0

We have an internal asp.net web application which has ASP.NET authentication and Windows Authentication enabled so that users can be logged in as soon as they connect to the website using their domain credentials (this is a requirement that we cannot change).

We are currently looking to upgrade our SQL database and understand that SQL Authentication is less secure than integrated security (e.g. https://msdn.microsoft.com/en-us/library/bb669066(v=vs.110).aspx). Currently we use SQL Authentication.

We could easily change the connection string to run using integrated security, however IIS presents the user as the domain user connected to the website (e.g. domain\greg) instead of the service (domain\WebsiteServiceUser), because IIS impersonates the user. This impersonation is needed to access their Exchange Mailbox, files and other things.

If we were to go down this path, we would have to add logons for every user (using AD groups) to SQL Server. This is possible, but in itself presents a new security issue - users would be able to create a SQL connection outside of our web application and run whatever queries they like against the database. All of our authorization could be bypassed.

Is there a way to connect to SQL using Integrated Authentication using the user that the AppPool runs as (Domain\WebsiteServiceUser) instead of connecting as the currently logged on user (Domain\Greg)?

Greg
  • 3,442
  • 3
  • 29
  • 50
  • You don't have to add logins for every user, you can allow users based on domain security group and don't have to create a separate login for each user. http://stackoverflow.com/questions/5029014/how-to-add-active-directory-user-group-as-login-in-sql-server – Erik Funkenbusch Mar 27 '15 at 01:24
  • Correct. That's what I was referring to when I mentioned (using AD Groups). The problem is not adding the users, it's stopping the users from connecting to the database outside of the web app – Greg Mar 27 '15 at 01:43
  • 1
    All you have to do is enable the firewall to prevent connections from any IP other than the web server. – Erik Funkenbusch Mar 27 '15 at 04:50

0 Answers0