470,594 Members | 1,536 Online
Bytes | Developer Community
New Post

Home Posts Topics Members FAQ

Post your question to a community of 470,594 developers. It's quick & easy.

IIS 6 and Windows Authentication to SQL Server 2000

I am running a Windows Server 2003 machine as my web server. I would
like to use Windows authentication for connections to my SQL Server
2000 instance on a Windows 2000 server. I've read where mirroring the
ASPNET account and password on the web server and SQL server would
work. However, with IIS 6, ASP.NET runs under the 'NT
AUTHORITY\NETWORK SERVICE' account. Should I change the password of
the 'NT AUTHORITY\NETWORK SERVICE' account to something I know, and
create a mirrored 'NETWORK SERVICE' account on my SQL server? Or,
should I create another user like 'MY_WEB_USER' and mirror that on both
machines?

In short, how do I get Windows authentication to work between a Windows
Server 2003 web server and a Windows 2000 SQL server?

Thanks!

Nov 19 '05 #1
6 4033
If you are truly using Windows Authentication, ie a user has an account on
the domain as well as SQL Server, you will do the following:

1. Ensure the user cannot sign in as anonymous
2. Add their account to a group that has SQL rights

You may mean "bastardized windows authentication", meaning SQL Server uses
WIndows Authentication, but you are using anon accounts in IIS. If you go
this route, you are advised to impersonate an account rather than give a
local account rights on another box. One way to easily do this is to place
the assembly in COM+ and declaratively assign a domain account to the
application.
---

Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

***************************
Think Outside the Box!
***************************
"mcollier" wrote:
I am running a Windows Server 2003 machine as my web server. I would
like to use Windows authentication for connections to my SQL Server
2000 instance on a Windows 2000 server. I've read where mirroring the
ASPNET account and password on the web server and SQL server would
work. However, with IIS 6, ASP.NET runs under the 'NT
AUTHORITY\NETWORK SERVICE' account. Should I change the password of
the 'NT AUTHORITY\NETWORK SERVICE' account to something I know, and
create a mirrored 'NETWORK SERVICE' account on my SQL server? Or,
should I create another user like 'MY_WEB_USER' and mirror that on both
machines?

In short, how do I get Windows authentication to work between a Windows
Server 2003 web server and a Windows 2000 SQL server?

Thanks!

Nov 19 '05 #2
Hi,
Are both the servers in the same domain?
If so create a domain user account and switch the identity of the ASP.NET
worker process to this acccount. You can do this by creating a new
application pool in IIS6.

Now configure this acccount as a login for sql server.

Don't forget to add this user to the IIS_WPG group on your Win2K3 machine.

HTH
--
Vikram Vamshi
Eclipsys Corporation
"mcollier" <mi*************@gmail.com> wrote in message
news:11**********************@f14g2000cwb.googlegr oups.com...
I am running a Windows Server 2003 machine as my web server. I would
like to use Windows authentication for connections to my SQL Server
2000 instance on a Windows 2000 server. I've read where mirroring the
ASPNET account and password on the web server and SQL server would
work. However, with IIS 6, ASP.NET runs under the 'NT
AUTHORITY\NETWORK SERVICE' account. Should I change the password of
the 'NT AUTHORITY\NETWORK SERVICE' account to something I know, and
create a mirrored 'NETWORK SERVICE' account on my SQL server? Or,
should I create another user like 'MY_WEB_USER' and mirror that on both
machines?

In short, how do I get Windows authentication to work between a Windows
Server 2003 web server and a Windows 2000 SQL server?

Thanks!

Nov 19 '05 #3
Both servers are not in the same domain. I've done this before when I
had two Windows 2000 servers. Having one Windows 2003 and one Windows
2000 server seems to be somewhat more confusing.

Nov 19 '05 #4
What you did for WIndows 2000 should still work for Win2K3.

Create a user on both the machines with the same username and password.
Then configure the ASP.NET worker process to run under this user account on
win2k3 machine
and configure sql on win2k machine to accept this user as a valid login.

As long as the username/password are same on both the machines this should
work.

hth

--
Vikram Vamshi
Eclipsys Corporation
"mcollier" <mi*************@gmail.com> wrote in message
news:11**********************@f14g2000cwb.googlegr oups.com...
Both servers are not in the same domain. I've done this before when I
had two Windows 2000 servers. Having one Windows 2003 and one Windows
2000 server seems to be somewhat more confusing.

Nov 19 '05 #5
Ok, I think I see where you're going with this. I was thinking I could
use the ASPNET or NETWORK SERVICE account for both servers. But, that
doesn't appear to be the case. What you're saying is that I could
create a user on both servers, for example MY_WEB_USER. Then, set the
ASP.NET worker process to run as this account. I would also need to
give that user the correct permissions (similar to NETWORK SERVICE
probably). Sound about right?

Nov 19 '05 #6
Yep,
That is what I had in mind.
Let us know how it goes.

Thanks
--
Vikram Vamshi
Eclipsys Corporation
"mcollier" <mi*************@gmail.com> wrote in message
news:11**********************@f14g2000cwb.googlegr oups.com...
Ok, I think I see where you're going with this. I was thinking I could
use the ASPNET or NETWORK SERVICE account for both servers. But, that
doesn't appear to be the case. What you're saying is that I could
create a user on both servers, for example MY_WEB_USER. Then, set the
ASP.NET worker process to run as this account. I would also need to
give that user the correct permissions (similar to NETWORK SERVICE
probably). Sound about right?

Nov 19 '05 #7

This discussion thread is closed

Replies have been disabled for this discussion.

Similar topics

8 posts views Thread by Bob Everland | last post: by
3 posts views Thread by Steven Fox | last post: by
2 posts views Thread by Maziar Aflatoun | last post: by
By using this site, you agree to our Privacy Policy and Terms of Use.