Re: ASP.NET + SQL Server Windows authentication

From: Lior Amar (lior_amar_at_hotmail.com)
Date: 08/27/03 

Date: Wed, 27 Aug 2003 12:09:30 -0400

Think the problem is just a limitation of NTLM single hop. Don't think there
is a way around it other than using SSL and Basic Authentication. ASPNET is
set up properly and is impersonating the user approriately. Don't think
there is anyway around this limitation.

Thanks for the help though

Lior

"Lior Amar" <lior_amar@hotmail.com> wrote in message
news:uHPZbT#aDHA.2928@tk2msftngp13.phx.gbl...
> Hey All,
>
> Trying to understand why I can not get SQL server to trust my IIS server.
I
> have two machines set up, 1 App and 1 DB, and I'm trying to validate the
> applications access to the DB server via NT Authentication. The App comes
in
> via NTLM which from my understanding only supports Single hop security
> delegation. So far I understand why it doesn't work, although seems to me
> like a very bad problem. Now, Basic Authentication will transfer the PW
and
> the UID which will allow IIS to login to the DB server and then NT
> Authentication will work. But we all know how non-secure Basic
> Authentication is.
>
> Here's the confusion, if Kerberos permits token transferring with no
> limitation why can't IIS receive a token via NTLM and transfer it to the
DB
> server?
>
> I've been reading all of these articles
>
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vbcon/html/
> vbconaccessingsqlserverfromwebapplication.asp
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vbcon/html/
> vbtskaccessingsqlserverusingwindowsintegratedsecurity.asp
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnauth/html
> /dnauth_security.asp
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnauth/html
> /signfaq.asp
> http://support.microsoft.com/default.aspx?scid=kb;en-us;Q176377
>
> and a bunch of other documents and they all come down to two valid
> solutions: Basic Authentication or SQL Users. These are only valid if the
> level of security you wish to achieve is not something that needs to pass
a
> certain level of security (would not pass in industries that require
maximum
> security).
>
> If I am bound to NT Authentication, is my only option Basic Authentication
> (of course under SSL)? And why is it that we don't have these problems
with
> other Database vendors? Is there any way we can utilize ADSI to get the
> users NTLM credentials to pass on to SQL server?
>
> Any help or suggestions will be very appreciated.
>
> Thank you,
>
>
>
>

Relevant Pages

  • Re: Can we use public IP?
    ... you've set it to use Basic authentication, not NTLM, as NTLM ... Your FE server is Exchange 2003, ...
    (microsoft.public.exchange.admin)
  • Re: NTLM for extranet users?
    ... > Does any one had success with NTLM over firewall??? ... Why not go the easy way and use Basic Authentication (and SSL if you ... want to secure this a bit) using another virtual server which you map to ...
    (microsoft.public.sharepoint.portalserver)
  • Re: (New Subject): How to eliminate prompt for credentials when using RPC over HTTP
    ... > If it worked with basic authentication, did you remember to change the ... > configuration in Outlook to use NTLM and SSL? ... > To see if it's a certificate issue, go to RWW or OWA (using your server's ... > server to avoid the security alert. ...
    (microsoft.public.windows.server.sbs)
  • Re: ASP.NET 1.1 + IIS 5 + Nagios
    ... NTLM in the effective group policies of both machines will ... When we access the application Nagios ... To monitor the web applcation using NAGIOS there is nothing to do ... basic authentication that a monitoring-user can access the page. ...
    (microsoft.public.inetserver.iis.security)
  • Re: ASP.NET 1.1 + IIS 5 + Nagios
    ... NTLM in the effective group policies of both machines will ... When we access the application Nagios ... To monitor the web applcation using NAGIOS there is nothing to do ... basic authentication that a monitoring-user can access the page. ...
    (microsoft.public.inetserver.iis.security)