Integrated Authentication.

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Tom B
    #1

    Integrated Authentication.

    In my web.config file I've specified Windows for the authentication, in IIS
    I've set it to Integrated Authentication.

    But my SQL connection is still showing Anonymous.
    Is there somewhere else I need to check?

    Thanks


    Win 2003, SQL Server 2000


    Tags: None
    • Jim Cheshire [MSFT]
      #2
      RE: Integrated Authentication.

      Tom,

      What do you mean when you say that your SQL connection is still showing
      anonymous?

      Jim Cheshire [MSFT]
      Developer Support
      ASP.NET
      jamesche@online .microsoft.com

      This post is provided as-is with no warranties and confers no rights.

      --------------------[color=blue]
      >From: "Tom B" <shuckle@NOSPAM hotmail.com>
      >Subject: Integrated Authentication.
      >Date: Thu, 16 Oct 2003 11:19:41 -0400
      >Lines: 12
      >X-Priority: 3
      >X-MSMail-Priority: Normal
      >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
      >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
      >Message-ID: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
      >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
      >NNTP-Posting-Host: 216.46.141.98
      >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP11.phx.g bl
      >Xref: cpmsftngxa06.ph x.gbl microsoft.publi c.dotnet.framew ork.aspnet:1846 52
      >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
      >
      >In my web.config file I've specified Windows for the authentication, in IIS
      >I've set it to Integrated Authentication.
      >
      >But my SQL connection is still showing Anonymous.
      >Is there somewhere else I need to check?
      >
      >Thanks
      >
      >
      >Win 2003, SQL Server 2000
      >
      >
      >[/color]

        Comment

        • Tom B
          #3
          Re: Integrated Authentication.

          Well, I catch the error and write out the Message, which is.....

          Login failed for user 'NT AUTHORITY\ANONY MOUS LOGON'.

          and Profiler shows the same.


          "Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
          news:m2yiSgAlDH A.1548@cpmsftng xa06.phx.gbl...[color=blue]
          > Tom,
          >
          > What do you mean when you say that your SQL connection is still showing
          > anonymous?
          >
          > Jim Cheshire [MSFT]
          > Developer Support
          > ASP.NET
          > jamesche@online .microsoft.com
          >
          > This post is provided as-is with no warranties and confers no rights.
          >
          > --------------------[color=green]
          > >From: "Tom B" <shuckle@NOSPAM hotmail.com>
          > >Subject: Integrated Authentication.
          > >Date: Thu, 16 Oct 2003 11:19:41 -0400
          > >Lines: 12
          > >X-Priority: 3
          > >X-MSMail-Priority: Normal
          > >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
          > >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
          > >Message-ID: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
          > >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
          > >NNTP-Posting-Host: 216.46.141.98
          > >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP11.phx.g bl
          > >Xref: cpmsftngxa06.ph x.gbl[/color][/color]
          microsoft.publi c.dotnet.framew ork.aspnet:1846 52[color=blue][color=green]
          > >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
          > >
          > >In my web.config file I've specified Windows for the authentication, in[/color][/color]
          IIS[color=blue][color=green]
          > >I've set it to Integrated Authentication.
          > >
          > >But my SQL connection is still showing Anonymous.
          > >Is there somewhere else I need to check?
          > >
          > >Thanks
          > >
          > >
          > >Win 2003, SQL Server 2000
          > >
          > >
          > >[/color]
          >[/color]


            Comment

            • Jim Cheshire [MSFT]
              #4
              Re: Integrated Authentication.

              Tom,

              Are you using SQL Server authentication or Windows authentication against
              SQL Server? Sounds like you are using Windows, and in that case, you
              either need to give the ASP.NET process account access to the SQL Server
              database, or you need to impersonate.

              Jim Cheshire [MSFT]
              Developer Support
              ASP.NET
              jamesche@online .microsoft.com

              This post is provided as-is with no warranties and confers no rights.


              --------------------[color=blue]
              >From: "Tom B" <shuckle@NOSPAM hotmail.com>
              >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>[/color]
              <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>[color=blue]
              >Subject: Re: Integrated Authentication.
              >Date: Thu, 16 Oct 2003 16:00:47 -0400
              >Lines: 55
              >X-Priority: 3
              >X-MSMail-Priority: Normal
              >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
              >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
              >Message-ID: <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
              >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
              >NNTP-Posting-Host: 216.46.141.98
              >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP10.phx.g bl
              >Xref: cpmsftngxa06.ph x.gbl microsoft.publi c.dotnet.framew ork.aspnet:1847 56
              >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
              >
              >Well, I catch the error and write out the Message, which is.....
              >
              >Login failed for user 'NT AUTHORITY\ANONY MOUS LOGON'.
              >
              >and Profiler shows the same.
              >
              >
              >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
              >news:m2yiSgAlD HA.1548@cpmsftn gxa06.phx.gbl.. .[color=green]
              >> Tom,
              >>
              >> What do you mean when you say that your SQL connection is still showing
              >> anonymous?
              >>
              >> Jim Cheshire [MSFT]
              >> Developer Support
              >> ASP.NET
              >> jamesche@online .microsoft.com
              >>
              >> This post is provided as-is with no warranties and confers no rights.
              >>
              >> --------------------[color=darkred]
              >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
              >> >Subject: Integrated Authentication.
              >> >Date: Thu, 16 Oct 2003 11:19:41 -0400
              >> >Lines: 12
              >> >X-Priority: 3
              >> >X-MSMail-Priority: Normal
              >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
              >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
              >> >Message-ID: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
              >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
              >> >NNTP-Posting-Host: 216.46.141.98
              >> >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP11.phx.g bl
              >> >Xref: cpmsftngxa06.ph x.gbl[/color][/color]
              >microsoft.publ ic.dotnet.frame work.aspnet:184 652[color=green][color=darkred]
              >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
              >> >
              >> >In my web.config file I've specified Windows for the authentication, in[/color][/color]
              >IIS[color=green][color=darkred]
              >> >I've set it to Integrated Authentication.
              >> >
              >> >But my SQL connection is still showing Anonymous.
              >> >Is there somewhere else I need to check?
              >> >
              >> >Thanks
              >> >
              >> >
              >> >Win 2003, SQL Server 2000
              >> >
              >> >
              >> >[/color]
              >>[/color]
              >
              >
              >[/color]

                Comment

                • Tom B
                  #5
                  Re: Integrated Authentication.

                  Impersonate! That's what it is.

                  It's an intranet, and I'm trying to use Windows Authentication. The odd
                  thing, is it was working the other day, but when I added some stuff to one
                  of my classes it stopped working ?!?

                  So would you (or someone else) be able to sum up the steps required?


                  1. web.config set authentication to "Windows"
                  2. SQL Server - set authentication to Windows Only (not really required, I
                  guess)
                  3. SQL Server - set permissions for Domain Users
                  4. IIS Manager set authentication to Integrated Authentication
                  5. web.config set impersonate on????????????? ??????????? <-- That's the
                  part I'm not sure of.


                  "Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                  news:7dXIDnClDH A.2148@cpmsftng xa06.phx.gbl...[color=blue]
                  > Tom,
                  >
                  > Are you using SQL Server authentication or Windows authentication against
                  > SQL Server? Sounds like you are using Windows, and in that case, you
                  > either need to give the ASP.NET process account access to the SQL Server
                  > database, or you need to impersonate.
                  >
                  > Jim Cheshire [MSFT]
                  > Developer Support
                  > ASP.NET
                  > jamesche@online .microsoft.com
                  >
                  > This post is provided as-is with no warranties and confers no rights.
                  >
                  >
                  > --------------------[color=green]
                  > >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                  > >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>[/color]
                  > <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>[color=green]
                  > >Subject: Re: Integrated Authentication.
                  > >Date: Thu, 16 Oct 2003 16:00:47 -0400
                  > >Lines: 55
                  > >X-Priority: 3
                  > >X-MSMail-Priority: Normal
                  > >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                  > >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                  > >Message-ID: <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                  > >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                  > >NNTP-Posting-Host: 216.46.141.98
                  > >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP10.phx.g bl
                  > >Xref: cpmsftngxa06.ph x.gbl[/color][/color]
                  microsoft.publi c.dotnet.framew ork.aspnet:1847 56[color=blue][color=green]
                  > >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                  > >
                  > >Well, I catch the error and write out the Message, which is.....
                  > >
                  > >Login failed for user 'NT AUTHORITY\ANONY MOUS LOGON'.
                  > >
                  > >and Profiler shows the same.
                  > >
                  > >
                  > >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                  > >news:m2yiSgAlD HA.1548@cpmsftn gxa06.phx.gbl.. .[color=darkred]
                  > >> Tom,
                  > >>
                  > >> What do you mean when you say that your SQL connection is still showing
                  > >> anonymous?
                  > >>
                  > >> Jim Cheshire [MSFT]
                  > >> Developer Support
                  > >> ASP.NET
                  > >> jamesche@online .microsoft.com
                  > >>
                  > >> This post is provided as-is with no warranties and confers no rights.
                  > >>
                  > >> --------------------
                  > >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                  > >> >Subject: Integrated Authentication.
                  > >> >Date: Thu, 16 Oct 2003 11:19:41 -0400
                  > >> >Lines: 12
                  > >> >X-Priority: 3
                  > >> >X-MSMail-Priority: Normal
                  > >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                  > >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                  > >> >Message-ID: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                  > >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                  > >> >NNTP-Posting-Host: 216.46.141.98
                  > >> >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP11.phx.g bl
                  > >> >Xref: cpmsftngxa06.ph x.gbl[/color]
                  > >microsoft.publ ic.dotnet.frame work.aspnet:184 652[color=darkred]
                  > >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                  > >> >
                  > >> >In my web.config file I've specified Windows for the authentication,[/color][/color][/color]
                  in[color=blue][color=green]
                  > >IIS[color=darkred]
                  > >> >I've set it to Integrated Authentication.
                  > >> >
                  > >> >But my SQL connection is still showing Anonymous.
                  > >> >Is there somewhere else I need to check?
                  > >> >
                  > >> >Thanks
                  > >> >
                  > >> >
                  > >> >Win 2003, SQL Server 2000
                  > >> >
                  > >> >
                  > >> >
                  > >>[/color]
                  > >
                  > >
                  > >[/color]
                  >[/color]


                    Comment

                    • Jim Cheshire [MSFT]
                      #6
                      Re: Integrated Authentication.

                      Tom,

                      It can get kind of confusing. Here's more information.

                      First off, concerning the steps you provided, using Windows authentication
                      against SQL Server is fine as long as you avoid any delegation of
                      credentials issues. If SQL Server is on the same box as the Web server, it
                      will work fine. If you move SQL Server to another box, it will fail
                      because your credentials will be delegated. Just keep that in mind. If
                      you move SQL Server, you can still use Windows authentication against it,
                      but you will need to use delegation and Kerberos authentication.

                      If you have anonymous enabled in IIS, if you are NOT impersonating, the
                      application will run under the ASPNET account. If you turn on
                      impersonation but don't specify a username and password, the application
                      will run under the anonymous account (IUSR by default). If you specify a
                      username and password, obviously the application will run under that user.

                      If you do NOT have anonymous enabled in IIS and you are NOT impersonating,
                      the application will run under ASPNET. If you do have impersonation
                      enabled, it will run under the person who is logged into the machine.

                      One more thing. Above when I say "the application will run under...",
                      that's really a little misleading. What this really means is that the
                      WindowsIdentity will refer to the user specified above.

                      Hope all of that makes some sense.

                      Jim Cheshire [MSFT]
                      Developer Support
                      ASP.NET
                      jamesche@online .microsoft.com

                      This post is provided as-is with no warranties and confers no rights.

                      --------------------[color=blue]
                      >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                      >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>[/color]
                      <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                      <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                      <7dXIDnClDHA.21 48@cpmsftngxa06 .phx.gbl>[color=blue]
                      >Subject: Re: Integrated Authentication.
                      >Date: Fri, 17 Oct 2003 08:23:22 -0400
                      >Lines: 114
                      >X-Priority: 3
                      >X-MSMail-Priority: Normal
                      >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                      >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                      >Message-ID: <ubFTRlKlDHA.23 12@TK2MSFTNGP12 .phx.gbl>
                      >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                      >NNTP-Posting-Host: 216.46.141.98
                      >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP12.phx.g bl
                      >Xref: cpmsftngxa06.ph x.gbl microsoft.publi c.dotnet.framew ork.aspnet:1848 89
                      >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                      >
                      >Impersonate! That's what it is.
                      >
                      >It's an intranet, and I'm trying to use Windows Authentication. The odd
                      >thing, is it was working the other day, but when I added some stuff to one
                      >of my classes it stopped working ?!?
                      >
                      >So would you (or someone else) be able to sum up the steps required?
                      >
                      >
                      >1. web.config set authentication to "Windows"
                      >2. SQL Server - set authentication to Windows Only (not really required, I
                      >guess)
                      >3. SQL Server - set permissions for Domain Users
                      >4. IIS Manager set authentication to Integrated Authentication
                      >5. web.config set impersonate on????????????? ??????????? <-- That's the
                      >part I'm not sure of.
                      >
                      >
                      >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                      >news:7dXIDnClD HA.2148@cpmsftn gxa06.phx.gbl.. .[color=green]
                      >> Tom,
                      >>
                      >> Are you using SQL Server authentication or Windows authentication against
                      >> SQL Server? Sounds like you are using Windows, and in that case, you
                      >> either need to give the ASP.NET process account access to the SQL Server
                      >> database, or you need to impersonate.
                      >>
                      >> Jim Cheshire [MSFT]
                      >> Developer Support
                      >> ASP.NET
                      >> jamesche@online .microsoft.com
                      >>
                      >> This post is provided as-is with no warranties and confers no rights.
                      >>
                      >>
                      >> --------------------[color=darkred]
                      >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                      >> >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>[/color]
                      >> <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>[color=darkred]
                      >> >Subject: Re: Integrated Authentication.
                      >> >Date: Thu, 16 Oct 2003 16:00:47 -0400
                      >> >Lines: 55
                      >> >X-Priority: 3
                      >> >X-MSMail-Priority: Normal
                      >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                      >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                      >> >Message-ID: <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                      >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                      >> >NNTP-Posting-Host: 216.46.141.98
                      >> >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP10.phx.g bl
                      >> >Xref: cpmsftngxa06.ph x.gbl[/color][/color]
                      >microsoft.publ ic.dotnet.frame work.aspnet:184 756[color=green][color=darkred]
                      >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                      >> >
                      >> >Well, I catch the error and write out the Message, which is.....
                      >> >
                      >> >Login failed for user 'NT AUTHORITY\ANONY MOUS LOGON'.
                      >> >
                      >> >and Profiler shows the same.
                      >> >
                      >> >
                      >> >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                      >> >news:m2yiSgAlD HA.1548@cpmsftn gxa06.phx.gbl.. .
                      >> >> Tom,
                      >> >>
                      >> >> What do you mean when you say that your SQL connection is still[/color][/color][/color]
                      showing[color=blue][color=green][color=darkred]
                      >> >> anonymous?
                      >> >>
                      >> >> Jim Cheshire [MSFT]
                      >> >> Developer Support
                      >> >> ASP.NET
                      >> >> jamesche@online .microsoft.com
                      >> >>
                      >> >> This post is provided as-is with no warranties and confers no rights.
                      >> >>
                      >> >> --------------------
                      >> >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                      >> >> >Subject: Integrated Authentication.
                      >> >> >Date: Thu, 16 Oct 2003 11:19:41 -0400
                      >> >> >Lines: 12
                      >> >> >X-Priority: 3
                      >> >> >X-MSMail-Priority: Normal
                      >> >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                      >> >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                      >> >> >Message-ID: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                      >> >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                      >> >> >NNTP-Posting-Host: 216.46.141.98
                      >> >> >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP11.phx.g bl
                      >> >> >Xref: cpmsftngxa06.ph x.gbl
                      >> >microsoft.publ ic.dotnet.frame work.aspnet:184 652
                      >> >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                      >> >> >
                      >> >> >In my web.config file I've specified Windows for the authentication,[/color][/color]
                      >in[color=green][color=darkred]
                      >> >IIS
                      >> >> >I've set it to Integrated Authentication.
                      >> >> >
                      >> >> >But my SQL connection is still showing Anonymous.
                      >> >> >Is there somewhere else I need to check?
                      >> >> >
                      >> >> >Thanks
                      >> >> >
                      >> >> >
                      >> >> >Win 2003, SQL Server 2000
                      >> >> >
                      >> >> >
                      >> >> >
                      >> >>
                      >> >
                      >> >
                      >> >[/color]
                      >>[/color]
                      >
                      >
                      >[/color]

                        Comment

                        • Tom B
                          #7
                          Re: Integrated Authentication.

                          OK, so in my scenario.....
                          machineA is W2K3 IIS machine
                          machineB is SQL

                          I want to use Windows authentication. ... So I need to set up delegation and
                          Kerberos authentication, correct?

                          Man, I think it was easier when I just used sa and a blank password ;)

                          The other option, is to just set up a user account, and impersonate that
                          account, right?

                          Your last paragraph--"it will run under the person who is logged into the
                          machine"--I assume you mean in the IIS/SQL on the same machine scenario.




                          "Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                          news:MBkufvLlDH A.576@cpmsftngx a06.phx.gbl...[color=blue]
                          > Tom,
                          >
                          > It can get kind of confusing. Here's more information.
                          >
                          > First off, concerning the steps you provided, using Windows authentication
                          > against SQL Server is fine as long as you avoid any delegation of
                          > credentials issues. If SQL Server is on the same box as the Web server,[/color]
                          it[color=blue]
                          > will work fine. If you move SQL Server to another box, it will fail
                          > because your credentials will be delegated. Just keep that in mind. If
                          > you move SQL Server, you can still use Windows authentication against it,
                          > but you will need to use delegation and Kerberos authentication.
                          >
                          > If you have anonymous enabled in IIS, if you are NOT impersonating, the
                          > application will run under the ASPNET account. If you turn on
                          > impersonation but don't specify a username and password, the application
                          > will run under the anonymous account (IUSR by default). If you specify a
                          > username and password, obviously the application will run under that user.
                          >
                          > If you do NOT have anonymous enabled in IIS and you are NOT impersonating,
                          > the application will run under ASPNET. If you do have impersonation
                          > enabled, it will run under the person who is logged into the machine.
                          >
                          > One more thing. Above when I say "the application will run under...",
                          > that's really a little misleading. What this really means is that the
                          > WindowsIdentity will refer to the user specified above.
                          >
                          > Hope all of that makes some sense.
                          >
                          > Jim Cheshire [MSFT]
                          > Developer Support
                          > ASP.NET
                          > jamesche@online .microsoft.com
                          >
                          > This post is provided as-is with no warranties and confers no rights.
                          >
                          > --------------------[color=green]
                          > >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                          > >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>[/color]
                          > <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                          > <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                          > <7dXIDnClDHA.21 48@cpmsftngxa06 .phx.gbl>[color=green]
                          > >Subject: Re: Integrated Authentication.
                          > >Date: Fri, 17 Oct 2003 08:23:22 -0400
                          > >Lines: 114
                          > >X-Priority: 3
                          > >X-MSMail-Priority: Normal
                          > >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                          > >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                          > >Message-ID: <ubFTRlKlDHA.23 12@TK2MSFTNGP12 .phx.gbl>
                          > >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                          > >NNTP-Posting-Host: 216.46.141.98
                          > >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP12.phx.g bl
                          > >Xref: cpmsftngxa06.ph x.gbl[/color][/color]
                          microsoft.publi c.dotnet.framew ork.aspnet:1848 89[color=blue][color=green]
                          > >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                          > >
                          > >Impersonate! That's what it is.
                          > >
                          > >It's an intranet, and I'm trying to use Windows Authentication. The odd
                          > >thing, is it was working the other day, but when I added some stuff to[/color][/color]
                          one[color=blue][color=green]
                          > >of my classes it stopped working ?!?
                          > >
                          > >So would you (or someone else) be able to sum up the steps required?
                          > >
                          > >
                          > >1. web.config set authentication to "Windows"
                          > >2. SQL Server - set authentication to Windows Only (not really required,[/color][/color]
                          I[color=blue][color=green]
                          > >guess)
                          > >3. SQL Server - set permissions for Domain Users
                          > >4. IIS Manager set authentication to Integrated Authentication
                          > >5. web.config set impersonate on????????????? ??????????? <-- That's the
                          > >part I'm not sure of.
                          > >
                          > >
                          > >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                          > >news:7dXIDnClD HA.2148@cpmsftn gxa06.phx.gbl.. .[color=darkred]
                          > >> Tom,
                          > >>
                          > >> Are you using SQL Server authentication or Windows authentication[/color][/color][/color]
                          against[color=blue][color=green][color=darkred]
                          > >> SQL Server? Sounds like you are using Windows, and in that case, you
                          > >> either need to give the ASP.NET process account access to the SQL[/color][/color][/color]
                          Server[color=blue][color=green][color=darkred]
                          > >> database, or you need to impersonate.
                          > >>
                          > >> Jim Cheshire [MSFT]
                          > >> Developer Support
                          > >> ASP.NET
                          > >> jamesche@online .microsoft.com
                          > >>
                          > >> This post is provided as-is with no warranties and confers no rights.
                          > >>
                          > >>
                          > >> --------------------
                          > >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                          > >> >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                          > >> <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                          > >> >Subject: Re: Integrated Authentication.
                          > >> >Date: Thu, 16 Oct 2003 16:00:47 -0400
                          > >> >Lines: 55
                          > >> >X-Priority: 3
                          > >> >X-MSMail-Priority: Normal
                          > >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                          > >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                          > >> >Message-ID: <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                          > >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                          > >> >NNTP-Posting-Host: 216.46.141.98
                          > >> >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP10.phx.g bl
                          > >> >Xref: cpmsftngxa06.ph x.gbl[/color]
                          > >microsoft.publ ic.dotnet.frame work.aspnet:184 756[color=darkred]
                          > >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                          > >> >
                          > >> >Well, I catch the error and write out the Message, which is.....
                          > >> >
                          > >> >Login failed for user 'NT AUTHORITY\ANONY MOUS LOGON'.
                          > >> >
                          > >> >and Profiler shows the same.
                          > >> >
                          > >> >
                          > >> >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                          > >> >news:m2yiSgAlD HA.1548@cpmsftn gxa06.phx.gbl.. .
                          > >> >> Tom,
                          > >> >>
                          > >> >> What do you mean when you say that your SQL connection is still[/color][/color]
                          > showing[color=green][color=darkred]
                          > >> >> anonymous?
                          > >> >>
                          > >> >> Jim Cheshire [MSFT]
                          > >> >> Developer Support
                          > >> >> ASP.NET
                          > >> >> jamesche@online .microsoft.com
                          > >> >>
                          > >> >> This post is provided as-is with no warranties and confers no[/color][/color][/color]
                          rights.[color=blue][color=green][color=darkred]
                          > >> >>
                          > >> >> --------------------
                          > >> >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                          > >> >> >Subject: Integrated Authentication.
                          > >> >> >Date: Thu, 16 Oct 2003 11:19:41 -0400
                          > >> >> >Lines: 12
                          > >> >> >X-Priority: 3
                          > >> >> >X-MSMail-Priority: Normal
                          > >> >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                          > >> >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                          > >> >> >Message-ID: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                          > >> >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                          > >> >> >NNTP-Posting-Host: 216.46.141.98
                          > >> >> >Path:[/color][/color][/color]
                          cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP11.phx.g bl[color=blue][color=green][color=darkred]
                          > >> >> >Xref: cpmsftngxa06.ph x.gbl
                          > >> >microsoft.publ ic.dotnet.frame work.aspnet:184 652
                          > >> >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                          > >> >> >
                          > >> >> >In my web.config file I've specified Windows for the[/color][/color][/color]
                          authentication,[color=blue][color=green]
                          > >in[color=darkred]
                          > >> >IIS
                          > >> >> >I've set it to Integrated Authentication.
                          > >> >> >
                          > >> >> >But my SQL connection is still showing Anonymous.
                          > >> >> >Is there somewhere else I need to check?
                          > >> >> >
                          > >> >> >Thanks
                          > >> >> >
                          > >> >> >
                          > >> >> >Win 2003, SQL Server 2000
                          > >> >> >
                          > >> >> >
                          > >> >> >
                          > >> >>
                          > >> >
                          > >> >
                          > >> >
                          > >>[/color]
                          > >
                          > >
                          > >[/color]
                          >[/color]


                            Comment

                            • Tom B
                              #8
                              Re: Integrated Authentication.

                              OK, I found this
                              http://msdn.microsoft.com/library/en...asp?frame=true

                              I think that should do it.

                              Thank you so much for your help.

                              Tom B
                              "Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                              news:MBkufvLlDH A.576@cpmsftngx a06.phx.gbl...[color=blue]
                              > Tom,
                              >
                              > It can get kind of confusing. Here's more information.
                              >
                              > First off, concerning the steps you provided, using Windows authentication
                              > against SQL Server is fine as long as you avoid any delegation of
                              > credentials issues. If SQL Server is on the same box as the Web server,[/color]
                              it[color=blue]
                              > will work fine. If you move SQL Server to another box, it will fail
                              > because your credentials will be delegated. Just keep that in mind. If
                              > you move SQL Server, you can still use Windows authentication against it,
                              > but you will need to use delegation and Kerberos authentication.
                              >
                              > If you have anonymous enabled in IIS, if you are NOT impersonating, the
                              > application will run under the ASPNET account. If you turn on
                              > impersonation but don't specify a username and password, the application
                              > will run under the anonymous account (IUSR by default). If you specify a
                              > username and password, obviously the application will run under that user.
                              >
                              > If you do NOT have anonymous enabled in IIS and you are NOT impersonating,
                              > the application will run under ASPNET. If you do have impersonation
                              > enabled, it will run under the person who is logged into the machine.
                              >
                              > One more thing. Above when I say "the application will run under...",
                              > that's really a little misleading. What this really means is that the
                              > WindowsIdentity will refer to the user specified above.
                              >
                              > Hope all of that makes some sense.
                              >
                              > Jim Cheshire [MSFT]
                              > Developer Support
                              > ASP.NET
                              > jamesche@online .microsoft.com
                              >
                              > This post is provided as-is with no warranties and confers no rights.
                              >
                              > --------------------[color=green]
                              > >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                              > >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>[/color]
                              > <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                              > <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                              > <7dXIDnClDHA.21 48@cpmsftngxa06 .phx.gbl>[color=green]
                              > >Subject: Re: Integrated Authentication.
                              > >Date: Fri, 17 Oct 2003 08:23:22 -0400
                              > >Lines: 114
                              > >X-Priority: 3
                              > >X-MSMail-Priority: Normal
                              > >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                              > >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                              > >Message-ID: <ubFTRlKlDHA.23 12@TK2MSFTNGP12 .phx.gbl>
                              > >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                              > >NNTP-Posting-Host: 216.46.141.98
                              > >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP12.phx.g bl
                              > >Xref: cpmsftngxa06.ph x.gbl[/color][/color]
                              microsoft.publi c.dotnet.framew ork.aspnet:1848 89[color=blue][color=green]
                              > >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                              > >
                              > >Impersonate! That's what it is.
                              > >
                              > >It's an intranet, and I'm trying to use Windows Authentication. The odd
                              > >thing, is it was working the other day, but when I added some stuff to[/color][/color]
                              one[color=blue][color=green]
                              > >of my classes it stopped working ?!?
                              > >
                              > >So would you (or someone else) be able to sum up the steps required?
                              > >
                              > >
                              > >1. web.config set authentication to "Windows"
                              > >2. SQL Server - set authentication to Windows Only (not really required,[/color][/color]
                              I[color=blue][color=green]
                              > >guess)
                              > >3. SQL Server - set permissions for Domain Users
                              > >4. IIS Manager set authentication to Integrated Authentication
                              > >5. web.config set impersonate on????????????? ??????????? <-- That's the
                              > >part I'm not sure of.
                              > >
                              > >
                              > >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                              > >news:7dXIDnClD HA.2148@cpmsftn gxa06.phx.gbl.. .[color=darkred]
                              > >> Tom,
                              > >>
                              > >> Are you using SQL Server authentication or Windows authentication[/color][/color][/color]
                              against[color=blue][color=green][color=darkred]
                              > >> SQL Server? Sounds like you are using Windows, and in that case, you
                              > >> either need to give the ASP.NET process account access to the SQL[/color][/color][/color]
                              Server[color=blue][color=green][color=darkred]
                              > >> database, or you need to impersonate.
                              > >>
                              > >> Jim Cheshire [MSFT]
                              > >> Developer Support
                              > >> ASP.NET
                              > >> jamesche@online .microsoft.com
                              > >>
                              > >> This post is provided as-is with no warranties and confers no rights.
                              > >>
                              > >>
                              > >> --------------------
                              > >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                              > >> >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                              > >> <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                              > >> >Subject: Re: Integrated Authentication.
                              > >> >Date: Thu, 16 Oct 2003 16:00:47 -0400
                              > >> >Lines: 55
                              > >> >X-Priority: 3
                              > >> >X-MSMail-Priority: Normal
                              > >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                              > >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                              > >> >Message-ID: <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                              > >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                              > >> >NNTP-Posting-Host: 216.46.141.98
                              > >> >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP10.phx.g bl
                              > >> >Xref: cpmsftngxa06.ph x.gbl[/color]
                              > >microsoft.publ ic.dotnet.frame work.aspnet:184 756[color=darkred]
                              > >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                              > >> >
                              > >> >Well, I catch the error and write out the Message, which is.....
                              > >> >
                              > >> >Login failed for user 'NT AUTHORITY\ANONY MOUS LOGON'.
                              > >> >
                              > >> >and Profiler shows the same.
                              > >> >
                              > >> >
                              > >> >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                              > >> >news:m2yiSgAlD HA.1548@cpmsftn gxa06.phx.gbl.. .
                              > >> >> Tom,
                              > >> >>
                              > >> >> What do you mean when you say that your SQL connection is still[/color][/color]
                              > showing[color=green][color=darkred]
                              > >> >> anonymous?
                              > >> >>
                              > >> >> Jim Cheshire [MSFT]
                              > >> >> Developer Support
                              > >> >> ASP.NET
                              > >> >> jamesche@online .microsoft.com
                              > >> >>
                              > >> >> This post is provided as-is with no warranties and confers no[/color][/color][/color]
                              rights.[color=blue][color=green][color=darkred]
                              > >> >>
                              > >> >> --------------------
                              > >> >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                              > >> >> >Subject: Integrated Authentication.
                              > >> >> >Date: Thu, 16 Oct 2003 11:19:41 -0400
                              > >> >> >Lines: 12
                              > >> >> >X-Priority: 3
                              > >> >> >X-MSMail-Priority: Normal
                              > >> >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                              > >> >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                              > >> >> >Message-ID: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                              > >> >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                              > >> >> >NNTP-Posting-Host: 216.46.141.98
                              > >> >> >Path:[/color][/color][/color]
                              cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP11.phx.g bl[color=blue][color=green][color=darkred]
                              > >> >> >Xref: cpmsftngxa06.ph x.gbl
                              > >> >microsoft.publ ic.dotnet.frame work.aspnet:184 652
                              > >> >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                              > >> >> >
                              > >> >> >In my web.config file I've specified Windows for the[/color][/color][/color]
                              authentication,[color=blue][color=green]
                              > >in[color=darkred]
                              > >> >IIS
                              > >> >> >I've set it to Integrated Authentication.
                              > >> >> >
                              > >> >> >But my SQL connection is still showing Anonymous.
                              > >> >> >Is there somewhere else I need to check?
                              > >> >> >
                              > >> >> >Thanks
                              > >> >> >
                              > >> >> >
                              > >> >> >Win 2003, SQL Server 2000
                              > >> >> >
                              > >> >> >
                              > >> >> >
                              > >> >>
                              > >> >
                              > >> >
                              > >> >
                              > >>[/color]
                              > >
                              > >
                              > >[/color]
                              >[/color]


                                Comment

                                • Tom B
                                  #9
                                  Re: Integrated Authentication.

                                  Actually, this ones better.
                                  http://msdn.microsoft.com/library/en...asp?frame=true

                                  "Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                                  news:MBkufvLlDH A.576@cpmsftngx a06.phx.gbl...[color=blue]
                                  > Tom,
                                  >
                                  > It can get kind of confusing. Here's more information.
                                  >
                                  > First off, concerning the steps you provided, using Windows authentication
                                  > against SQL Server is fine as long as you avoid any delegation of
                                  > credentials issues. If SQL Server is on the same box as the Web server,[/color]
                                  it[color=blue]
                                  > will work fine. If you move SQL Server to another box, it will fail
                                  > because your credentials will be delegated. Just keep that in mind. If
                                  > you move SQL Server, you can still use Windows authentication against it,
                                  > but you will need to use delegation and Kerberos authentication.
                                  >
                                  > If you have anonymous enabled in IIS, if you are NOT impersonating, the
                                  > application will run under the ASPNET account. If you turn on
                                  > impersonation but don't specify a username and password, the application
                                  > will run under the anonymous account (IUSR by default). If you specify a
                                  > username and password, obviously the application will run under that user.
                                  >
                                  > If you do NOT have anonymous enabled in IIS and you are NOT impersonating,
                                  > the application will run under ASPNET. If you do have impersonation
                                  > enabled, it will run under the person who is logged into the machine.
                                  >
                                  > One more thing. Above when I say "the application will run under...",
                                  > that's really a little misleading. What this really means is that the
                                  > WindowsIdentity will refer to the user specified above.
                                  >
                                  > Hope all of that makes some sense.
                                  >
                                  > Jim Cheshire [MSFT]
                                  > Developer Support
                                  > ASP.NET
                                  > jamesche@online .microsoft.com
                                  >
                                  > This post is provided as-is with no warranties and confers no rights.
                                  >
                                  > --------------------[color=green]
                                  > >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                                  > >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>[/color]
                                  > <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                                  > <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                                  > <7dXIDnClDHA.21 48@cpmsftngxa06 .phx.gbl>[color=green]
                                  > >Subject: Re: Integrated Authentication.
                                  > >Date: Fri, 17 Oct 2003 08:23:22 -0400
                                  > >Lines: 114
                                  > >X-Priority: 3
                                  > >X-MSMail-Priority: Normal
                                  > >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                                  > >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                                  > >Message-ID: <ubFTRlKlDHA.23 12@TK2MSFTNGP12 .phx.gbl>
                                  > >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                                  > >NNTP-Posting-Host: 216.46.141.98
                                  > >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP12.phx.g bl
                                  > >Xref: cpmsftngxa06.ph x.gbl[/color][/color]
                                  microsoft.publi c.dotnet.framew ork.aspnet:1848 89[color=blue][color=green]
                                  > >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                                  > >
                                  > >Impersonate! That's what it is.
                                  > >
                                  > >It's an intranet, and I'm trying to use Windows Authentication. The odd
                                  > >thing, is it was working the other day, but when I added some stuff to[/color][/color]
                                  one[color=blue][color=green]
                                  > >of my classes it stopped working ?!?
                                  > >
                                  > >So would you (or someone else) be able to sum up the steps required?
                                  > >
                                  > >
                                  > >1. web.config set authentication to "Windows"
                                  > >2. SQL Server - set authentication to Windows Only (not really required,[/color][/color]
                                  I[color=blue][color=green]
                                  > >guess)
                                  > >3. SQL Server - set permissions for Domain Users
                                  > >4. IIS Manager set authentication to Integrated Authentication
                                  > >5. web.config set impersonate on????????????? ??????????? <-- That's the
                                  > >part I'm not sure of.
                                  > >
                                  > >
                                  > >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                                  > >news:7dXIDnClD HA.2148@cpmsftn gxa06.phx.gbl.. .[color=darkred]
                                  > >> Tom,
                                  > >>
                                  > >> Are you using SQL Server authentication or Windows authentication[/color][/color][/color]
                                  against[color=blue][color=green][color=darkred]
                                  > >> SQL Server? Sounds like you are using Windows, and in that case, you
                                  > >> either need to give the ASP.NET process account access to the SQL[/color][/color][/color]
                                  Server[color=blue][color=green][color=darkred]
                                  > >> database, or you need to impersonate.
                                  > >>
                                  > >> Jim Cheshire [MSFT]
                                  > >> Developer Support
                                  > >> ASP.NET
                                  > >> jamesche@online .microsoft.com
                                  > >>
                                  > >> This post is provided as-is with no warranties and confers no rights.
                                  > >>
                                  > >>
                                  > >> --------------------
                                  > >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                                  > >> >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                                  > >> <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                                  > >> >Subject: Re: Integrated Authentication.
                                  > >> >Date: Thu, 16 Oct 2003 16:00:47 -0400
                                  > >> >Lines: 55
                                  > >> >X-Priority: 3
                                  > >> >X-MSMail-Priority: Normal
                                  > >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                                  > >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                                  > >> >Message-ID: <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                                  > >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                                  > >> >NNTP-Posting-Host: 216.46.141.98
                                  > >> >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP10.phx.g bl
                                  > >> >Xref: cpmsftngxa06.ph x.gbl[/color]
                                  > >microsoft.publ ic.dotnet.frame work.aspnet:184 756[color=darkred]
                                  > >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                                  > >> >
                                  > >> >Well, I catch the error and write out the Message, which is.....
                                  > >> >
                                  > >> >Login failed for user 'NT AUTHORITY\ANONY MOUS LOGON'.
                                  > >> >
                                  > >> >and Profiler shows the same.
                                  > >> >
                                  > >> >
                                  > >> >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                                  > >> >news:m2yiSgAlD HA.1548@cpmsftn gxa06.phx.gbl.. .
                                  > >> >> Tom,
                                  > >> >>
                                  > >> >> What do you mean when you say that your SQL connection is still[/color][/color]
                                  > showing[color=green][color=darkred]
                                  > >> >> anonymous?
                                  > >> >>
                                  > >> >> Jim Cheshire [MSFT]
                                  > >> >> Developer Support
                                  > >> >> ASP.NET
                                  > >> >> jamesche@online .microsoft.com
                                  > >> >>
                                  > >> >> This post is provided as-is with no warranties and confers no[/color][/color][/color]
                                  rights.[color=blue][color=green][color=darkred]
                                  > >> >>
                                  > >> >> --------------------
                                  > >> >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                                  > >> >> >Subject: Integrated Authentication.
                                  > >> >> >Date: Thu, 16 Oct 2003 11:19:41 -0400
                                  > >> >> >Lines: 12
                                  > >> >> >X-Priority: 3
                                  > >> >> >X-MSMail-Priority: Normal
                                  > >> >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                                  > >> >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                                  > >> >> >Message-ID: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                                  > >> >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                                  > >> >> >NNTP-Posting-Host: 216.46.141.98
                                  > >> >> >Path:[/color][/color][/color]
                                  cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP11.phx.g bl[color=blue][color=green][color=darkred]
                                  > >> >> >Xref: cpmsftngxa06.ph x.gbl
                                  > >> >microsoft.publ ic.dotnet.frame work.aspnet:184 652
                                  > >> >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                                  > >> >> >
                                  > >> >> >In my web.config file I've specified Windows for the[/color][/color][/color]
                                  authentication,[color=blue][color=green]
                                  > >in[color=darkred]
                                  > >> >IIS
                                  > >> >> >I've set it to Integrated Authentication.
                                  > >> >> >
                                  > >> >> >But my SQL connection is still showing Anonymous.
                                  > >> >> >Is there somewhere else I need to check?
                                  > >> >> >
                                  > >> >> >Thanks
                                  > >> >> >
                                  > >> >> >
                                  > >> >> >Win 2003, SQL Server 2000
                                  > >> >> >
                                  > >> >> >
                                  > >> >> >
                                  > >> >>
                                  > >> >
                                  > >> >
                                  > >> >
                                  > >>[/color]
                                  > >
                                  > >
                                  > >[/color]
                                  >[/color]


                                    Comment

                                    • Jim Cheshire [MSFT]
                                      #10
                                      Re: Integrated Authentication.

                                      Tom,

                                      Inline.
                                      [color=blue]
                                      >I want to use Windows authentication. ... So I need to set up delegation and
                                      >Kerberos authentication, correct?[/color]

                                      Yes, but only if you are using Windows authentication in SQL Server.
                                      [color=blue]
                                      >The other option, is to just set up a user account, and impersonate that
                                      >account, right?[/color]

                                      You can, but if you are using Windows authentication in SQL Server, you
                                      will still need to use Kerberos or Basic authentication on the site or it
                                      won't work.
                                      [color=blue]
                                      >Your last paragraph--"it will run under the person who is logged into the
                                      >machine"--I assume you mean in the IIS/SQL on the same machine scenario.[/color]

                                      This is not related to whether or not SQL Server and IIS are on the same
                                      box. If you enable impersonation and don't have anonymous access enabled,
                                      it will work this way.

                                      Jim Cheshire [MSFT]
                                      Developer Support
                                      ASP.NET
                                      jamesche@online .microsoft.com

                                      This post is provided as-is with no warranties and confers no rights.

                                      --------------------[color=blue]
                                      >From: "Tom B" <shuckle@hotmai l.com>
                                      >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>[/color]
                                      <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                                      <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                                      <7dXIDnClDHA.21 48@cpmsftngxa06 .phx.gbl>
                                      <ubFTRlKlDHA.23 12@TK2MSFTNGP12 .phx.gbl>
                                      <MBkufvLlDHA.57 6@cpmsftngxa06. phx.gbl>[color=blue]
                                      >Subject: Re: Integrated Authentication.
                                      >Date: Fri, 17 Oct 2003 13:21:52 -0400
                                      >Lines: 203
                                      >X-Priority: 3
                                      >X-MSMail-Priority: Normal
                                      >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                                      >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                                      >Message-ID: <uI$PrMNlDHA.22 32@TK2MSFTNGP09 .phx.gbl>
                                      >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                                      >NNTP-Posting-Host: 207.61.174.60
                                      >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP09.phx.g bl
                                      >Xref: cpmsftngxa06.ph x.gbl microsoft.publi c.dotnet.framew ork.aspnet:1849 81
                                      >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                                      >
                                      >OK, so in my scenario.....
                                      >machineA is W2K3 IIS machine
                                      >machineB is SQL
                                      >
                                      >I want to use Windows authentication. ... So I need to set up delegation and
                                      >Kerberos authentication, correct?
                                      >
                                      >Man, I think it was easier when I just used sa and a blank password ;)
                                      >
                                      >The other option, is to just set up a user account, and impersonate that
                                      >account, right?
                                      >
                                      >Your last paragraph--"it will run under the person who is logged into the
                                      >machine"--I assume you mean in the IIS/SQL on the same machine scenario.
                                      >
                                      >
                                      >
                                      >
                                      >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                                      >news:MBkufvLlD HA.576@cpmsftng xa06.phx.gbl...[color=green]
                                      >> Tom,
                                      >>
                                      >> It can get kind of confusing. Here's more information.
                                      >>
                                      >> First off, concerning the steps you provided, using Windows[/color][/color]
                                      authentication[color=blue][color=green]
                                      >> against SQL Server is fine as long as you avoid any delegation of
                                      >> credentials issues. If SQL Server is on the same box as the Web server,[/color]
                                      >it[color=green]
                                      >> will work fine. If you move SQL Server to another box, it will fail
                                      >> because your credentials will be delegated. Just keep that in mind. If
                                      >> you move SQL Server, you can still use Windows authentication against it,
                                      >> but you will need to use delegation and Kerberos authentication.
                                      >>
                                      >> If you have anonymous enabled in IIS, if you are NOT impersonating, the
                                      >> application will run under the ASPNET account. If you turn on
                                      >> impersonation but don't specify a username and password, the application
                                      >> will run under the anonymous account (IUSR by default). If you specify a
                                      >> username and password, obviously the application will run under that[/color][/color]
                                      user.[color=blue][color=green]
                                      >>
                                      >> If you do NOT have anonymous enabled in IIS and you are NOT[/color][/color]
                                      impersonating,[color=blue][color=green]
                                      >> the application will run under ASPNET. If you do have impersonation
                                      >> enabled, it will run under the person who is logged into the machine.
                                      >>
                                      >> One more thing. Above when I say "the application will run under...",
                                      >> that's really a little misleading. What this really means is that the
                                      >> WindowsIdentity will refer to the user specified above.
                                      >>
                                      >> Hope all of that makes some sense.
                                      >>
                                      >> Jim Cheshire [MSFT]
                                      >> Developer Support
                                      >> ASP.NET
                                      >> jamesche@online .microsoft.com
                                      >>
                                      >> This post is provided as-is with no warranties and confers no rights.
                                      >>
                                      >> --------------------[color=darkred]
                                      >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                                      >> >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>[/color]
                                      >> <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                                      >> <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                                      >> <7dXIDnClDHA.21 48@cpmsftngxa06 .phx.gbl>[color=darkred]
                                      >> >Subject: Re: Integrated Authentication.
                                      >> >Date: Fri, 17 Oct 2003 08:23:22 -0400
                                      >> >Lines: 114
                                      >> >X-Priority: 3
                                      >> >X-MSMail-Priority: Normal
                                      >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                                      >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                                      >> >Message-ID: <ubFTRlKlDHA.23 12@TK2MSFTNGP12 .phx.gbl>
                                      >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                                      >> >NNTP-Posting-Host: 216.46.141.98
                                      >> >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP12.phx.g bl
                                      >> >Xref: cpmsftngxa06.ph x.gbl[/color][/color]
                                      >microsoft.publ ic.dotnet.frame work.aspnet:184 889[color=green][color=darkred]
                                      >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                                      >> >
                                      >> >Impersonate! That's what it is.
                                      >> >
                                      >> >It's an intranet, and I'm trying to use Windows Authentication. The odd
                                      >> >thing, is it was working the other day, but when I added some stuff to[/color][/color]
                                      >one[color=green][color=darkred]
                                      >> >of my classes it stopped working ?!?
                                      >> >
                                      >> >So would you (or someone else) be able to sum up the steps required?
                                      >> >
                                      >> >
                                      >> >1. web.config set authentication to "Windows"
                                      >> >2. SQL Server - set authentication to Windows Only (not really[/color][/color][/color]
                                      required,[color=blue]
                                      >I[color=green][color=darkred]
                                      >> >guess)
                                      >> >3. SQL Server - set permissions for Domain Users
                                      >> >4. IIS Manager set authentication to Integrated Authentication
                                      >> >5. web.config set impersonate on????????????? ??????????? <-- That's the
                                      >> >part I'm not sure of.
                                      >> >
                                      >> >
                                      >> >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in message
                                      >> >news:7dXIDnClD HA.2148@cpmsftn gxa06.phx.gbl.. .
                                      >> >> Tom,
                                      >> >>
                                      >> >> Are you using SQL Server authentication or Windows authentication[/color][/color]
                                      >against[color=green][color=darkred]
                                      >> >> SQL Server? Sounds like you are using Windows, and in that case, you
                                      >> >> either need to give the ASP.NET process account access to the SQL[/color][/color]
                                      >Server[color=green][color=darkred]
                                      >> >> database, or you need to impersonate.
                                      >> >>
                                      >> >> Jim Cheshire [MSFT]
                                      >> >> Developer Support
                                      >> >> ASP.NET
                                      >> >> jamesche@online .microsoft.com
                                      >> >>
                                      >> >> This post is provided as-is with no warranties and confers no rights.
                                      >> >>
                                      >> >>
                                      >> >> --------------------
                                      >> >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                                      >> >> >References: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                                      >> >> <m2yiSgAlDHA.15 48@cpmsftngxa06 .phx.gbl>
                                      >> >> >Subject: Re: Integrated Authentication.
                                      >> >> >Date: Thu, 16 Oct 2003 16:00:47 -0400
                                      >> >> >Lines: 55
                                      >> >> >X-Priority: 3
                                      >> >> >X-MSMail-Priority: Normal
                                      >> >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                                      >> >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                                      >> >> >Message-ID: <ut78NAClDHA.23 28@TK2MSFTNGP10 .phx.gbl>
                                      >> >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                                      >> >> >NNTP-Posting-Host: 216.46.141.98
                                      >> >> >Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP10.phx.g bl
                                      >> >> >Xref: cpmsftngxa06.ph x.gbl
                                      >> >microsoft.publ ic.dotnet.frame work.aspnet:184 756
                                      >> >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                                      >> >> >
                                      >> >> >Well, I catch the error and write out the Message, which is.....
                                      >> >> >
                                      >> >> >Login failed for user 'NT AUTHORITY\ANONY MOUS LOGON'.
                                      >> >> >
                                      >> >> >and Profiler shows the same.
                                      >> >> >
                                      >> >> >
                                      >> >> >"Jim Cheshire [MSFT]" <jamesche@onlin e.microsoft.com > wrote in[/color][/color][/color]
                                      message[color=blue][color=green][color=darkred]
                                      >> >> >news:m2yiSgAlD HA.1548@cpmsftn gxa06.phx.gbl.. .
                                      >> >> >> Tom,
                                      >> >> >>
                                      >> >> >> What do you mean when you say that your SQL connection is still[/color]
                                      >> showing[color=darkred]
                                      >> >> >> anonymous?
                                      >> >> >>
                                      >> >> >> Jim Cheshire [MSFT]
                                      >> >> >> Developer Support
                                      >> >> >> ASP.NET
                                      >> >> >> jamesche@online .microsoft.com
                                      >> >> >>
                                      >> >> >> This post is provided as-is with no warranties and confers no[/color][/color]
                                      >rights.[color=green][color=darkred]
                                      >> >> >>
                                      >> >> >> --------------------
                                      >> >> >> >From: "Tom B" <shuckle@NOSPAM hotmail.com>
                                      >> >> >> >Subject: Integrated Authentication.
                                      >> >> >> >Date: Thu, 16 Oct 2003 11:19:41 -0400
                                      >> >> >> >Lines: 12
                                      >> >> >> >X-Priority: 3
                                      >> >> >> >X-MSMail-Priority: Normal
                                      >> >> >> >X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
                                      >> >> >> >X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
                                      >> >> >> >Message-ID: <#FV7Hj$kDHA.23 64@TK2MSFTNGP11 .phx.gbl>
                                      >> >> >> >Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
                                      >> >> >> >NNTP-Posting-Host: 216.46.141.98
                                      >> >> >> >Path:[/color][/color]
                                      >cpmsftngxa06.p hx.gbl!TK2MSFTN GP08.phx.gbl!TK 2MSFTNGP11.phx. gbl[color=green][color=darkred]
                                      >> >> >> >Xref: cpmsftngxa06.ph x.gbl
                                      >> >> >microsoft.publ ic.dotnet.frame work.aspnet:184 652
                                      >> >> >> >X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
                                      >> >> >> >
                                      >> >> >> >In my web.config file I've specified Windows for the[/color][/color]
                                      >authentication ,[color=green][color=darkred]
                                      >> >in
                                      >> >> >IIS
                                      >> >> >> >I've set it to Integrated Authentication.
                                      >> >> >> >
                                      >> >> >> >But my SQL connection is still showing Anonymous.
                                      >> >> >> >Is there somewhere else I need to check?
                                      >> >> >> >
                                      >> >> >> >Thanks
                                      >> >> >> >
                                      >> >> >> >
                                      >> >> >> >Win 2003, SQL Server 2000
                                      >> >> >> >
                                      >> >> >> >
                                      >> >> >> >
                                      >> >> >>
                                      >> >> >
                                      >> >> >
                                      >> >> >
                                      >> >>
                                      >> >
                                      >> >
                                      >> >[/color]
                                      >>[/color]
                                      >
                                      >
                                      >[/color]

                                        Comment

                                        Previous template Next
                                        Working...