Data Access


To access a remote database using Windows authentication from your ASP.NET application, you have the following options:

  • Use the default ASP.NET process account . Use the default ASP.NET process account by creating a mirrored account with the same user name and password on the database server. On Windows 2000, the default process account is ASPNET. On Windows Server 2003, the default process account is NetworkService.

    The disadvantage of using local accounts is that if you can dump the SAM database, which requires administration privileges, then you can access the credentials. The main advantage is that local accounts can be scoped to specific servers, which is difficult to achieve using domain accounts.

  • Use a least privileged domain account to run ASP.NET . This approach simplifies administration, and it means that you do not need to synchronize the passwords of mirrored accounts. It will not work if the Web server and database server are in separate non-trusting domains, or if a firewall separates the two servers and the firewall does not permit the necessary ports for Windows authentication.

  • Impersonate the Anonymous Web account . If you are using Forms or Passport authentication, you can impersonate the anonymous Web account (IUSR_MACHINE by default) and create a mirrored account on the database server. This approach is useful in scenarios where you host multiple Web applications on the same Web server. You can use IIS to configure each application's virtual directory with a different anonymous account.

    On Windows Server 2003, you can run multiple applications in separate worker processes, using IIS 6.0 application pools and configuring a separate identity for each one.

Configuring Data Access for Your ASP.NET Application

Whichever approach you use, restrict the application's account in the database. To do this, create a SQL Server login for the account, grant it access to the required database, and restrict its permissions so that it only has access to the minimum required database objects. Ideally, you should restrict permissions so that the login has access only to the stored procedures used by your application or Web service.

The following procedure assumes that you are using a mirrored local account, but you can use the same approach with a domain account to restrict the account's capabilities in the database.

 Task   To configure database access for your ASP.NET application

  1. Use the Computer Management tool to change the password of the local ASPNET account on the Web server to a known strong password.

    You need to do this so that you can create a mirrored account on the database server.

  2. Change the password attribute on the <processModel> element in Machine.config so that the ASP.NET worker process continues to run using the ASPNET account. Use Aspnet_setreg.exe to store the encrypted credentials in the registry.

  3. Create a local account on the database server with the same name (ASPNET) and strong password on the database server.

  4. Create a local Windows group, such as ASPNETWebApp, on the database server, and then add the local ASPNET account to the group .

  5. Grant the Windows group access to SQL Server by creating a new login, as follows :

     sp_grantlogin 'MACHINE\ASPNETWebApp' 
    Note  

    Replace MACHINE with your database server name.

  6. Grant the SQL login access to the database. The following T-SQL creates a database user called WebAppUser to which the login is associated.

     USE YourDatabase GO sp_grantdbaccess 'MACHINE\ASPNETWebApp', 'WebAppUser' 
  7. Create a user-defined database role.

     USE YourDatabase GO sp_addrole 'WebAppUserRole' 
  8. Add the database user to the new database role.

     USE YourDatabase GO sp_addrolemember 'WebAppUserRole', 'WebAppUser' 
  9. Configure permissions in the database for the database role. Ideally, grant execute permissions only for the stored procedures that the application uses to query the database and do not provide direct table access.

     grant execute on sprocname to WebAppUserRole 



Improving Web Application Security. Threats and Countermeasures
Improving Web Application Security: Threats and Countermeasures
ISBN: 0735618429
EAN: 2147483647
Year: 2003
Pages: 613

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net