Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I have web applications (Classic ASP and .NET) that connect to SQL Server using SQL authentication. Each one has their own login. I want to convert these to Windows Authentication. The new AD users (1 per application) have already been established for each application.

What is the most secure way to use these AD users? Should I configure each application's application pool in IIS to run under the new AD user account, and then just use the "integrated security" option in the connection string from each application?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Yes, the most secure means to for authentication is Windows Authentication. Read more about this topic and the differences here.

As for different applications having different logins, that is going to be the most secure method. The reason behind this is because each application will most likely require a different set of permissions (I'm assuming a bit here), and instead of having one server principal with a handful of permissions to suit numerous applications, it will be more secure to have each application have a login with permissions tailored to its own needs. It's all about the Principle of Least Privilege.

share|improve this answer
    
Good links. I am definitely moving to Windows authentication, and am looking more for the answer to using the accounts in the application pools vs. using impersonation or something similar from the applications. Should all this security be controlled on the IIS side of things? –  SomeGuy Nov 12 '12 at 16:04
    
That specific question might be more geared towards ServerFault.com. I can't speak on behalf of that. –  Thomas Stringer Nov 14 '12 at 14:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.