ASP.Net Security and SQL Server access

[Richard]

Can someone tell me the best security configuration for an intranet site.

I want to use Window accounts (groups) to control access to the Web site and
the access to a SQL Server database on a different server.

Does the web.config file override the IIS MMC security settings ?

Cheers

 

[Chris Jackson]

Your IIS application runs under one identity. This is configured in the IIS
settings.

ASP.NET runs under another identity, which you can configure in the
machine.config. (By default, it's MACHINE\ASPNET.)

If you want ASP.NET to use the Windows identity of the IIS application
(which can be the authenticated user) then make sure your web.config has
<identity impersonate="true">

 

[Chris Jackson]

Under what credentials is your aspnet_wp.exe running? (You can check this
under the task manager.) Have you set up impersonation?

--
Chris Jackson
Software Engineer
Microsoft MVP - Windows XP
Windows XP Associate Expert
--