iis security: Hi All,

I am facing a challenge, the description is given below:-

For website security, IIS should have "Integrated
Windows" option Checked, Anonymous and Basic Unchecked
and SQL to work in Windows Authentication Mode only.

The implementation should comply with the Security Policy
Guidelines as stated below:

1) The SQL server should be Windows NT
authentication mode only.

2) The IIS (Authentication Methods) should
have "Integrated Windows authentication" Checked.



Note:



IIS and SQL Server are on different machines.

Now when any user accesses the application it results in
a "Login failed for user (null)" even if the User is
added to the SQL.

Perhaps the error is because IIS is not able to pass
credentials to the SQL as both are on different machines.

Where as a scenarios wherein IIS and SQL Server are on
same machine the credentials are passed without any
problem and the user gets authenticated.



In Code, web.config impersonate is set to true.



Is there any other configuration setting which needs to
be taken care off?

Any pointers, suggestions are welcome.



Thanks a lot

Regards

Ashish

On Tue, 30 Dec 2003 00:53:35 -0800, "Ashish Kumar"
[quoted text, click to view]

If the user is "Null" it means your code isn't passing a user for the
connection.

[quoted text, click to view]

Not quite, it's possible. But remember that the user would need to be
a domain user and not the local user IUSR/IWAM accounts. Meaning the
user has to authenticate before the connection can be made.

[quoted text, click to view]

Local users.

At any rate, this isn't an IIS issue. You'll want to check in an
ASP.NET group (since you mentioned an ASP.NET config). Might also
Google "ASP Remote SQL" or the like for some help.