Re: Impersonation

From: Ken Schaefer (kenREMOVE_at_THISadOpenStatic.com)
Date: 04/07/04


Date: Thu, 8 Apr 2004 06:10:41 +1000


) if you do this, you will lose the benefits of connection pooling, as a
separate connection will be used for each security context (each user
account will have it's own pool). So, this solution will not scale to a
large number of users. It's OK if you have a small number of users

b) the problem is double-hop authentication. When using IWA, the webserver
does not have the user's password. It just gets a token from the DC, but the
token does not have permission to logon to network resources.

Options:
a) if you are using a Windows 2000 Domain, you can enable delegation. This
allows the IIS server to impersonate the Windows account, and logon to the
backend SQL Server. You need to use Kerberos authentication for this (not
NTLM v2)

b) if you are using a Windows 2003 Domain, when you enable constrained
delegation, you can use Protocol Transition. This allows the user to
authenticate using any of a number of mechanisms to the IIS server (eg
Digest, or NTLM), and the webserver can still get an Kerberos token to logon
to the SQL Server.

Here are a few articles to get you started:

IMPORTANT:
Read chapter 12 from the Building Secure ASP.Net Application Book - it has
very good information about building scalable, secure ASP.Net applications
(eg using a trusted subsystem model):
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp?frame=true

http://support.microsoft.com/?id=319723
INF: SQL Server 2000 Kerberos support including SQL Server virtual servers
on server clusters

http://support.microsoft.com/default.aspx?scid=kb;en-us;810572
HOW TO: Configure an ASP.NET Application for a Delegation Scenario

http://support.microsoft.com/?id=294382

Authentication May Fail with "401.3" Error If Web Site's "Host Header"
Differs from Server's NetBIOS Name

http://support.microsoft.com/default.aspx?kbid=325894
HOW TO: Configure Computer Accounts and User Accounts So That They Are
Trusted for Delegation in Windows Server 2003 Enterprise Edition (also
includes Windows 2000 instructions)

http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/se_con_del_computer.asp
Configuring Users and Computers for delegation (there's a couple of pages -
use the links in the nav bar to get to them)

Windows 2003 Protocol Transition
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/constdel.mspx

Cheers
Ken

"Paul P" <anonymous@discussions.microsoft.com> wrote in message
news:D88CEF6E-26AE-48A2-BE41-1474968A26DC@microsoft.com...
: Can someone explain this to me:
:
: I have a web app I am trying to deploy for the Intranet of our company. I
want to use integrated windows so I
: have <identity impersonate = "true" /> in my web.config file and under IIS
for the website I only have
: integrated windows authentication checked. My problem is when it tries to
retrieve data from the SQL Server
: database I get the NT AUTHORITY\ANONYMOUS LOGON failed error on my SQL
Server. This happens when
: someone else pulls up the site on their computer. My computer is hosting
the website and when I go to the
: website from my computer it works just fine. I get logged into SQL Server
with my domain user name/password but if
: anyone from another computer tries to go to the website and when the
website tries to retrieve data I get the NT AUTHORITY\ANONYMOUS LOGON failed
error.
:
: Things I have tried are putting an account in the identity tag <identity
impersonate="true" userName="domain\username" password="password" />
: this works but I would rather know the username of the actual person going
to the website and retrieving data than this default user.
:
: Can anyone explain what is happening and why I get NT AUTHORITY\ANONYMOUS
LOGON failed error and give any suggestions on a fix.
:
: Thanks
:



Relevant Pages

  • Re: VS2005: SQL Debugging "T-SQL execution ended without debugging. You may not have sufficient
    ... > account also must be a member of the sysadmin role in the target SQL ... and the Windows firewall is disabled on both client & server. ... to the remote SQL Server 2005. ... But I'm still getting the "T-SQL execution ended without debugging. ...
    (microsoft.public.vsnet.debugging)
  • Re: Utter madness!
    ... It is just Windows security stuff. ... You can get a trusted connection back to SQL server. ... ASP.NET account (either processModel or app pool identity depending on ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Passthrough authenication w/ SQL trusted connection
    ... separate connection will be used for each security context (each user ... account will have it's own pool). ... if you are using a Windows 2000 Domain, ... backend SQL Server. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Search services not available
    ... Let me clarify that our SQL server uses Windows Authentication, ... account, even if it was just for now to get it working, that would be easier ... I have configured the Search service to use this ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Permissions!
    ... This account is used because your web ... application is configured for anonymous access instead of integrated ... The details on how to use Windows ... SQL Server MVP ...
    (microsoft.public.sqlserver.security)