9

I have always used "Network Service" as the application pool identity for Sitecore since 6.0 through 8.1 and never had any problems. A co-worker stated recently that the "AppPoolIdentity" is the recommended version for 7+. What is the recommended identity?

Improve this question
1
  • 2
    Have you considered using a separate service account? I recommend using something like domain\service.scprod, that way your connection strings to the database use the application identity rather than containing the username/password.
    – Michael West
    Commented Dec 12, 2016 at 19:33

2 Answers 2

Reset to default
11

You can use either, but I recommend ApplicationPoolIdentity whenever possible. TBH, your question really isn't Sitecore-specific, but the below info should help to get you started.

Application Pool Identity vs NETWORK SERVICE

The security of ApplicationPoolIdentity will always be greater than or equal to that of NETWORK SERVICE, given that the same access rights are applied to both.

When using AppPoolIdentity, you have a separate identity (security account) for each app pool. This means that you can control the services and securities for your application pool, specifically, agnostic of any other application pools or services. In other words, if you have multiple services and/or applications then ApplicationPoolIdentity is more secure, otherwise it is pretty much the same, though ApplicationPoolIdentity is more extensible (and a bit easier to read in Windows Event Logs, IMHO).

In contrast, NETWORK SERVICE can be used for any/all of your services, i.e. it can be used by more than one without issue. While this sounds like a nice feature that might save you some time, this actually means that if you use it your securities cannot be controlled on a service-by-service or application-by-application basis. All services and/or applications that use NETWORK SERVICE will have the same permissions, which can be a pretty big security risk.

Food for Thought

Imagine that you use NETWORK SERVICE on your site and you also happen to use NETWORK SERVICE on an IIS-based service that a hacker manages to break into. Imagine that the hack allows the hacker to access the server's file system. Because you used NETWORK SERVICE for the application pool's security account, the hacker now has access to your site's folder and to anything that your site had access too. Now, the hacker can not only gain access to your site's ConnectionStrings and web.config, but also to things in your System folder (since Sitecore requires access to some of the System folders), your databases (since they have your ConnectionStrings), and beyond!

More information

This post from iis.net gives a good description of the different security accounts that you can use and their similarities/differences.

Improve this answer
1
  • Exactly what I was looking for Zach. Thanks!
    – Toby Gutierrez
    Commented Dec 12, 2016 at 20:42
3

From the installation guide I can see Sitecore recommend ApplicationPoolIdentity or NetworkService.

Please see: https://dev.sitecore.net/~/media/Downloads/Sitecore_Experience_Platform/8_0/Sitecore_Experience_Platform_8_0/Non-secure/Installation-Guide-SC80-A4.ashx enter image description here

on chapter 4.3 Configuring the IIS

More information about Application Pool Identities : https://www.iis.net/learn/manage/configuring-security/application-pool-identities

Improve this answer
1
  • +1 for the documentation :) @TobyGutierrez note that while the docs linked to are for Sitecore 8.0 the same applies to all other versions of Sitecore 8.0, as well
    – Zachary Kniebel
    Commented Dec 12, 2016 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.