SQL integrated authentication when using forms authentication

[Brett Smith]

I currently I am using integrated windows authentication, (anonymous access
disabled), with impersonation on my asp.net app. I would like to implement
forms authentication against AD, but I have not found a way to then have the
proper AD user authenticated on the SQL server. If I enable anonymous
access and then specify a user that had rights to the SQL server I can make
the calls but I loose any audit trail or SQL server level rights (everyone
appears to be the same user to SQL). If I use SQL authentication on the SQL
server I can send the proper credentials to the server using the information
from the logon form, but I would like to stick with integrated
authentication on the SQL server if I could.

[Mary Chipman]

There's no easy solution to the problem -- you might want to take a
look at the ASP.NET security best practices whitepaper, which explores
the options:
http://www.microsoft.com/downloads/r...eleaseID=44047

--Mary

On Tue, 19 Oct 2004 13:00:33 -0400, "Brett Smith" <bsmith at comppro
dot com> wrote:

I currently I am using integrated windows authentication, (anonymous access
disabled), with impersonation on my asp.net app. I would like to implement
forms authentication against AD, but I have not found a way to then have the
proper AD user authenticated on the SQL server. If I enable anonymous
access and then specify a user that had rights to the SQL server I can make
the calls but I loose any audit trail or SQL server level rights (everyone
appears to be the same user to SQL). If I use SQL authentication on the SQL
server I can send the proper credentials to the server using the information
from the logon form, but I would like to stick with integrated
authentication on the SQL server if I could.

[Brett Smith]

Thank you for your response.

"Mary Chipman" <mc***@online.microsoft.com> wrote in message
news:do********************************@4ax.com...

There's no easy solution to the problem -- you might want to take a
look at the ASP.NET security best practices whitepaper, which explores
the options:
http://www.microsoft.com/downloads/r...eleaseID=44047

--Mary

On Tue, 19 Oct 2004 13:00:33 -0400, "Brett Smith" <bsmith at comppro
dot com> wrote:

I currently I am using integrated windows authentication, (anonymous
access
disabled), with impersonation on my asp.net app. I would like to implement
forms authentication against AD, but I have not found a way to then have
the
proper AD user authenticated on the SQL server. If I enable anonymous
access and then specify a user that had rights to the SQL server I can
make
the calls but I loose any audit trail or SQL server level rights (everyone
appears to be the same user to SQL). If I use SQL authentication on the
SQL
server I can send the proper credentials to the server using the
information
from the logon form, but I would like to stick with integrated
authentication on the SQL server if I could.