1

I have web applications (Classic ASP and .NET) that connect to SQL Server using SQL authentication. Each one has their own login. I want to convert these to Windows Authentication. The new AD users (1 per application) have already been established for each application.

What is the most secure way to use these AD users? Should I configure each application's application pool in IIS to run under the new AD user account, and then just use the "integrated security" option in the connection string from each application?

Improve this question

1 Answer 1

Reset to default
2

Yes, the most secure means to for authentication is Windows Authentication. Read more about this topic and the differences here.

As for different applications having different logins, that is going to be the most secure method. The reason behind this is because each application will most likely require a different set of permissions (I'm assuming a bit here), and instead of having one server principal with a handful of permissions to suit numerous applications, it will be more secure to have each application have a login with permissions tailored to its own needs. It's all about the Principle of Least Privilege.

Improve this answer
2
  • Good links. I am definitely moving to Windows authentication, and am looking more for the answer to using the accounts in the application pools vs. using impersonation or something similar from the applications. Should all this security be controlled on the IIS side of things?
    – SomeGuy
    Nov 12, 2012 at 16:04
  • That specific question might be more geared towards ServerFault.com. I can't speak on behalf of that.
    – Thomas Stringer
    Nov 14, 2012 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.