Take the 2-minute tour ×

Environment: win2003 running IIS6 serving asp pages that call delphi code.

Delphi code contacts a c# webservice for which it needs to login (login.asmx). Webservice logs show login is successful. Debug results show that Context.User.Identity.IsAuthenticated returns true.

After login, delphi code doublechecks if it is still authenticated. Webservice returns false -> Context.User.Identity.IsAuthenticated returns false.

Our guess: authentication cookie received by delphi code running under IIS6 credentials (network service?) does not get saved to disk, so login is lost.

Filemon shows 'C:\WINDOWS\Temp\Temporary Internet Files' access denied. Giving IIS6 user admin rights on that folder fixes the problem, but is not acceptable since cookies should work by default.

Running IIS6 in IIS5 compatibility mode fixes the problem, but is also not preferred

Wanted solution: exact cause of problem and smallest modification possible in configuration (giving admin rights to IUSR is not an option)

share|improve this question
add comment

2 Answers

Cookies do work by default, but you have to have somewhere to store them. If you don't want to give access to the normal place where they are stored, then you will need to set up another directory that you can give rights to and set it up as the internet cache for the IIS6 user.

share|improve this answer
I expect the IIS6 to have a default location where it has the rights it needs. Or is it default behaviour for Windows2003, IIS6 to not have cookies working out of the box ? –  Uytterhaegen Tommy Nov 26 '08 at 14:09
add comment

A couple quick resources that may help, given that for this type of problem you have a fairly large number of potential issues:


One important difference between IIS5 and IIS6 is that Windows 2003 underwent a significant security lockdown with the SP1 update. There are a very large number of things that worked for Windows 2000 that just will not in 2003 (and should not have - they opened the door to all sorts of shenanigans). Trying to track down all the places where IIS6 locked stuff down might be challenging, instead I would use the above resource to track down the common issues people are running into with IIS6.

share|improve this answer
add comment

Your Answer

