SQL 集成安全 Windows 身份验证 + 用户名

Question

I have an application which user Integrated Authentication with SQL to read data. The system which is reading data has multiple system users. Hence is it possible to provide username while connecting to SQL in integrated security mode so that the right user is understood.

Current Connection string used is:

<add name="SQLCon" connectionString="Data Source=servername;Initial Catalog=testDB;Integrated Security=SSPI" providerName="System.Data.SqlClient"/>

Answer 1

You either use an Integrated Security or Standard Security in the ConnectionString . When you use Integrated Security it will use the current Windows Account that is trying to connect to the SQL instance. For instance, if you're trying to connect to SQL Server instance from SQL Server Management Studio or any IDE inside Windows , then the Windows User that runs the SSMS or IDE will be required to be authenticated. However, if the connection was made from IIS, then the Application Pool that uses the connection will be required to be authenticated.

When using Standard Security , it will always use the same username and password to authenticate.

There is no way to use both security contexts in the same connection. If you need to use both, then you will need to use two different ConnectionString s and use one of them to connection initiator ( SqlConnection , DbContext , ..etc.) - depends on the SQL provider used.

An example, on that, say you have a login page that will authenticate user credentials. The backend for this login page will connect to the database using Integrated Security to validate the user. If the validation success, then you need to build a connectionString for this user and reuse it for all user requests. You do the same with all users.

This technique will require that user will also have a match SQL Login with the proper permissions to be able to query the database. This is going to put a lot of work, and it has also its own security risks.

The common way is to use one connectionString with Integrated Security so the application will initiate the connection, and implement a user management system such as ASP.NET Identity or any similar system, that will control the user activities over the application. This would be safer than given a user access to the database directly.

If you need to just let the DBA knows which user is using the connection, you could use Workstation ID or Application Name keywords to add more information about the connection, such as Application Name="CurrentApplication\CurrentUserName where CurrentApplication would be the name of the project that is initiating the connection. and CurrentUserName would be the current logged in user that is using this connection. This information would show-up when the DBAs execute sp_who2 .