title: Issue Passing Credentials from ASP.NET To SQL Server
body: <p><strong>Setup:</strong></p>
  
  <p>IIS on Windows 2008 Server R2 Enterprise, SQL Server 2008 R2 Enterprise, ASP.NET 2.0 Web Application.</p>
  
  <p><strong>Purpose:</strong></p>
  
  <p>We are converting the security model of an old web app from using a single SQL Server account to using Active Directory accounts. In the ASP.NET application, we've added <code>&lt;identity impersonate="true" /&gt;</code> as the first item in the <code>&lt;system.web&gt;</code> section of web.config. We've added database roles, which contain Active Directory groups, for granting access to the existing stored procedures. Our web.config already contains <code>&lt;authentication mode="Windows"/&gt;</code>. Here is my connection string, editing out server and DB names:</p>
  
  <pre><code>&lt;add name="DbConn" 
       connectionString="
           Data Source=SERVER;
           Initial Catalog=DBNAME;
           Integrated Security=SSPI;"
       providerName="System.Data.SqlClient"
  /&gt;
  </code></pre>
  
  <p><strong>Problem:</strong></p>
  
  <p>I am getting an error when trying to open an SqlConnection to the database:</p>
  
  <blockquote>
    <p>Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.</p>
  </blockquote>
  
  <p>Instead of going through all the logical layers of the application (web page to .DLL layers), I threw in a quick, plain web page that does some <code>Response.Write</code> in <code>Page_Load()</code>. I get this (account info edited out):</p>
  
  <blockquote>
    <p>HttpContext.Current.User.Identity.Name = domain\my account</p>
    
    <p>My.User.Name = domain\my account</p>
  </blockquote>
  
  <p>Then <code>Page_Load</code> calls a Sub that does some <code>Response.Write</code> and tries to run an existing stored procedure. I get this:</p>
  
  <blockquote>
    <p>Before opening the DB connection ...</p>
    
    <p>HttpContext.Current.User.Identity.Name = domain\my account</p>
    
    <p>My.User.Name = domain\my account</p>
    
    <p>Sub TestDbCall() Failed! ex.Message = Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.</p>
  </blockquote>
  
  <p>It fails on opening the SqlConnection with error message above (Login failed ...). Clearly, the ASP.NET application recognizes my domain account. It seems that my Windows credentials are not propagating from the ASP.NET app to SQL Server. I'm at a loss as to why.</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I found this <a href="http://msdn.microsoft.com/en-us/library/bsz5788z%28v=VS.80%29.aspx" rel="nofollow">page on microsoft.com</a> that says in order to access an SQL Server that is not on the IIS server (who would even DO this???), you can't use Windows Authentication in IIS. Rather, you have to use Basic Authentication. It works, but I don't like the idea of users' account name and password floating around the corporate network in plain text. So even though it "works", I don't accept my own finding as an answer.</p>