IIS vs ASP.Net Authentication problem

From: njtom (njtom_at_discussions.microsoft.com)
Date: 11/12/04 

Date: Fri, 12 Nov 2004 09:09:02 -0800

------
Setup
------

- IIS runs with a domain user account 'domain\iisuser'
- SQL Server has 'domain\iisuser' login setup to act as a data reader/writer

Requirement is to use 'domain\iisuser' to authenticate in SQL Server

-------------------
More info on setup
-------------------
- asp.net 1.1
- processModel in machine.config has userName='machine'
password='AutoGenerate'
- Only Integrated Windows Authentication enabled (Anonymous/basic/digest
unchecked) in IIS 5
- Connection string used : "Provider=SQLOLEDB;Data
Source=CCMIWS05;Database=t5CONV;Integrated Security=SSPI;"
- Using Windows XP SP2 as a development box.

----------------------------
Microsoft Documentation says
----------------------------
Check the url given here for an exact description

Impersonation is disabled ->
This is the default setting for backward compatibility with ASP. In this
instance, the ASP.NET thread will run using the process token of the

application worker process, which by default is the IIS system account,
regardless of which combination of IIS and ASP.NET authentication

have been used.
<identity impersonate="false"/>

(URL:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/authaspdotnet.asp)

------------
The problem
------------

The 'domain\iisuser' is not authenticated in SQL Server and ASPNet seems to
get authenticated which fails as it's not a user in SQL Server.

The error message I am getting is:

Login failed for user 'CCMIWS05\ASPNET'.
Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more

information about the error and where it originated in the code.

Exception Details: System.Data.OleDb.OleDbException: Login failed for user
'CCMIWS05\ASPNET'.

***What am I doing wrong per documentation?***

Relevant Pages

  • Re: Can login domain be set to a default?
    ... need for specifying a login domain. ... accounts of the IIS box (and the login process needs a way to ... cannot specify a default domain for Windows integrated authentication ... > The internal domain for the three servers is different than the web site ...
    (microsoft.public.windows.server.security)
  • Windows Authentication with IIS on separate machines
    ... Yes, setting Basic Authentication in IIS works, but the ... >in SQL server but doesn't work if user account was ... >imported from a Windows account. ...
    (microsoft.public.sqlserver.security)
  • Re: Authentication problem
    ... As matt notes below, even if nothing on your box has changed it's possible ... > On your IIS box, check the HTTP Authentication tab of the SQL Server ...
    (microsoft.public.sqlserver.ce)
  • Re: Basic Authentication fails with Error 401.2 where Integrated s
    ... The password dialog is supposed to appear for Basic authentication ... Thinking more esoterically now -- what are the login rights assigned ... IIS uses a specific login type, ... account created has full permissions for the folder and the file that's in it. ...
    (microsoft.public.inetserver.iis.security)
  • RE: IIS (ASP) -> SQLServer Authentication Issue
    ... I understand that you'd like to use IIS Intergration authentication in the ... and ASP "impersonates" authencitaed users to access SQL Server on ... only kerberos authentication allows double-hops from clients ...
    (microsoft.public.sqlserver.security)