0

I have this PHP code running under IIS:

$serverName = "someServer\someServer";
$connectionInfo = array( "Database"=>"SOME_DB");

$conn = sqlsrv_connect( $serverName, $connectionInfo);

if( $conn ) {
     echo "Connection established.<br />";
}else{
     echo "Connection could not be established.<br />";
     die( print_r( sqlsrv_errors(), true));
}

When I try to visit the page, I get the error:

[Microsoft][SQL Server Native Client 10.0][SQL Server]Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

Which is confusing, as the documentation here says "The connection will be attempted using Windows Authentication".

The flow of this is:

  1. User using x Windows account on workstation1 visits this website hosted on server1
  2. server1 executes above PHP code and tries to retrieve data from server2 using y Windows account (y is defined in the IIS settings, under Application Pools->Identity)
  3. Windows account y has access to the database

The IIS pool is running under a Windows domain user "domainadm" which has access to the SOME_DB database and the server it sits on.

Why is it trying to authenticate anonymously and how can I fix this so it runs under the user the IIS pool is running as?

In php.ini:

fastcgi.impersonate = 1;

Checking the Authentication section in IIS, the only options I have are "Anonymous Authentication" or "ASP.NET Impersonation". No Windows authentication?

Anonymous is currently enabled, which gives the error above. If I switch to the ASP.NET one I instead get this error when visiting the page:

500 - Internal server error. There is a problem with the resource you are looking for, and it cannot be displayed.

7
  • Is Windows Authentication enabled in IIS? Nov 5, 2014 at 21:54
  • @JohnMcCall Apparently not. My only options are "Anonymous Authentication" or "ASP.NET Impersonation"
    – JBurace
    Nov 5, 2014 at 22:45
  • In the Authentication section, what is it currently set to? Have you tried "ASP.NET Impersonation"? Nov 6, 2014 at 16:51
  • I tried the ASP.NET one, got a different error. See OP
    – JBurace
    Nov 6, 2014 at 22:30
  • Is your php.ini file using fastcgi.impersonate = 1?
    – Jeremy
    Nov 6, 2014 at 22:44

3 Answers 3

1

Reading the manual I found something relevant:

For example IIS 7, in its default configuration, has anonymous authentication enabled with built-in user account IUSR used as a default identity. This means that in order for IIS to execute PHP scripts, it is necessary to grant IUSR account read permission on those scripts. If PHP applications need to perform write operations on certain files or write files into some folders then IUSR account should have write permission to those.

And iis.net has the following relevant information:

This built-in account does not need a password and will be the default identity that is used when anonymous authentication is enabled. If you look in the applicationHost.config file you will see the following definition:

<anonymousAuthentication enabled="true" userName="IUSR" defaultLogonDomain="" />

This tells IIS to use the new built-in account for all anonymous authentication requests.

Hope it helps

1

Could this be a double-hop delegation problem since apparently Kerberos is not being used? Every machine in the chain, from the workstation to the database needs to use Kerberos authentication.

You mention visiting the page, which then queries the database. Which could be interpreted as a double-hop, although I do not fully understand the topology from the description.

I interpreted the topology as: Workstation / IIS Server / SQL Server.

The following post explains the technology: Double-hop authentication: Why NTLM fails and Kerberos works.

Basically, NTLM is not able to go through the middle server to the next server because it does not have the password hash for NTLM to work with moving forward.

Using Kerberos authentication does not require access to the password hash, using instead the session ticket to define itself.

1
  • I don't think so. I edited my post, sorry I think it was confusing. A Windows already is already defined in IIS to connect as, under the App Pool.
    – JBurace
    Nov 20, 2014 at 16:28
0

"The IIS pool is running under a Windows domain user "domainadm" which has access to the SOME_DB database and the server it sits on."

can you check if the user that you are trying to authenticate has been added to the security group on the dB server where your schema is located and the security login for that user is created with serveradmin access.

1
  • Yes, that's already done. That isn't the issue, read the OP. It's trying to connect as anon for some reason.
    – JBurace
    Nov 7, 2014 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.