Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Basically I got started looking into this because I got tired of just selecting stuff like NETWORKSERVICE just to make things magically work across our network, and wanted to learn more about what is actually happening. I opened a can of worms and now I really want to figure this out as best as I can, without bothering my network administrators with my stupid newbie questions. Obviously that's what will get me the best answers, but I'd like your guys help in understanding our environment as best as I can first, before I go and get the full story.

Basically, we have about 30 PC's all using Windows 7, and we're all on the same network. We are NOT using Active Directory and apparently this isn't an option (internal history/politics reasons...) When I open My Computer and hit Network, I can see them all.

In order to double click a PC and view it's shared contents, I either have to... 1) go to that PC and create a user account on that PC that is the same name and password as the account I use on my PC or 2) log in as Administrator.

For convenience sake, on the systems we need to access most, we have manually gone in and created individual user accounts for each person on each machine, using the same username as their main workstation PC.

Now, the reason I need to fully understand this system that we have set up, is that I need to know how this kind of networking system is going to work with an internal ASP.NET site running on an IIS 7.0 web server, backed by SQL Server 2008 R2. Since all of our computers have a universal administrator account, it would be easy as pie to just slap on impersonation as Administrator to the web.config file and call it a day, but I really don't want to do that --- I want to do this "right," I want to do this "securely," I want to do this with allowing as least permissions as possible to every user.

Does this really mean that I'm going to have to create Windows Authentication logins for everyone on our SQL Server AND our web server? The site itself should only ever be read-only, period, so I'm thinking I could create a new user account on the web server machine, restrict access to everything but the website as Read Only, and then impersonate that user in the web.config file. But the SQL database, for some groups of people, it should be read-only, for some groups of people, they should have write access as well, but no one should ever have delete access.

The reason I'm having a hard time researching this on my own is that, apparently we're not doing this the "right" way to begin with. Every book I pick up on Windows networking either talks about small home networks, or it jumps to Active Directory for enterprises and large networks.

share|improve this question

migrated from stackoverflow.com Dec 21 '11 at 1:25

This question came from our site for professional and enthusiast programmers.

    
Sounds an awful lot like you are not allowed to do this "right" or "securely"; if you cannot use Active Directory because someone important doesn't like AD in particular, you can accomplish many/most of the same things using a Mac Mini Server as a domain controller, or by using Novell eDirectory, or by setting up Samba on a Linux server, or... –  Skyhawk Dec 21 '11 at 1:44
    
Yeah, it's definitely a "unique" situation, just have to make do with what we have, I guess :) Thanks for the reply. –  CptSupermrkt Dec 22 '11 at 12:35

1 Answer 1

up vote 3 down vote accepted

Microsoft's solution for sharing credentials between difference machines is to use an Active Directory domain. Active Directory uses the Kerberos authentication protocol to arbitrate access to resources distributed across different computers from a central authentication database.

What you've done w/ creating user accounts on individual computers is colloquially referred to as the "poor man's trust relationship". By creating these accounts that "mirror" the credentials used on users' "main" computers you've created something that, while not very scalable or manageable (and, frankly, not very secure), will give you a functional similarity to an Active Directory domain for interactive users. For "pass through" (also known as "delegated) authentication, like with your web application and the SQL Server back-ending it, though, you're not going to be able to just create "mirror" accounts to get the functionality you're looking for.

Without Active Directory your only option, as I see it, to having different groups of users authenticate differently to the SQL Server via the web application is going to be storing credentials inside the web application for different SQL Server users and using the appropriate credential to access the SQL Server based on who has authenticated to the web server.

share|improve this answer
    
This was extremely helpful. Thank you. –  CptSupermrkt Dec 22 '11 at 12:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.