jkw


If I am posting to the wrong forum, please point me in the right direction.

We have upgraded to SQL Server 2005 and Window 2003 from SQL Server 2000 and Windows 2000, and have been having all kinds of problems with security of our web applications. We have been forced to put the system account of the web server as a user in the database in order for the web applications to work. We have lost the ability to control security at the user/role level. Is this the way security is going to work in Windows 2003/SQL Server 2005 How do I use integrated security so that I can secure web pages and database objects

Thanks





Re: Using Integrated Security from .Net Web to access SQL Server 2005

Jens K. Suessmeyer


Well, that depends. Using SQL Server 2005 and Windows Server on different boxes, you will have to setup delegation and a server principal name within your AD. having them on the same box and in additin if the above option applies, you will have to set the web.config security part

<identity impersonate="true" />

Remember that this only works if you set the virtual directory for Windows Authentication. using Anonymous access will use the specified account to logon againstg SQL Server.


Jens K. Suessmeyer

---
http://www.sqlserver2005.de
---







Re: Using Integrated Security from .Net Web to access SQL Server 2005

jkw

We do have the database and web on different boxes. Thanks for the assist







Re: Using Integrated Security from .Net Web to access SQL Server 2005

Jens K. Suessmeyer

Well, then you will have to set the SPN (service principal name) for security delegation.

http://support.microsoft.com/kb/319723

Jens K. Suessmeyer

---
http://www.sqlserver2005.de
---