title: Anonymous access (IIS) and SQL Server
body: <p>I just had an interview in Redmond where they asked me a ton of security based questions surrounding asp.net.  One of the questions they asked was about configuring a secure intranet application to use constrained delegation to access the SQL Server.  In this scenario an AD user account is delegated access to the SQL Server.  The whole purpose of course is to a) not store any username/password anywhere on the web server (web.config), and b) provide an abstracted security model that can be managed in Active Directory.</p>
  
  <p>This got me to thinking about how I have been configuring my sites for anonymous access all these years.  Typically I will run my IIS websites using the default anonymous account and store the connection string in the web.config (encrypted, and sometimes in clear text).  This, of course, requires your SQL Server to run in mixed mode.  So my question is, what if we didn't store the connection string in the web.config at all, and just created a unique anonymous domain account for the particular website that would have db_datareader access within SQL Server?  Is there any reason why it would be a bad idea to do this?</p>
  
  <p>I have tried to think of all the scenarios where this would be a bad idea, and the only one I can think of is where a "hacker" compromised the code on the web server, and then somehow got access to your SQL Server...but this could happen in either scenario.</p>
  
  <p>Does anyone know the best practice here?</p>