Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am creating a PHP website on IIS8 that needs to connect to an SQL Server that is in the same Windows Domain as the IIS8. I am given a Windows Domain user account and asked to connect using its credentials.

I am using sqlserv_connect() for PHP and I get the error Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Is there a way to run PHP + IIS8 as the windows domain user? Or MUST I configure SQL Server to use SQL Authentication mode so that I can supply a username and password?

share|improve this question

3 Answers 3

You can use IIS Manager to set the Identity in the Advanced Settings area for the Application Pool of your PHP site to be any user you want... but personally, I much prefer to use sql authentication.

share|improve this answer
up vote 1 down vote accepted

Whilst Joel's answer leads me to it, I did not solve the problem with the above. I find that changing the application pool to the specific user did not help. There are a few more related areas to check.

The FastCGI.Impersonation value in php.ini must be set to 1. This can be verified in the task manager and see what account the PHP process is currently running under.

And then the there is an IIS Authentication setting in IIS Manager under the website object. By default, Anonymous Login is enabled and when you look at the setting it uses a default user account (in my case it is IISUSER). It allows the option to change the Anonymous user to the Application Pool, in which case, it will work if Application Pool is set to the correct user.

Alternatively, forget completely about the Application Pool and directly set the user account as the default anonymous login account.

I am leaving my answer here and see if other can feedback on potential pit falls of this method of changing default anonymous user.

share|improve this answer

I've done it before with IIS 7.5 and a domain level service account that has zero login privleages. If you know how to hammer down a service account, policy wise, then this is the way to go about it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.