I've setup a new Python site on iis using FastCGI handler. The site has windows authentication enabled in iis and the app checks that the AD user belongs to an active directory group when they access the site. If authorisation fails access is denied.
Windows authentication uses Kerberos but it is not a double hop.
However the web app reads/writes to a SQL Server database and the DB calls are made using the service account which runs the app pool. The service account has limited access to run the web app and can only access one single database which the web app uses.
I've read that impersonation would be better from a DB security perspective using constrained delegation. Although the app does log which user has accesed the db.
I wouldn't remember the URL now. but it was essentially stating that the SQL database is checking that the actual AD user who is using the web app has access to the database. As opposed to the database checking that the service account has access.
Is there any obvious security risks with the approach I'm using?