0

We are moving an old application to a new environment using Windows 2012 with IIS 8.5 and I've come across the following error:

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Could not find a login matching the name provided. [CLIENT: 10.107.23.103]

This seems to be very common. Everywhere I read on the web mention the "double hop" error. However, from what I understand, using delegation will only use the credentials from the client to connect to the database and not the domain account running the application pool, which is the account that has access to the database.

I also read this article (https://www.mssqltips.com/sqlservertip/2312/understanding-when-sql-server-kerberos-delegation-is-needed/) and it mentions that Kerberos delegation is not needed for this scenario:

"The user connects to a web site or application on a different system and it uses a Windows domain account (other than the user's) or a SQL Server login to connect to the SQL Server."

This looks like what I am trying to achieve.

Is there anything that could be misconfigured on the IIS Server that is making the application fail when it is trying to connect to SQL Server?

1

I just came across the solution. The issue was related to having

<identity impersonate="true" /> 

on the web.config. Setting it to "false" solved the issue.

0

It's look like that you need to run your ApplicationPool under another account, for example "Network service". Then you need to give an access to MS SQL for account "domain\iis-server-name$".

And it is possible that you need to enable "Windows authentification" in IIS (or site) settings.

  • The problem was related to having "identity impersonate="true"" on the web.config. I actually don't know how that got into the web.config. Does IIS adds that to the web.config? I think it may be an issue with the deployment script when it is creating the IIS site. – paddingtonMike Aug 16 '16 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.