471,887 Members | 1,824 Online
Bytes | Software Development & Data Engineering Community
Post +

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 471,887 software developers and data experts.

attaching SQL Server 2005 Express database in ASP.NET web application

Hi there

Please help! I'm at my wits' end...

I am using the System.Data.SQLClient namespace in an ASP.NET web application
to connect to a local instance of SQL Server 2005 Express.

Using "AttachDBFileName" in the connection string to attach to the database,
I can connect to the database if the ASPNET account is explicitly (a)
granted database access and (b) given "SELECT" permission, presumably
because the ASPNET account has limited permission by default.

I'm certain that I'm dealing with a permission issue: If I assign the ASPNET
account to the Administrators group, I can attach to and access the
database, but this is too scary for me (not to mention for my principals).
I've been told that I can let the ASPNET account impersonate the local user,
but the local user will not have been given explicit permission to access
the database (I'm using XCopy deployment with no knowledge of the ultimate
user's Windows domain\user details). Alternatively I've been told that I can
get the ASPNET process to run under the System account, but (i) this is
fairly risky too, (ii) I don't know how to do it, and (iii) I'm uncertain
whether it would work.

Am I missing something glaring?!!

Please help!

Best regards
Loane

Nov 19 '05 #1
2 1330
attach databases requires admin permission. this is due to security, if any
user could attach/detach, they access any database on the hard drive.

your best bet if to suppy an admin page, that does the attach, then grats
access to the asp.net process.

-- bruce (sqlwork.com)


"Loane Sharp" <lo************@hotmail.com> wrote in message
news:ug*************@tk2msftngp13.phx.gbl...
Hi there

Please help! I'm at my wits' end...

I am using the System.Data.SQLClient namespace in an ASP.NET web
application
to connect to a local instance of SQL Server 2005 Express.

Using "AttachDBFileName" in the connection string to attach to the
database,
I can connect to the database if the ASPNET account is explicitly (a)
granted database access and (b) given "SELECT" permission, presumably
because the ASPNET account has limited permission by default.

I'm certain that I'm dealing with a permission issue: If I assign the
ASPNET
account to the Administrators group, I can attach to and access the
database, but this is too scary for me (not to mention for my principals).
I've been told that I can let the ASPNET account impersonate the local
user,
but the local user will not have been given explicit permission to access
the database (I'm using XCopy deployment with no knowledge of the ultimate
user's Windows domain\user details). Alternatively I've been told that I
can
get the ASPNET process to run under the System account, but (i) this is
fairly risky too, (ii) I don't know how to do it, and (iii) I'm uncertain
whether it would work.

Am I missing something glaring?!!

Please help!

Best regards
Loane

Nov 19 '05 #2
Hi Bruce, Thanks for clarifying that.
It sounds like a great idea but I'm not sure exactly what you mean by the
following ...
your best bet if to suppy an admin page, that does the attach, then grats
access to the asp.net process.


How would I do this? Do you have any pointers?
Best regards
Loane
Nov 19 '05 #3

This discussion thread is closed

Replies have been disabled for this discussion.

Similar topics

1 post views Thread by Darryl Kerkeslager | last post: by
2 posts views Thread by Tor Inge Rislaa | last post: by
3 posts views Thread by LamSoft | last post: by
10 posts views Thread by =?Utf-8?B?UHVuaXQgS2F1cg==?= | last post: by
reply views Thread by YellowAndGreen | last post: by
reply views Thread by zermasroor | last post: by

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.