Iis – Configuring IIS to use multiple application pools for a single website

application-poolsiisiis-7.5

I have a web application/website running on IIS 7.5 and higher that I am trying to configure to use multiple application pools to segregate functions for security and performance purposes. The problem is when I create and use the second application pool the secondary function doesn't work. The rest of the site works fine, but as soon as I click a link that uses a resource in the secondary pool (link to ISAPI DLL that downloads a zip file) it gives a service unavailable message (404).

I have tried numerous configurations including giving full/admin permissions for App Pool Identity, Physical Path Credential, Windows file permissions, Windows Share permissions, etc (including using all of the same permissions for both application pools) with no change. The files are on the local server and not over a network (although in some case it will be run over a network). If I try the same configurations under a single Application Pool it works fine with multiple configurations, but as soon as I separate the main website function from the secondary function it breaks.

There seems to be something with separate Application Pools that overrides all other permissions to the resource. The strange thing is that I had this working on over 10 servers previously and it stopped working at some point and I don't know why. My guess is there was a Windows Update that "fixed" a security function that broke the config. I simply consolidated the application pools and it worked fine. Keeping this config in the future will be problematic as we move away from COMs and into something that is multi-threaded soon.

Any ideas or thoughts? I thought there might be some Application Pool Isolation security that I need to disable or something?

Best Answer

The only way to have multiple applications pools for one web sites on IIS is to split the site up into various applications, you always have the root application and potentially multiple application below it.

Each application can be assigned its own application pool.

But after splitting a site into various applications it doesn't behave as a single entity anymore, there are many things you can no longer do between these now separated parts of your site.

Without knowing the details it is difficult to diagnose why your second application pool fails. It may run under a different account, sessions are no longer shared etc.

There is nothing inherent in IIS that prevents you from running a site with various appPools, but each application is its own thing.

If you are saying it worked before on 10 servers and now it doesn't work on all of them, check what you have done to your configuration on all of them. I don't know of any security fix to Server 2008 R2 that changed it's behaviour, at least not since Service Pack 1.

Related Solutions

How to Assign Permissions to ApplicationPoolIdentity Account

Update: The original question was for Windows Server 2008, but the solution is easier for Windows Server 2008 R2 and Windows Server 2012 (and Windows 7 and 8). You can add the user through the NTFS UI by typing it in directly. The name is in the format of IIS APPPOOL\{app pool name}. For example: IIS APPPOOL\DefaultAppPool.

IIS APPPOOL\{app pool name}

Note: Per comments below, there are two things to be aware of:

Enter the string directly into the "Select User or Group" and not in the search field.
In a domain environment you need to set the Location to your local computer first.

Reference to Microsoft Docs article: Application Pool Identities > Securing Resources

Original response: (for Windows Server 2008) This is a great feature, but as you mentioned it's not fully implemented yet. You can add the app pool identity from the command prompt with something like icacls, then you can manage it from the GUI. For example, run something like this from the command prompt:

icacls c:\inetpub\wwwroot /grant "IIS APPPOOL\DefaultAppPool":(OI)(CI)(RX)

Then, in Windows Explorer, go to the wwwroot folder and edit the security permissions. You will see what looks like a group (the group icon) called DefaultAppPool. You can now edit the permissions.

However, you don't need to use this at all. It's a bonus that you can use if you want. You can use the old way of creating a custom user per app pool and assigning the custom user to disk. That has full UI support.

This SID injection method is nice because it allows you to use a single user but fully isolate each site from each other without having to create unique users for each app pool. Pretty impressive, and it will be even better with UI support.

Note: If you are unable to find the application pool user, check to see if the Windows service called Application Host Helper Service is running. It's the service that maps application pool users to Windows accounts.

IIS 7.5, Multiple Application Pools, and URL Rewriting (403.18 — Forbidden)

In IIS you cannot just route request from one application to another. Applications are isolated, that is why you are getting 403 error.

You can proxy requests using either ISAPI_Rewrite, Ape or ARR - it does not matter because request will be passed to another application using local HTTP request anyway. This solution is quite stable, but you will lose some performance.

Redirect is probably not an option here, because it will generate two request to the server anyway, but since request will be generated by the user with slow connection performance may drop significantly.

Best Answer

Related Solutions

How to Assign Permissions to ApplicationPoolIdentity Account

IIS 7.5, Multiple Application Pools, and URL Rewriting (403.18 — Forbidden)

Related Topic