Re: Subject: impersonate="True" gives login (null) for SQL Server

Hi Dominick,

In fact the document you metioned was very, very good.

But I still have a problem:

The application is also to be accessed by the internet on any computer.

The application users travel a lot, and some times need to access to the
application in a computer on a internet cafee or something like that.

The problem that I found is that when you enter the site in a computer where
you are not logged as a our domain user, the browser ask you to identifiy
yourself, which is good, but when the application tries to access the Data
server the login (null) problem raises again.

Is there a way to solve this?

Regards,
Pedro Gonçalves


"Dominick Baier [DevelopMentor]" wrote:

Thats a typical two-hop problem


http://msdn.microsoft.com/msdnmag/issues/05/09/SecurityBriefs/default.aspx


---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Hi,

I've an application using ASP.NET 2.0 that is deployied in IIS 6.0 in
a Win2003 application server.

For that application I'm using windows authentication and
impersonation to access to an SQL Server 2000 on other Win2003
application server througth a integrated security connection string.
The domain is Win 2000.

On web.config file I've:
<identity impersonate="true"/>
<authentication mode="Windows"/>
The problem is that when the application try to open the connection
gets an error saying that can't logon because user '(null) ' is not
configured to a trust connection.

How can I configure this application and/or IIS to able this
functionality?

Impersonate a specific user doesn't work because the stored procedures
that my web application use in the database uses a lot of caller user
identity for permit or not access to tables and inserts or updates.
same times the processing is very different according to the user that
call the SP.

I've read that migth be a problem of configuring the ASP account to
"Act as part of OS", but I don't know exactlt how to do it and where
to do it. Both machines, Web Server and Database Server, are in a
domain, but they are only application servers. The domain server is on
other computer. The ASP account on the web server is a local account
(on the web server). Do I have to change the account for asp_wp to a
domain account? And where I give the permition to "Act as part of OS"?
In the Local Group policy of the web server or in the Domain group
policy?

Regards,
Pedro Gonçalves



.

Relevant Pages

  • outlook2000 modprof - how to create multiple internet mail services
    ... I've got a prf (internet mail) that modprof will append to a existing ... account, modprof will delete the whole profile - is there a way to ... Specifies the name of the POP3 server used for incoming messages. ...
    (microsoft.public.outlook.general)
  • Re: need some help from MS
    ... Internet Security and Acceleration Server ... I thought so too about the account lockout, ... > Microsoft Web Proxy Service it is back up immediately. ...
    (microsoft.public.windows.server.sbs)
  • Re: Bare min. install with problems - Email, VPN
    ... Exchange server. ... original post) but use their local ISP for internet access to the office. ... >> their local ISP account. ... > I'd also ditch the POP connector and host the mail directly on the server. ...
    (microsoft.public.windows.server.sbs)
  • Re: DCPROMO - windows 2003
    ... IP/Segment) without doing a DCPROMO and took it to corp office. ... Delete extinct server metadata; Windows Server 2003, ... computer account out of ADUC/domain controllers OU. ... How to Configure OEx for Internet News ...
    (microsoft.public.windows.server.active_directory)
  • RE: Help .. Small Business Server Error may be DNS ?
    ... I have already excluded remote Attacks as the domain server was isolated ... > resource from the network with a bad password or an account that was locked ... > Personally, I think if the SBS computer is connected to the internet, many ... Microsoft is providing this information as a convenience to you. ...
    (microsoft.public.windows.server.sbs)