Windows authentication for an application page without Kerberos?

Question

I'm investigating ways to integrate an existing SQL Server database into my firm's Sharepoint installation. I've put together some external content types, but I'd also like to develop an application page to replace our existing frontend. Before I can even get started, though, I need to figure out how to get authentication working.

Our database currently uses Windows authentication, and I'm hoping to keep it that way, but we're currently using NTLM, not Kerberos, so I can't use AD to log users into the database. I can use the secure store to store credentials for external content types. Is there a way to leverage those credentials for use in my application page as well?

I understand how to get credentials out of the secure store for SQL Server authentication, but I haven't been able to find any information on doing the same with Windows authentication. Can I somehow piggyback on the connection being used by the external content types? Or maybe I could use the windows user name and password to impersonate a windows login to SQL Server? Or possibly the answer is something else altogether.

Any suggestions would be appreciated. Thanks for your help!

Answer 1

I faced a similar problem very recently, and my solution was as follows:

• Retrieve the credentials from the Secure Store, as described on MSDN.
• Use this codeproject page as a guide to build an Impersonate User class.
• Surround the calls made to the database with Impersonation of the user from the Secure Store.

I then created a base class for my BDC Service classes that covered these three things (and a selection of other utility methods) to avoid code duplication.