Security Question

[jby1]

Hi

I have developed an ASP.NET application which runs on an intranet, and uses Active Directory roles for Windows Integrated security.

I have up until this point been using a single SQL Server account to access the database, which is stored in the web.config file along with its password.

Quite rightly, the security people have raised alarm at this approach, so I have been looking into using integrated security to connect through to the database.

After trawling the web for ages without finding anything that useful, I managed to get a FAQ in this very forum which seemed to be pointing me in the right direction. I implemented it and it worked just fine.

However, when I installed the application on another server, it stopped working. I had up until this point been running the application from my own PC.

Does anyone have any ideas what I might need to do to get this working?

Thanks!

 

[jby1]

I have just found an article that suggests that in order to use Windows Integrated Security for accessing a SQL Server database from an ASP.NET application, the database must be running on the same computer as IIS. Is this correct? It seems like a terrible rule to me! Or by computer, do they perhaps mean domain?

In the example that worked for me, IIS and the database were not running on the same physical machine.