I am trying to run a django website which connects to a SQL Server, using IIS with Windows authentication.
IIS server and SQL server are on different machines under the same domain i.e., iis_machine.example.com and sql_machine.example.com
What I'm trying to achieve:
- Impersonate the remote user accessing the django website hosted on IIS, so his Windows credentials are passed to SQL Server for authentication.
What I tried so far:
Added this to my web.config file for impersonation
<system.web> <identity impersonate="true" /> </system.web>
Enabled Windows authentication and set up Application Pool (django_web) for django website as shown below
Added IIS APPPOOL\django_web to SQL Server Security\Logins
- When I access the django website, IIS prompts the user for his Windows credentials and I can successfully login
If user tries to access SQL Server after logging in
Case a. IIS, SQL Server are on the different machines: SQL server authentication fails with "Login failed for user 'domain\MACHINENAME$'
Case b. IIS, SQL Server are on the same machine, SQL server authentication is successful but authentication credentials used are IIS APPPOOL\django_web not domain\remote_user
I understand that there is some Kerberos trickery involved with this setup. Unfortunately, I'm only a programmer and not very familiar with how Kerberos works. If someone experienced in this domain, could shed some light on how this setup would work, that'd be really appreciated. Thanks!
I am using:
- IIS 10
- SQL Server 2014
- django 2.0.7
- Python 3.6.5
- Windows 8/10