Connection to SQL Server from ASP

[winntshawn]

Hello all,

My situation is this:

I have an internal server that has SQL Server 2000 installed. It contains a database that I am making available to internal users through a series of ASP pages.

One set of pages allows them to search through the data contained in the database - it doesn't require a login to do a search.

With another set of pages, I want to give people the ability to login with their regular domain accounts to perform maintenance on the database data.

I have created the login page that authenticates them against Active Directory, and it also stores their username and password in session variables. I am trying to use the following as the connection string to open the connection to the database:

<%
strConnection = "Provider=SQLOLEDB; Server=[ServerName]; Initial Catalog=[Database]; User ID=DOMAIN\" & Session("strUSername") & "; Password=" & Session("strPassword") & ";Integrated Security=SSPI;"
%>

I have created accounts in SQL Enterprise Manager that maps their domain accounts to SQL logins, and given them access to the database.

To test it, I logged into the maintenance pages with my user account (which has access), and I was able to maintain the data as expected. However, when I login with a user account that doesn't have access to the database, it still updates the data, which is not what I want.

Any help or direction would be greatly appreciated.

(I have also posted this in the SQL Server forum, just to be safe.)

-- Shawn

 

[marinero]

Check the database access in EM to make sure that the guest account is removed.
Run the profiler and look at the access to the database
(you DO use the profiler to analyze database problems?)