Upload/Download Security Question

[Guest]

Hello, I am following along with an example of how to do uploads and download
from your application.

The download seems to wok just fine, but the upload does not. Each time I
attempt to upload, I get and exception with the error message being "{"Logon
failure: unknown user name or bad password.\r\n" }". I am trying to move the
file to shared directory on another server, and I am guessing that perhaps I
need to do something on my shared server to allow my application to be able
to write files to it. What exactly do I need to do, or is there some other
error? Here is the code I an using to upload files....

string loadDir = @"e:\products\Speed\Attachments";
System.Web.HttpPostedFile postedFile = uploadedFile.PostedFile;
string filename = Path.GetFileName(postedFile.FileName);
string contentType = postedFile.ContentType;
int contentLength = postedFile.ContentLength;
postedFile.SaveAs(loadDir + _DirectorySeparatorChar.ToString() + filename);

Are there some considerations that I should make for where I locate the
directory where I uploade files? I think I have heard that is should
segregated from where my application is, does this mean the same server or
should it be isolated to a different server?

Thanks in advance for your assistance!!!

 

[Steve C. Orr [MVP, MCSD]]

By default the ASPNET user account does not have access to network
directories. Either grant it access or have ASP.NET run under a different
user account by using impersonation.

For example, you can add a line similar to this to your web.config file:
<identity impersonate="true" userName="domain\MyAppUser">
password="password"/>

For testing purposes you can have it use your user account since you know
you have the necessary permissions to write to that network location.

Here's more info on impersonation:
http://msdn.microsoft.com/library/d...-us/cpguide/html/cpconaspnetimpersonation.asp

 

[Guest]

Thanks...But why does it work when I am physically signed on? Is it not
using the ASP.Net account then?

Do I just grant MachineName\aspnet the access event though my ID is logged
on to the domain account?