Entity Framework Core and Windows authentication on IIS Server

Question

I'm trying to use, for the first time, Windows authentication on my ASP.NET Core 3.1 MVC site to connect to SQL Server using EF Core.

Locally everything is ok (using IIS Express), but on the server, something goes wrong.

My site has "hi,<myDomain/myAccount>!" on the top right of the page, and it is correct, but when I request a page with database query, I get this error:

SqlException: Login failed for user 'MyDomain\MyServerName$'

Why? How do I configure EF Core connection string?

Update:

• I can't use form authentication
• I don't have a user list table
• I can use impersonation (WinAuth? active dir?)
• Every user(more can login to site has the access to the sql database
• I can change some IIS Server settings
• This is the first time i use the winAuth (auto configured by visual studio create project tool => with windows authentication)
• "what kind of user is the app pool running under?" i don't know, the default one i think

Answer 1

This is likely an issue having to do with the credentials running the app pool in IIS, and the access rights those particular credentials have. You say you are NOT using impersonation, in which case the request to SQL Server from your app running on IIS needs to be made using a system account that has proper database access. A system account being a singleton account that only exists to run as the "Application Pool Identity" for the app in IIS.

On IIS on your server, what kind of user is the app pool running under? In most cases with Windows Authentication, you want to use a system account of some kind to run the app pool and then give that system account access to the database. If you don't want to use a system account, you would have to use impersonation, and then use an AD Group to give the impersonated users access to the SQL Server Database.

Since you're saying the request to SQL server is coming across as DOMAIN\SERVERNAME, you likely need to change that setting in IIS to set the request to come from a system account, and then give that system account explicit access to the SQL Server database.

You can change this by adjusting your Advanced Settings in IIS and inputting the information (Username/PW) of the account you want to run the app under or "as" in IIS.

Then, add this same DOMAIN\USERNAME account to the Database as a user who can Read/Write/Delete etc. You could also simply add the DOMAIN\SERVERNAME that is being denied in it's request to the database here, if you don't want to use a custom system account.

As for "How to configure EFCore connection string?", this is usually done in the Startup.cs file. There you can input a connection string from your appsettings.json directly with the .UseSqlServer(connectionstring) method.

You access the connection string using Configuration.GetConnectionString("KEY") .

Once configured there, you don't need to configure it again (unless perhaps to change from dev/qa/prod environments).