469,313 Members | 2,578 Online
Bytes | Developer Community
New Post

Home Posts Topics Members FAQ

Post your question to a community of 469,313 developers. It's quick & easy.

attaching SQL Server 2005 Express database in ASP.NET web application

Hi there

Please help! I'm at my wits' end...

I am using the System.Data.SQLClient namespace in an ASP.NET web application
to connect to a local instance of SQL Server 2005 Express.

Using "AttachDBFileName" in the connection string to attach to the database,
I can connect to the database if the ASPNET account is explicitly (a)
granted database access and (b) given "SELECT" permission, presumably
because the ASPNET account has limited permission by default.

I'm certain that I'm dealing with a permission issue: If I assign the ASPNET
account to the Administrators group, I can attach to and access the
database, but this is too scary for me (not to mention for my principals).
I've been told that I can let the ASPNET account impersonate the local user,
but the local user will not have been given explicit permission to access
the database (I'm using XCopy deployment with no knowledge of the ultimate
user's Windows domain\user details). Alternatively I've been told that I can
get the ASPNET process to run under the System account, but (i) this is
fairly risky too, (ii) I don't know how to do it, and (iii) I'm uncertain
whether it would work.

Am I missing something glaring?!!

Please help!

Best regards
Loane

Nov 19 '05 #1
2 1285
attach databases requires admin permission. this is due to security, if any
user could attach/detach, they access any database on the hard drive.

your best bet if to suppy an admin page, that does the attach, then grats
access to the asp.net process.

-- bruce (sqlwork.com)


"Loane Sharp" <lo************@hotmail.com> wrote in message
news:ug*************@tk2msftngp13.phx.gbl...
Hi there

Please help! I'm at my wits' end...

I am using the System.Data.SQLClient namespace in an ASP.NET web
application
to connect to a local instance of SQL Server 2005 Express.

Using "AttachDBFileName" in the connection string to attach to the
database,
I can connect to the database if the ASPNET account is explicitly (a)
granted database access and (b) given "SELECT" permission, presumably
because the ASPNET account has limited permission by default.

I'm certain that I'm dealing with a permission issue: If I assign the
ASPNET
account to the Administrators group, I can attach to and access the
database, but this is too scary for me (not to mention for my principals).
I've been told that I can let the ASPNET account impersonate the local
user,
but the local user will not have been given explicit permission to access
the database (I'm using XCopy deployment with no knowledge of the ultimate
user's Windows domain\user details). Alternatively I've been told that I
can
get the ASPNET process to run under the System account, but (i) this is
fairly risky too, (ii) I don't know how to do it, and (iii) I'm uncertain
whether it would work.

Am I missing something glaring?!!

Please help!

Best regards
Loane

Nov 19 '05 #2
Hi Bruce, Thanks for clarifying that.
It sounds like a great idea but I'm not sure exactly what you mean by the
following ...
your best bet if to suppy an admin page, that does the attach, then grats
access to the asp.net process.


How would I do this? Do you have any pointers?
Best regards
Loane
Nov 19 '05 #3

This discussion thread is closed

Replies have been disabled for this discussion.

Similar topics

1 post views Thread by Darryl Kerkeslager | last post: by
2 posts views Thread by Tor Inge Rislaa | last post: by
3 posts views Thread by LamSoft | last post: by
10 posts views Thread by =?Utf-8?B?UHVuaXQgS2F1cg==?= | last post: by
1 post views Thread by CARIGAR | last post: by
reply views Thread by zhoujie | last post: by
reply views Thread by suresh191 | last post: by
1 post views Thread by Geralt96 | last post: by
reply views Thread by harlem98 | last post: by
By using this site, you agree to our Privacy Policy and Terms of Use.