Windows authentication from ASP.NET to SQL Server

Collapse
This topic is closed.
X
X
 
  • Time
  • Show
Clear All
new posts
  • Nils Magnus Englund

    Windows authentication from ASP.NET to SQL Server

    Hello,

    I am having trouble using Integrated Windows Authentication between our
    intranet server and our database server, both of which are on our local
    domain.

    Windows authentication works for our intranet server - my domain user
    "DOM\nme" is correctly authenticated and authorized to view the ASP.NET page
    on our intranet. The ASP.NET application uses impersonation (<identity
    impersonate="tr ue"> in Web.config).

    Windows authentication also works for the SQL Server; when logged on to the
    domain, I can start Query Analyzer and connect to the SQL Server using
    Windows authentication. Permissions on the SQL Server are also correctly set
    up.

    However, problems arise when I want to connect to the SQL Server from the
    ASP.NET page - I get the fairly common error message below:

    Login failed for user '(null)'. Reason: Not associated with a trusted SQL
    Server connection.

    Although I do get a lot of hits when searching for this specific error, I
    still can't seem to find the cause of the problem.

    The connection string I'm using to connect to the SQL Server is:
    "Server=DB;Inte grated Security=SSPI;D atabase=Intrane tDB".

    When setting <identity impersonate="fa lse">, I get the error message "Login
    failed for user 'DOM\INTRANET$' ." - DOM\INTRANET$ is the hostname of the
    intranet server.

    In the database servers event log, I can see two events (supplied below)
    after trying to authenticate (unsuccessfully ) from the ASP.NET application
    to the SQL Server as "DOM\nme".

    What do I need to do to let users use Windows authentication against the DB
    server as well?


    Regards,
    Nils Magnus Englund


    (event log entries follows...)


    Date: 08.08.2005
    Source: Security
    Time: 15:14:55
    Category: Logon/Logoff
    Type: Success Audit
    Event ID: 540
    User: NT AUTHORITY\ANONY MOUS LOGON
    Computer: DB

    Description:
    Successful Network Logon:
    User Name:
    Domain:
    Logon ID: (0x0,0x5CE408)
    Logon Type: 3
    Logon Process: NtLmSsp
    Authentication Package: NTLM
    Workstation Name: INTRANET
    Logon GUID: -
    Caller User Name: -
    Caller Domain: -
    Caller Logon ID: -
    Caller Process ID: -
    Transited Services: -
    Source Network Address: -
    Source Port: -


    Date: 08.08.2005
    Source: Security
    Time: 15:14:55
    Category: Logon/Logoff
    Type: Success Audit
    Event ID: 538
    User: NT AUTHORITY\ANONY MOUS LOGON
    Computer: DB

    Description:
    User Logoff:
    User Name: ANONYMOUS LOGON
    Domain: NT AUTHORITY
    Logon ID: (0x0,0x5CE408)
    Logon Type: 3







  • Stefan

    #2
    Re: Windows authentication from ASP.NET to SQL Server

    Do you have anonymous authentication disabled in IIS?
    If so, do you have <authenticati on mode="Windows" /> set in your
    web.config?

    Comment

    • Cowboy (Gregory A. Beamer) - MVP

      #3
      RE: Windows authentication from ASP.NET to SQL Server

      The easiest way is to turn off anonymous access for the Intranet site. This
      will force authentication, usually through a login box (although the network
      admins can alleviate this through policy).

      --
      Gregory A. Beamer
      MVP; MCP: +I, SE, SD, DBA

      *************** ************
      Think Outside the Box!
      *************** ************


      "Nils Magnus Englund" wrote:
      [color=blue]
      > Hello,
      >
      > I am having trouble using Integrated Windows Authentication between our
      > intranet server and our database server, both of which are on our local
      > domain.
      >
      > Windows authentication works for our intranet server - my domain user
      > "DOM\nme" is correctly authenticated and authorized to view the ASP.NET page
      > on our intranet. The ASP.NET application uses impersonation (<identity
      > impersonate="tr ue"> in Web.config).
      >
      > Windows authentication also works for the SQL Server; when logged on to the
      > domain, I can start Query Analyzer and connect to the SQL Server using
      > Windows authentication. Permissions on the SQL Server are also correctly set
      > up.
      >
      > However, problems arise when I want to connect to the SQL Server from the
      > ASP.NET page - I get the fairly common error message below:
      >
      > Login failed for user '(null)'. Reason: Not associated with a trusted SQL
      > Server connection.
      >
      > Although I do get a lot of hits when searching for this specific error, I
      > still can't seem to find the cause of the problem.
      >
      > The connection string I'm using to connect to the SQL Server is:
      > "Server=DB;Inte grated Security=SSPI;D atabase=Intrane tDB".
      >
      > When setting <identity impersonate="fa lse">, I get the error message "Login
      > failed for user 'DOM\INTRANET$' ." - DOM\INTRANET$ is the hostname of the
      > intranet server.
      >
      > In the database servers event log, I can see two events (supplied below)
      > after trying to authenticate (unsuccessfully ) from the ASP.NET application
      > to the SQL Server as "DOM\nme".
      >
      > What do I need to do to let users use Windows authentication against the DB
      > server as well?
      >
      >
      > Regards,
      > Nils Magnus Englund
      >
      >
      > (event log entries follows...)
      >
      >
      > Date: 08.08.2005
      > Source: Security
      > Time: 15:14:55
      > Category: Logon/Logoff
      > Type: Success Audit
      > Event ID: 540
      > User: NT AUTHORITY\ANONY MOUS LOGON
      > Computer: DB
      >
      > Description:
      > Successful Network Logon:
      > User Name:
      > Domain:
      > Logon ID: (0x0,0x5CE408)
      > Logon Type: 3
      > Logon Process: NtLmSsp
      > Authentication Package: NTLM
      > Workstation Name: INTRANET
      > Logon GUID: -
      > Caller User Name: -
      > Caller Domain: -
      > Caller Logon ID: -
      > Caller Process ID: -
      > Transited Services: -
      > Source Network Address: -
      > Source Port: -
      >
      >
      > Date: 08.08.2005
      > Source: Security
      > Time: 15:14:55
      > Category: Logon/Logoff
      > Type: Success Audit
      > Event ID: 538
      > User: NT AUTHORITY\ANONY MOUS LOGON
      > Computer: DB
      >
      > Description:
      > User Logoff:
      > User Name: ANONYMOUS LOGON
      > Domain: NT AUTHORITY
      > Logon ID: (0x0,0x5CE408)
      > Logon Type: 3
      >
      >
      >
      >
      >
      >
      >
      >[/color]

      Comment

      • Nils Magnus Englund

        #4
        Re: Windows authentication from ASP.NET to SQL Server

        "Stefan" <ClownLounge@gm ail.com> wrote in message
        news:1123510471 .010213.176890@ g14g2000cwa.goo glegroups.com.. .[color=blue]
        > Do you have anonymous authentication disabled in IIS?
        > If so, do you have <authenticati on mode="Windows" /> set in your
        > web.config?[/color]

        In reply to both Stefan and Gregory;

        Anonymous authentication is disabled, and I have authentication mode
        "Windows" set in Web.config.

        Again, let me specify that the Windows authentication for the ASP.NET page
        works, and the User.Identity part successfully retrieves the domain user.
        It's the Windows authentication to the SQL Server from the ASP.NET page that
        causes trouble.


        Regards,
        Nils Magnus Englund


        Comment

        • Patrick.O.Ige

          #5
          Re: Windows authentication from ASP.NET to SQL Server

          Nils hae you give your database and table the ASPNET account permission?
          Try doing that.
          Patrick


          "Nils Magnus Englund" <nils.magnus.en glund@orkfin.no > wrote in message
          news:O7VPCCEnFH A.3608@TK2MSFTN GP15.phx.gbl...[color=blue]
          > "Stefan" <ClownLounge@gm ail.com> wrote in message
          > news:1123510471 .010213.176890@ g14g2000cwa.goo glegroups.com.. .[color=green]
          > > Do you have anonymous authentication disabled in IIS?
          > > If so, do you have <authenticati on mode="Windows" /> set in your
          > > web.config?[/color]
          >
          > In reply to both Stefan and Gregory;
          >
          > Anonymous authentication is disabled, and I have authentication mode
          > "Windows" set in Web.config.
          >
          > Again, let me specify that the Windows authentication for the ASP.NET page
          > works, and the User.Identity part successfully retrieves the domain user.
          > It's the Windows authentication to the SQL Server from the ASP.NET page[/color]
          that[color=blue]
          > causes trouble.
          >
          >
          > Regards,
          > Nils Magnus Englund
          >
          >[/color]


          Comment

          • Nils Magnus Englund

            #6
            Re: Windows authentication from ASP.NET to SQL Server

            Hi Patrick,

            Since the database server isn't the same server as the ASP.NET server, and
            since ASPNET is a local user, I cannot use that user to set permissions on
            the database server. However, because of the identity impersonation, is the
            application supposed to be connecting as ASPNET at all?


            Regards,
            Nils Magnus Englund

            "Patrick.O. Ige" <naijacoder@hot mail.com> wrote in message
            news:%23YEKs8Jn FHA.1968@TK2MSF TNGP14.phx.gbl. ..[color=blue]
            > Nils hae you give your database and table the ASPNET account permission?
            > Try doing that.
            > Patrick
            >
            >
            > "Nils Magnus Englund" <nils.magnus.en glund@orkfin.no > wrote in message
            > news:O7VPCCEnFH A.3608@TK2MSFTN GP15.phx.gbl...[color=green]
            >> "Stefan" <ClownLounge@gm ail.com> wrote in message
            >> news:1123510471 .010213.176890@ g14g2000cwa.goo glegroups.com.. .[color=darkred]
            >> > Do you have anonymous authentication disabled in IIS?
            >> > If so, do you have <authenticati on mode="Windows" /> set in your
            >> > web.config?[/color]
            >>
            >> In reply to both Stefan and Gregory;
            >>
            >> Anonymous authentication is disabled, and I have authentication mode
            >> "Windows" set in Web.config.
            >>
            >> Again, let me specify that the Windows authentication for the ASP.NET
            >> page
            >> works, and the User.Identity part successfully retrieves the domain user.
            >> It's the Windows authentication to the SQL Server from the ASP.NET page[/color]
            > that[color=green]
            >> causes trouble.
            >>
            >>
            >> Regards,
            >> Nils Magnus Englund
            >>
            >>[/color]
            >
            >[/color]


            Comment

            • Paul Clement

              #7
              Re: Windows authentication from ASP.NET to SQL Server

              On Tue, 9 Aug 2005 08:21:08 +0200, "Nils Magnus Englund" <nils.magnus.en glund@orkfin.no > wrote:

              ¤ Hi Patrick,
              ¤
              ¤ Since the database server isn't the same server as the ASP.NET server, and
              ¤ since ASPNET is a local user, I cannot use that user to set permissions on
              ¤ the database server. However, because of the identity impersonation, is the
              ¤ application supposed to be connecting as ASPNET at all?
              ¤

              If your ASP.NET app is configured for Integrated Windows security, credentials cannot be delegated
              by IIS to the remote database server w/o implementing Kerberos.

              The reason for this is that NTLM authenticates credentials under IIS Integrated Windows security so
              IIS never receives the credentials and cannot forward them for delegation.


              Paul
              ~~~~
              Microsoft MVP (Visual Basic)

              Comment

              • Nils Magnus Englund

                #8
                Re: Windows authentication from ASP.NET to SQL Server

                > If your ASP.NET app is configured for Integrated Windows security,[color=blue]
                > credentials cannot be delegated
                > by IIS to the remote database server w/o implementing Kerberos.
                >
                > The reason for this is that NTLM authenticates credentials under IIS
                > Integrated Windows security so
                > IIS never receives the credentials and cannot forward them for delegation.[/color]


                But why can't I use Kerberos authentication? Is it anyway to force the
                application to use Kerberos? The WindowsIdentity .Authentication Type property
                returns "Negotiate" - this should be "Kerberos", should it not?


                Regards,
                Nils Magnus Englund


                Comment

                • Paul Clement

                  #9
                  Re: Windows authentication from ASP.NET to SQL Server

                  On Tue, 16 Aug 2005 11:35:17 +0200, "Nils Magnus Englund" <nils.magnus.en glund@orkfin.no > wrote:

                  ¤ > If your ASP.NET app is configured for Integrated Windows security,
                  ¤ > credentials cannot be delegated
                  ¤ > by IIS to the remote database server w/o implementing Kerberos.
                  ¤ >
                  ¤ > The reason for this is that NTLM authenticates credentials under IIS
                  ¤ > Integrated Windows security so
                  ¤ > IIS never receives the credentials and cannot forward them for delegation.
                  ¤
                  ¤
                  ¤ But why can't I use Kerberos authentication? Is it anyway to force the
                  ¤ application to use Kerberos? The WindowsIdentity .Authentication Type property
                  ¤ returns "Negotiate" - this should be "Kerberos", should it not?
                  ¤

                  You can use Kerberos, but your environment must be configured for it. The following should help:





                  Paul
                  ~~~~
                  Microsoft MVP (Visual Basic)

                  Comment

                  Working...