在IIS上，应用程序无法打开SQL连接

Question

I have a connection string that looks like this:

Server=.;Database=mydbname;Trusted_Connection=True;

This works fine when i run/debug my application using Visual Studio (IIS Express) but after deployment over IIS-8 it throws me an exception while opening connection that:

Login failed for user 'IIS APPPOOL\\mysite'.

I am very confused why this is happening why IIS is adding its user in the middle when the database doesnt require one and why this is not happening with IIS Express ?

Answer 1

You're using Trusted_Connection=True and thus the user ApplicationPoolIdentity or IIS APPPOOL\\mysite is supplied to SQL server.

Option 1. Give permissions to IIS APPPOOL\\mysite in SQL server.

Option 2. Use User Id=User_Id;Password=****** instead of Trusted_Connection=True

Answer 2

This is occurring because you have asked for the connection to be made using a trusted connection, which means that the operating system user that the code is being executed as will be the one connecting to the database.

In the case of IIS, the operating system user is usually defined in the IIS Application Pool unless you have specified impersonation to be used in web.config.

By default (in order to prevent security issues), the default identity used for IIS Application Pools has a very limited capability. Depending on your configuration (where SQL server is in relation to IIS (same machine, different machines), you may need to either specify a different identity for the app pool and/or you may need to grant authority to access SQL Server to the app pool identity.

This Microsoft article has additional information on how to configure ASP.Net impersonation.

We always configure our web applications to impersonate a domain user so that we can access databases and other resources on remote machines without having to affect the IIS application pool settings.

Answer 3

Having Trusted_Connection=true in the connection string will override the SQL authentication values with the IIS Identity user profile.

Set Trusted_Connection=false