Moving Web App from 1 PC to 3 Servers!

[Nirbho]

Hi,

I've got a c#.net web app that uses SQl Server 2000. It all works very well
on my Development PC, but now I've got to install the app onto some real
servers. I have 3 servers: 2 for the web app and one for the SQl Server
database. The 2 web servers connect to the same SQL server. I have 2
webservers for resilience.

Currently, the SQL Server db has lots of stored procedures, each of which
has granted exec permissions to the machine's ASPNET user account.

My question is, how can I set up the stored proc permissions now that the
web app is accessing the db from another machine (or two!)? What user do I
create?

A second question is... is it ok to have ASPNET with Exec permissions on the
stored procedures from a security perspective? Is that how it is usually set
up?

Thanks!
--
Nirbho

[Scott Allen]

Hi Nirbho:
One option is to use mirrored local accounts. This is easy to setup
even when your production environment is not on a domain. The web
servers and the database server then will all have local accounts with
the same password. This allows the database server to authenticate the
incoming credentials:

See:

http://msdn.microsoft.com/library/de...SecNetHT01.asp
--
Scott
http://www.OdeToCode.com/blogs/scott/
On Mon, 9 May 2005 08:27:38 -0700, Nirbho
<Ni****@discussions.microsoft.com> wrote:

Hi,

I've got a c#.net web app that uses SQl Server 2000. It all works very well
on my Development PC, but now I've got to install the app onto some real
servers. I have 3 servers: 2 for the web app and one for the SQl Server
database. The 2 web servers connect to the same SQL server. I have 2
webservers for resilience.

Currently, the SQL Server db has lots of stored procedures, each of which
has granted exec permissions to the machine's ASPNET user account.

My question is, how can I set up the stored proc permissions now that the
web app is accessing the db from another machine (or two!)? What user do I
create?

A second question is... is it ok to have ASPNET with Exec permissions on the
stored procedures from a security perspective? Is that how it is usually set
up?

Thanks!