Re: Cached Logon

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 12/19/04


Date: Sun, 19 Dec 2004 14:30:06 -0700

Why did you reference domain1 and domain2 ?
> domain1\administrator - domain2\administrator both have the same password.
What is their relationship to this?
It appears that the IIS and the SQL are installed on one machine ?
Is the XP used to access the asp pages allowed to provide "behind
the scenes" windows authentication information?
You are saying that the connection string used for ado is
identical on all three pages ?

-- 
Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"Roland Hall" <nobody@nowhere> wrote in message
news:uN$9owb5EHA.3784@TK2MSFTNGP10.phx.gbl...
> If IIS cached a logon just for one particular page, but not for other
pages
> performing the same logon, is that normal?  I know it sounds bizarre but I
> have an ASP page that makes an ADO connection to MS SQL Server.
> Authentication on SQL is set to SQL and Microsoft.  Authentication in IIS
is
> set to Basic and Integrated.  Anonymous is disabled.
>
> I know this is not a coding NG but this is not necessarily a coding
> question.
>
> StraightASP.asp prompted me for credentials and I put in credentials for
the
> domain administrator.  It makes an ADO connection to SQL server using sa.
> (System Administrator).  There is no sa account in Active Directory and
the
> domain administrator does not have a SQL logon.
>
> I got access to the page, as I should but then the logon to SQL failed.  I
> verified the password was correct and tried again.  Same result.  I then
> chose to try another file, which resides in the same folder:
> StraightXML1.asp  It uses the exact same ADO code for logon to SQL, and it
> works.  I have one last file, StraightXML2.asp, same code, works fine.
>
> The differences between the files is:
>
> 1. ASP only.
> 2. Recordset written to XML using CSS.
> 3. Recordset written to XML using XLS.
>
> I renamed the first file and it worked.
> I rename it back, it fails.
> I shutdown and restarted SQL.  Same issue.
> I shutdown and restarted IIS.  Same issue.
> I reboot the IIS/SQL server.  Problem disappears.  I now do not get
prompted
> for any credentials and all files work.  No changes to code.
>
> Other info:
>
> IIS/SQL server is W2K Adv. Server (completely patched).
> Remote: WinXP Pro (completely patched)
> domain1\administrator - domain2\administrator both have the same password.
>
> I was only prompted for credentials by the one file.  I'm wondering where
> the caching issue resides and/or if the system had a problem with SQL
being
> set for SQL and Windows authentication and IIS set for Basic and
Integrated
> only.
>
> This question crosses several boundaries, ASP, SQL, IIS, W2K.  I've
included
> several NGs to see if anyone can provide an opinion on the cause of this
> phenomena.  If you can only provide a partial answer which is relevant to
> the NG you read this in, that's fine.
>
> TIA...
>
>


Relevant Pages

  • FW: Microsoft Security Advisory MS 03-007
    ... am trying to find a vulnerability tester/script and I could test it out ... Department of the Army server that had been compromised and that this ... announcement covers IIS 5.1 but not IIS 6, ... How a Hacker Uses SQL Injection to Steal Your SQL Data! ...
    (Focus-Microsoft)
  • Cached Logon
    ... If IIS cached a logon just for one particular page, ... Authentication on SQL is set to SQL and Microsoft. ... It makes an ADO connection to SQL server using sa. ...
    (microsoft.public.windows.server.general)
  • Cached Logon
    ... If IIS cached a logon just for one particular page, ... Authentication on SQL is set to SQL and Microsoft. ... It makes an ADO connection to SQL server using sa. ...
    (microsoft.public.sqlserver.connect)
  • Cached Logon
    ... If IIS cached a logon just for one particular page, ... Authentication on SQL is set to SQL and Microsoft. ... It makes an ADO connection to SQL server using sa. ...
    (microsoft.public.sqlserver.server)
  • Cached Logon
    ... If IIS cached a logon just for one particular page, ... Authentication on SQL is set to SQL and Microsoft. ... It makes an ADO connection to SQL server using sa. ...
    (microsoft.public.win2000.networking)