Is it possible for IIS and SQL server on Separate Machines with integrated auth

[Ravikanth[MVP]]

Hi

It is possible that IIS and SQL Server can reside on
Seperate Machines and you can use Integrated Windows
Authentication to connect.

Ravikanth

 

[robert]

hi, Ravikanth;

Could you give me more info how to do that? I've tried. I
set the IIS ->Directory Security -> Anonymous access and
authentication control-> edit-> select "integrated windows
authentication", no others. In web.config, <authentication
mode="Windows" /> <identity impersonate="true"/>. In
connection string,"integrated
security=SSPI;Trusted_Connection=Yes; persist security
info=False;" But still failed. The account from IIS send
to SQL server as the login account
is "domainname/IIScomputername$"

So what the problem I've done? how to solve the problem?

In msdn, http://msdn.microsoft.com/library/default.asp?
url=/library/en-
us/vbcon/html/vbtskAccessingSQLServerUsingMappedWindowsDoma
inUser.asp. it said, Integrated security requires: That
SQL server be running on the same computer as IIS. Is that
wrong?

thanks
robert

 

[robert]

still doesn't work. Same error.

any other suggestion?

robert

 

[Scott Allen]

Hi Robert:

WIth IIS and SQL on seperate machines, you'll need to go one step past
"impersonation" and look at "delegation" via Kerberos. There is a good
description of why your situation does not work and the steps you
would need to take to use delegation in the following article (see the
"Security" section):

http://www.databasejournal.com/features/mssql/print.php/2211161


Delegation requires a specific network environment, and is also
riskier from a security perspective, so you might want to consider the
"Delegation Alternatives" in the .net docs:

http://msdn.microsoft.com/library/d...y/en-us/vsent7/html/vxconASPNETDelegation.asp