CODEWITHSUNDEEP
asp.netsql-server
user724779
user724779

Reputation: 51

SQL Server Integrated Authentication Mode

I was wondering when using Windows Authentication mode in a connection string from a web application. Application itself is using Windows Authentication for authorization. Which account will be used to login to SQL Server.

Is't the web application pool account? User account who logged in to web application using windows auth? Any other account?

Application is running under Win Ser 2008 64 bit and IIS 7. Application pool account is Network Service.

Upvotes: 5

Views: 4224

Answers (3)

Jacob Pressures
Jacob Pressures

Reputation: 1461

The problem that i was having was that my application pool account in SQL Server needed to be set to the db_owner role before it worked. I spent a long time trying to figure this out.

I was using Windows Authentication, Windows 7 home premium, and IIS all on the same computer. I'm posting this in case someone else run into a similar problem. The book i used did not say to use db_owner but the reader and writer accounts instead.

Upvotes: 0

Shawn
Shawn

Reputation: 9402

It depends on how you configure it. From http://msdn.microsoft.com/en-us/library/ms998292.aspx and http://msdn.microsoft.com/en-us/library/bsz5788z.aspx ...

ASP.NET applications do not impersonate by default. As a result, when they use Windows authentication to connect to SQL Server, they use the Web application's process identity. With this approach, your front-end Web application authenticates and authorizes its users and then uses a trusted identity to access the database. The database trusts the application's identity and trusts the application to properly authenticate and authorize callers. This approach is referred to as the trusted subsystem model.

The alternative model referred to as the impersonation/delegation model uses the original caller's Windows identity to access the database. This approach requires that your ASP.NET application is configured to use impersonation. See the section "Impersonation / Delegation vs. Trusted Subsystem" in this document.

So depending on how you have configured it, it could use either the app pool account (not when not using impersonation) or the account of the logged-in user that is using the web application (when using impersonation).

See http://msdn.microsoft.com/en-us/library/134ec8tc.aspx for impersonation information.

Upvotes: 6

alexl
alexl

Reputation: 6851

It's the application pool user who connects to the database, if you specified Integrated Security in your connection string.

Upvotes: 0

Related Questions