4

I am trying to use IIS 7.5 Application Pool identity as login on SQL Server 2008 R2 so that my ASP.NET web app can connect to the database...

Using this approach worked fine on my local dev machine (IIS 7.5 and SQL Server 2008 R2 on same machine).

However, when I try to set up the same on production (IIS and SQL servers are separate) I am unable to add "IIS APPPOOL\MyAppAppPool" login to SQL Server 2008 R2.

Notice that in either case you cannot use "Browse..." when creating a login in SQL Server since "IIS APPPOOL\MyAppAppPool" user identity is dynamic (or "special")...

Any ideas?

Update:

For more info on Application Pool Identities see here.

From article:

Whenever a new Application Pool is created, the IIS management process creates a security identifier (SID) that represents the name of the Application Pool itself. For example, if you create an Application Pool with the name "MyNewAppPool," a security identifier with the name "MyNewAppPool" is created in the Windows Security system. From this point on, resources can be secured by using this identity. However, the identity is not a real user account; it will not show up as a user in the Windows User Management Console.

Improve this question

1 Answer 1

Reset to default
3

That articles states (under "Accessing the Network") you still use the <domainname>\<machinename>$ aka machine account in the domain.

So if both servers are in "foobar" domain, and the web box is "bicycle", the login used to the SQL Server Instance is foobar\bicycle$

If you aren't in a domain, then there is no common directory to authenticate against. Use a SQL login with username and password for simplicity

Edit, after comment

If the domains are trusted then you can use the machien account still (use domain local groups for SQL Server, into which add a global groups etc)

As for using app pool identities, they are local to your web server only as per article. They have no meaning to SQL Server. If you need to differentiate sites, then use proper domain accounts for the App Pools.

You can't have it both ways...

Improve this answer
Sign up to request clarification or add additional context in comments.

6 Comments

Hi sorry if I was not clear. IIS and DB servers are in different networks/domains (IIS server is in DMZ, while DB server is "inside"). Additionally, I like the app pool identity approach because it allows specifying which identity has access to which database...If I use machine account then every app would I would lose that granularity right?
Sorry, if I understood the articles correctly, the app pool identities are virtual accounts that are "injected" at the time the worker starts for a particular pool (app in my case). If I stop IIS, I am still able to add APP POOL\MyAppAppPool to SQL Server login on my local DB instance (same machine) but not on remote DB server (different machine)...From SQL Server standpoint login does not exist in eiter case but it allows me to create login on local machine but not on remote...
Of course you add it locally because it's the same machine. It has no meaning remotely. So you can't do it. As per article
Ok, let me ask this in another way...Our prod IIS server does not belong to any domain (it is in DMS on an isolated workgroup/different network). Our DB server is on "inside" and belongs to internal company domain. With this setup (without change) is it possible to use windows auth on SQL server to authenticate IIS app pool?
No. Use SQL Server authentication.
|

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.