Skip Ribbon Commands
Skip to main content

Robin | zevenseas | SharePoint Blog

:

The zevenseas Community > Blogs > Robin | zevenseas | SharePoint Blog > Posts > SPApplicationPool
March 04
SPApplicationPool

As always, I was wandering through the OM of our beloved SharePoint searching for getting to the Application Pools of a WebApplication. The case is that for our beloved LCM tool I was trying to get all the application pool accounts and add those to the LCM web as contributors.

Since I came across an issue regarding the fact that when a site or a web is deleted and you’ve checked ‘Log the deletions in SharePoint’ in the configuration page. The application pool accounts couldn’t get access to the “Deleted Sites” list on the LCM Web. (btw this is still an issue and is not solved by adding the accounts to the Web. This is due to the fact that the service accounts must be added as a farm admin to the Central Admin.. and we don’t want that either ;).

But to come back to the topic.. I’ve found an interesting class and that is the SPApplicationPool class. And.. well.. I was shocked to find out that there is a property called “Password”. Well actually I wasn’t shocked to found out that the property existed.. but I was shocked to find out that the property was not only settable but also gettable!!

So when running the following piece of code..

SPWebApplicationCollection webApplicationCollection = SPWebService.ContentService.WebApplications;
foreach (SPWebApplication webApplication in webApplicationCollection)
{            
    SPApplicationPool applicationPool = webApplication.ApplicationPool;
    Console.WriteLine("WebApplication " + webApplication.Name);
    Console.WriteLine("Username " + applicationPool.Username);
    Console.WriteLine("Password " + applicationPool.Password);
}

..it will give you the passwords of each application pool account. Though I must say that this of course will only run if you logged in as a farm admin since this comes out of the SharePoint.Administration namespace. But I must say that this is quite tricky..  especially when there is another property in there called “SecurePassword”.

Please let me know your thoughts ;)

I’m going back to work on a different solution to store those damned deleted sites..

Technorati Tags: ,

Comments

Mike Watson

yep, the SharePoint OM will tell you pretty much every password used by your deployment in plaintext. I don't see too many ppl thinking about security in this situation.
System Account on 04/03/2009 12:56

Daniel McPherson

I think this is an excellent example of why you should be implementing "Best Practice" when it comes to deployment. Application Pool accounts should not have farm admin rights, unless there is a very very good reason. If you do this, you better trust the code you run.
System Account on 05/03/2009 04:43

Bas Lijten

I wasn't aware of your blog either ;)
System Account on 28/05/2009 03:22
 

 Statistics

 
Views: 1592
Comments: 3
Tags:
Published:1540 Days Ago