Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Hey guys, I've recently been having problems with Microsoft Server 2008, Plesk, and MSSQL. The problem was that when one of my applications in the pool tried to access the database I got an error saying it doesn't have access.

I have now fixed this problem by setting the application pool's identity in IIS to "local system", but I understand there can be some security risks with this. Do you guys have an idea for a better solution? One where the pool can access the MSSQL database, but not compromise security?

Thank you!

share|improve this question

migrated from stackoverflow.com Apr 29 '11 at 4:24

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 3 down vote accepted

If your IIS and SQL servers are in a domain together, create a domain user to serve as the identity of the app. Set the app pool identity to that user and add it as a db user. Also make sure the user has access to all the application files.

share|improve this answer
1  
You should also mention that if the application relies on Windows Authentication to auth domain users this will not work out of the box -- an SPN will have to be created. –  MK. Apr 29 '11 at 4:10
    
Yes that sounds like exactly what I need. How can I create a new user? And how can i set it as a db user? –  Rob Apr 29 '11 at 4:10
    
WOW I can't believe how incredibly long it took me to figure out how to do what you said, but it FINALLY worked! Holy crap! Thank you =) –  Rob Apr 29 '11 at 8:08
    
Sorry, I was asleep when you posted your question :) –  pseudocoder Apr 29 '11 at 16:44

I have now fixed this problem by setting the application pool's identity in IIS to "local system", but I understand there can be some security risks with this. Do you guys have an idea for a better solution?

Assuming the DB and IIS are on the same box you can create a local user account and give that account the necessary rights (DB reader and writer if neccessary) on the DB. Then create an IIS AppPool for your app that runs under that account, and configure the app to use that AppPool.

share|improve this answer
    
How can I create a local user account and set its right? –  Rob Apr 29 '11 at 4:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.