Custom DB Access Issue

Question

We have an issue in accessing custom a DB from a SharePoint custom webpart. When we try to access the custom DB from SharePoint webpart we are getting the error "Login Failed for User NTAuthority\Anonymous Logon".

This issue occurs in the following scenario: WebApplication exists in seperate server DB Server Instance exists in seperate server and WebApplication AppPool uses "domain\someuser" and DB Server Instance has the same user "domain\someuser" and has permission to Custom DB.

Web.config entries:

<authentication mode="Windows" />
<identity impersonate="true" />

The connection string we are using is "Data Source=xxxx; Initial catalog=yyy; Integrated security=true;" We have tried with a small change in conneciontion string as well "Data Source=xxxx; Initial catalog=yyy; Integrated security=SSPI;" It didn't work.

It works in 3 scenarios, but these are not acceptable as per our client security rules,

1. If we modify impersonation to use the domain user <identity impersonate="true" username=”domain\someuser” password=”***” />

2. If we add “NTAuthority\Anonymous Logon” as a user in custom DB server instance.

3. If we use Sql Authentication “Data Source=xxxx; Initial catalog=yyy; Integrated security=false;user id=sampleuser;password=*;”

Is there any other approach which could be used to resolve this issue?

Answer 1

This is due to the double-hop issue. You cannot inherit the user credentials all the way to your database by using NTLM.

You have several options though:

• User Kerberos and delegation
• Impersonation
• Use specific db-credentials (optionally using the SSO service)
• Use SQL login instead of Windows login and specify the credentials in the connection string
• and there are more...

Answer 2

You can wrap your database access code in a block that will impersonate the application pool account:

using (HostingEnvironment.Impersonate()) 
{

    // access external resource as app pool account

}

More details on how this can be wrapped up using AOP can be found here

Answer 3

Can u let me us know what is the CAS Policy ? Is it Low/Medium/Fulltrust, If its low it does not work. And one more thing can u try the elevated permission option