2

I have a pretty typical .NET app that uses Entity Framework, MS SQL, and IIS. The app was developed with the expectation that the SQL server would run local to IIS and with SQL authentication for the database connection. The users will logon to the app via Windows authentication.

Recently, I’ve been tasked with separating the web and SQL servers onto two servers; however, I’m not allowed to use SQL authentication any longer, but instead, it must use Windows Authentication.

My new connection string is now something like:

 <add name="MyDbConn2" connectionString="Initial Catalog=MyDb;Data Source=MyServer;Integrated Security=SSPI;"/>

.

I’m my local dev environment, I’ve tried setting the AppPool user to a service account (e.g. "domain\User"), and set the <identity/> in the web.config to use the same AppPool user like so:

<identity impersonate="true" userName="domain\User" password="****"/>

Provided the user has the permissions on the SQL box, this works. But now, I’m also being told that I cannot use a service account either since the user/pass would have to be stored in the config file.

I can’t even fathom how this would work without a service account, so I’m hoping this community has some ideas.

0

You can do it by changing the service to run as the network service account, then give permission to domain\computername$ in SQL Server.

Following won't work, see comments.
As the network service account has restricted permissions you may need to grant it more permissions to get your app to work.

  • The NetworkService account is a predefined local account used by the service control manager. This account is not recognized by the security subsystem, so you cannot specify its name in a call to the LookupAccountName function. It has minimum privileges on the local computer and acts as the computer on the network. See the link docs.microsoft.com/en-gb/windows/win32/services/… – Tony Dong Aug 16 at 16:46
  • Yeah I think you are right. You can only do the first part of my answer. If the Network Service does not have enough permission to run your app it looks like you will need a different solution. – pholcroft yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.