CODEWITHSUNDEEP
c#sql-servercross-domaindatabase-connectionwindows-authentication
Alezis
Alezis

Reputation: 2759

Connecting to different databases on different domains using Windows Authentication

I have to work with 3rd party tool that connected on different DBs/Servers to collect some data and do some work. It is not important what this app do just note that it connects to Server1\DB1 and Server2\DB2 on Domain1. Both servers use ONLY Windows Authentication (i.e. client have to connected with IntegratedSecurity=true). This approach works pretty well in Domain1. But one day we decided to move this app working on another domain (business reasons). We created mirror of Server1\DB1 on another domain (let call it Server1IOtherDomain\DB1). Currently this app can work with Server1OtherDomain\DB1 because I run it as user of new domain and it seems everything OK. We just need support fresh version of DB on our environment. However few days ago we have recognized that connection string to Server2\DB2 is hardcoded and we can't do the same with Server2\DB2 (to create mirror on our OtherDomain). Obviously, some part of functionality is not working just because it can't reach Server2\DB2 in Domain1. To summarize I have picture:

enter image description here

My 2 questions:

  1. Is it possible to run somehow application in OtherDomain to have it connected to both DBs in different domains ?
  2. Is it possible to make C# program that can be connected for various servers in different domains? For example using different Windows Authentication to different hosts, how to manage such cases?

Upvotes: 0

Views: 2200

Answers (1)

Bernd Linde
Bernd Linde

Reputation: 2152

To answer your second question:
It is possible to have a C# program that can be used across different domains, have a look at this answer for a simple C# implementation, this Q/A for more details about cross domain authentication and this question for a bit more specific issue related to SQL Server and cross domain authentication.
There are steps that you will need to take to make both domains trusted by each other to allow for a connection from the one to the other, this however also opens both domains to more security concerns and such decisions need to be evaluated and made by the network administrators.

I would also recommend that you have a look WindowsIdentity.Impersonate and WindowsImpersonationContext for examples and additional information as to how to specifically implement impersonation.

Upvotes: 1

Related Questions