Re: Web Server connecting to db server on different machines

Dominick

Thanks for the replies (again).

That solution wont work for use as we are building security into the
database to identify which data a user has access to based on their domain
account.

I will have to investigate either delegation or having the web server reside
on the same machine as the database.

Thanks again.

"Dominick Baier [DevelopMentor]" wrote:

hi - no problem -

not really a good one -

but the general idea is that you do authentication, authorization and auditing
in the middle tier and access the back-end resource using the middle tier
server credentials as opposed to the client ones...



---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Sorry for the question, but do you have a link that describes the
trusted subsystem design?

Thanks for your help!

"Dominick Baier [DevelopMentor]" wrote:

Hi,

if you want to delegate client credentials - kerberos is they only
way to go.

You could disable delegation and use a trusted subsystem design to
access the back-end resources.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com
Thank you.

Seeing as I may not be able to convince our AD services group to do
this, is there another option?

Thanks.

"Dominick Baier [DevelopMentor]" wrote:

http://msdn.microsoft.com/msdnmag/issues/05/09/SecurityBriefs/defau
lt .aspx

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com
Hello

Im creating an asp.net web app that will need to connect to a SQL
Server db on another machine. I have set this up using trusted
connections and impersonation in the web.config file but I am
getting a "Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'"
message. I need this to work through domain accounts on both
machines.

Currently, it will work if I am using the machine where the web
app resides (ie. http://localhost/webapp/page.aspx) but i get the
above message when using another remote machine.

Any help is appreciated.
Ben



.

Relevant Pages

  • Re: ASP .NET Configuration Tool
    ... Dominick Baier - DevelopMentor ... web.config before trying to run the configuration tool? ... LocalSqlServer - is this pointing to the right database? ...
    (microsoft.public.dotnet.security)
  • RE: Help me to understand ??
    ... Dominick Baier, DevelopMentor ... ServicedComponent features if no interest on Object pooling, ... Application messaging, database transaction....? ...
    (microsoft.public.dotnet.security)
  • Re: pass login to application
    ... Dominick Baier - DevelopMentor ... I think it depends on where you're storing principals - a database or ... end up having to use a database, then you're right - there's certainly ...
    (microsoft.public.dotnet.security)
  • Re: .Net 2.0 Membership
    ... if this does not help - start an instance of sql profiler to see that you really hit the database. ... Dominick Baier - DevelopMentor ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Web Server connecting to db server on different machines
    ... Setting up the various SPNs are enabling constrained delegation (if your AD ... Dominick Baier - DevelopMentor ... You could disable delegation and use a trusted subsystem design to ...
    (microsoft.public.dotnet.framework.aspnet.security)