SHIFT

--- Sjoerd Hooft's InFormation Technology ---

User Tools

Site Tools


Sidebar

Sponsor:


Recently Changed Pages:

View All Pages


View All Tags







WIKI Disclaimer: As with most other things on the Internet, the content on this wiki is not supported. It was contributed by me and is published “as is”. It has worked for me, and might work for you.
Also note that any view or statement expressed anywhere on this site are strictly mine and not the opinions or views of my employer.


Pages with comments

PageDateDiscussionTags
2019/11/18 13:52 1 Comment

View All Comments

iisintegratedwindowsauth

Set Integrated Windows Authentication for IIS Website

We have a webapp running on IIS that is using SQL authentication for accessing it's database. We want to change this to Integrated Windows Authentication.

Create a Service Account and Assign Permissions

When working with Integrated Windows Authentication we want to create a service account that is excluded from your normal password policy:

  • Create a service account called sa_appname
  • Set a description
  • Set a password

Assign Database Permission

Usually when working with Integrated Windows Authentication the vendor of your application will know exactly which permissions to assign to the service account used to access the database. In case you don't have this information or you're still testing the whole setup you could usually assign db_owner role to the user.

To do so, in SQL Management Studio follow these steps (notice, that these steps might change per SQL server version) :

  • In Object Explorer, expand the server in which you want to edit a fixed server role.
  • Expand the Security folder.
  • Expand the Server Roles folder
  • Right-click the role you want to edit and select Properties.
  • In the Server Role Properties -server_role_name dialog box, on the Members page, click Add.
  • In the Select Server Login or Role dialog box, under Enter the object names to select (examples), enter the login or server role to add to this server role. Alternately, click Browse… and select any or all of the available objects in the Browse for Objects dialog box. Click OK to return to the Server Role Properties -server_role_name dialog box.
  • Click OK.

Local Admin Permissions

It should normally not be required to add the serviceaccount to the local admin group on the IIS server, but I've had cases in which this was required, so in case you're testing and get error you might want to try this:

In Server Manager, follow these steps:

  • Click Tools → Click Computer Management
  • Navigate to Local User and Groups → Groups → Open the Administrators group
  • Click Add to add the sa_appname to the local admin group

Change Connection Strings

The connection strings are setup in the web.config file of the webapp on IIS. So in the IIS server, follow these steps to change the config:

  • First determine the webapp root on the filesystem. This is usually somewhere like C:\inetpub\wwwroot\appname but you check the exact setting by going into IIS Manager, selecting the website and clicking “Basic Settings”. This will show you (a.o.) the physical path of the website.
  • Once you located the web.config, open up Notepad (or your favorite text editor) as an Administrator and open the web.config file. Note that you need to set the document type to “All File (*.*)” within notepad to be able to see and open the file

In the file the connection strings are usually located at the top, and for DB Connections they ususally look like this:

<add name="DBConnection" connectionString="Data Source=WSQL-P01.getshifting.com\SQL01;Initial Catalog=Shifthub;Persist Security Info=True;User=shifthub;Password=EasyPass01!"/>

Notice that the password for the sql user shifthub is in plain text and visible to anyone with read access. Change the connection string in: <add name=“DBConnection” connectionString=“Server=WSQL-P01.getshifting.com\SQL01;Database=Shifthub;User Id=sa_appname;Trusted_Connection=True”/>

Save the file when you're done.

Setup Integrated Windows Authentication

You have a few configuration steps to take in IIS Manager to set this up completely. In IIS Manager, follow these steps:

Set the Website to Windows Authentication

  • In IIS Manager go to Sites → Select the correct site
  • Under the IIS section in the main pane, doubleclick on Authentication
  • Click on Windows Authentication and click on Enable under Actions

Set the IIS Server to Windows Authentication

  • In IIS Manager go to the IIS Server (identifiable by it's system name)
  • Under the IIS section in the main pane, doubleclick on Authentication
  • Click on Windows Authentication and click on Enable under Actions

Configure the Application Pool to use the Service Account

  • In IIS Manager go to Application Pools → Select the correct Application Pool
  • Click on Advanced Settings under the Actions pane
  • Scroll down and select the Identity setting under Process Model and click the small box with three dots next to it
  • Select Custom Account and click set
  • Enter the service account name in domain format, so for example: shift\sa_appname and provide the password
  • Save your changes

Restart the Website

  • In IIS Manager go to Sites → Select the correct site
  • Click “Restart” under the Actions Pane

Test Configuration

You can test the configuration in IIS Manager:

  • In IIS Manager go to Sites → Select and expand the correct site
  • Select the home object (identifiable by the globe icon with a document in front of it)
  • Click on Basic Settings under the actions pane
  • Click on “Test Settings”

Now a test for the authentication (service account credentials) and authorization (file access) will be done.

Resources

Discussion

Enter your comment. Wiki syntax is allowed:
I X X A F
 
iisintegratedwindowsauth.txt · Last modified: 2020/02/25 14:09 by sjoerd