-Server as something like:

IIS AppPool\AppPoolName

make sure that both Application pool identities have access to your server and the database in question.

I could create a Windows group to put the various Application pool identities in and then give that Windows group access to your database.

Also check this question, which seems to address a similar problem and suggest a reboot of the server.

IIS 7.5 folder and web site permissions

If you've created the website using the usual IIS7.5 out-of-the-box defaults then your "test website" will have had an application pool created for it as well.

The default identity that the site will execute requests as is ApplicationPoolIdentity. ApplicationPoolIdentity is a special synthesised account that is created on the fly and represents the identity of your site's application pool.

You state:

physical path has "IIS AppPool\DefaultAppPool" read and execute

This would explain why you're getting the 500.19 error. Unless you assigned the site to the "DefaultAppPool" application pool this permission won't be doing anything useful.

You need to assign the ApplicationPoolIdentity of the site (at least) read and execute permissions. To do this execute the following from the command line:

icacls <path_to_site> /grant "IIS APPPOOL\<app_pool_name>"(CI)(OI)(M)

Where <app_pool_name> is the name of the application pool that was created for your test site. You can find its name by executing:

appcmd list app /site.name:"<your site name>"

This will return something like and displays the name of your site's application pool (which ApplicationPoolIdentity is named after:

APP "test site/" (applicationPool:test site)

Best Answer

Related Solutions

IIS 7.5 One Application Pool works, a second one doesn’t work

IIS 7.5 folder and web site permissions

Related Topic