Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have an issue in accessing custom a DB from a SharePoint custom webpart. When we try to access the custom DB from SharePoint webpart we are getting the error "Login Failed for User NTAuthority\Anonymous Logon".

This issue occurs in the following scenario: WebApplication exists in seperate server DB Server Instance exists in seperate server and WebApplication AppPool uses "domain\someuser" and DB Server Instance has the same user "domain\someuser" and has permission to Custom DB.

Web.config entries:

<authentication mode="Windows" />
<identity impersonate="true" />

The connection string we are using is "Data Source=xxxx; Initial catalog=yyy; Integrated security=true;" We have tried with a small change in conneciontion string as well "Data Source=xxxx; Initial catalog=yyy; Integrated security=SSPI;" It didn't work.

It works in 3 scenarios, but these are not acceptable as per our client security rules,

  1. If we modify impersonation to use the domain user <identity impersonate="true" username=”domain\someuser” password=”***” />

  2. If we add “NTAuthority\Anonymous Logon” as a user in custom DB server instance.

  3. If we use Sql Authentication “Data Source=xxxx; Initial catalog=yyy; Integrated security=false;user id=sampleuser;password=*;”

Is there any other approach which could be used to resolve this issue?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

This is due to the double-hop issue. You cannot inherit the user credentials all the way to your database by using NTLM.

You have several options though:

  • User Kerberos and delegation
  • Impersonation
  • Use specific db-credentials (optionally using the SSO service)
  • Use SQL login instead of Windows login and specify the credentials in the connection string
  • and there are more...
share|improve this answer

Can u let me us know what is the CAS Policy ? Is it Low/Medium/Fulltrust, If its low it does not work. And one more thing can u try the elevated permission option

share|improve this answer
    
This issue has nothing to do with CAS and RWEP will not help either. –  Wictor Wilen MCA MCM MVP May 14 '10 at 13:22

You can wrap your database access code in a block that will impersonate the application pool account:

using (HostingEnvironment.Impersonate()) 
{

    // access external resource as app pool account

}

More details on how this can be wrapped up using AOP can be found here

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.