Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here is the situation:

Where I work (small division of large company), we have a single on site big company owned server running SQL Server. We only have access to this server through windows authentication, and only a single windows account (xyzCo\theUser) can be used to access it. As this server is ran by large company instead of small division, we cannot change this setup, and we have to work within their rules.

We are looking to to purchase a second (division owned) server to run IIS for a simple intranet, but we need to access data on the SQL Server instance. Being primarily a programmer, I have never done this, so I figured here would be the correct place to ask.

Is it straight forward to configure IIS to use a particular Windows account to connect to SQL Server?

I have researched this, and particularly, the following article: http://msdn.microsoft.com/en-us/library/ff647396.aspx

In theory, it seems i just set "xyzCo\theUser" as the user for the application pool, then I can connect in code using standard means.

Is it actually this easy?
Are there any pitfalls I need to avoid? Anyone who has done this before have any other advice? Any other step-by-step instructions online?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Yup, that's really all you have to do, based on my experience. Make sure the application pool identity is a domain account, and any connection strings that specify Windows authentication will connect as that user. Now, if you wanted to do something more complicated like impersonating the user accessing the web site when connecting to SQL Server, that would require some Kerberos trickery, but I can't think of any obvious reasons to have a setup like that.

share|improve this answer
    
I was hoping that is how it would work, thanks! –  bunglestink Apr 7 '11 at 13:30
1  
If this is a Windows 2008 server, remember to also add the domain user to the IIS_WPG group. –  Nils Magne Lunde Apr 7 '11 at 15:06
    
Good call. I think that's necessary (or at least advisable) on 2003 as well. –  db2 Apr 7 '11 at 17:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.