Impersonation / Kerberos

[Mark]

Assume: IIS 6.0 and SQL Server 2000 are running on two separate windows 2003
servers on the same LAN and windows domain using Active Directory. All
client connections using IE 6.0+ are on the domain.

True or false:

To avoid sending a username and password from the client pc to the web
server while using impersonation to make database calls from our web server
to our SQL Server, we would have to use delegation so we could leverage
kerberos.

Thanks in advance!
Mark

 

[avnrao]

If you are connecting to SQL Server using Single Windows Identity from your
web server, you dont need impersonate the logged in client (also no need of
delegation). if you are just passing username to sql server, use stored proc
parameters.

if you are connecting to sql server using the identity of logged in client,
you need impersonation enabled and also delegation using kerberos.

Av.