Re: What's best practice for connecting to a Sql Server database
- From: "Joe Kaplan" <joseph.e.kaplan@xxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 29 Aug 2008 13:05:02 -0500
I doubt you are moving to IIS 8 yet since IIS 7 is the version shipping in
2008 server and Vista. :)
That said, I generally prefer using Windows auth over SQL auth when possible
as it makes it possible to centrally manage accounts in AD. However, some
customers may prefer to use SQL auth. Providing an option is probably a
good idea.
Which account to use should also be something the customer can choose, but
when using Windows auth in an architecture like yours (which looks like it
uses a fixed service account), using the IIS process identity to access SQL
is usually the easiest thing. The customer can configure whatever app pool
identity they want to use to access SQL that way.
As to whether they use groups to grant access to SQL or grant access
directly to specific security principles should be their decision as well.
I do recommend you use roles in SQL to abstract your permissions at the
database level so they can assign whatever principle they want to your roles
in order to grant the correct set of privileges at the SQL to the app.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"David Thielen" <thielen@xxxxxxxxxxxxx> wrote in message
news:749gb4pvsluef788rk7hieut23uavpq72d@xxxxxxxxxx
Hi;
Back in the old old days of .NET 2.0 on IIS 7 the best practice was
that the web app ran under a user that had very weak rights and the
connection string had the uname/pw to connect to the database.
We are now moving up to Windows 2008 and IIS 8 and I have a developer
here telling me that best practives now are to get the web app the
rights needed to connect to the database and use integrated security
in the connection string. Is this the case?
And if so:
1) What username should the web app run under?
2) Do we assign that user rights to access the database or do we
create a group that can do so and assign that group across?
thanks - dave
david@at-at-at@windward.dot.dot.net
Windward Reports -- http://www.WindwardReports.com
me -- http://dave.thielen.com
Cubicle Wars - http://www.windwardreports.com/film.htm
.
- References:
- What's best practice for connecting to a Sql Server database
- From: David Thielen
- What's best practice for connecting to a Sql Server database
- Prev by Date: What's best practice for connecting to a Sql Server database
- Next by Date: asp.net data authentication
- Previous by thread: What's best practice for connecting to a Sql Server database
- Next by thread: asp.net data authentication
- Index(es):
Relevant Pages
|
