Add IIS 7 AppPool Identities as SQL Server Logons

 

I'm running an IIS 7 Website with an AppPool of Integrated Pipeline Mode. The AppPools does NOT run under NetworkService, etc.. identity (by purpose), but uses it's own AppPool Identitiy (IIS AppPoolMyAppPool).

This is a so called service account or virtual account. (a user account, which is not a full account...)

I'd like to give this service account (IIS AppPoolMyAppPool) permissions to connect to my SQL Server 2008 Express (running in Mixed Auth. Mode).

While SQL Server can add any normal user account, the IIS AppPoolMyAppPool virtual account cannot be added to the valid logons (SQL Server says, that the account cannot be found).

Is there any trick, anything I need to enable to make the virtual accounts work? (the w3wp.exe process runs under this identity according to taskmgr, but I cannot use the account in NTFS security either...)

Thanks for your help!

The "IIS APPPOOLAppPoolName" will work, but as mentioned previously, it does not appear to be a valid AD name so when you search for it in the "Select User or Group" dialog box, it won't show up (actually, it will find it, but it will think its an actual system account, and it will try to treat it as such...which won't work, and will give you the error message about it not being found).

How I've gotten it to work is:

  • In SQL Server Management Studio, look for the Security folder (the security folder at the same level as the Databases, Server Objects, etc. folders...not the security folder within each individual database)
  • Right click logins and select "New Login"
  • In the Login name field, type IIS APPPOOLYourAppPoolName - do not click search
  • Fill whatever other values you like (ie, authentication type, default database, etc.)
  • Click OK

    • As long as the AppPool name actually exists, the login should now be created. 

    CREATE LOGIN [IIS APPPOOLMyAppPool] FROM WINDOWS;
CREATE USER MyAppPoolUser FOR LOGIN [IIS APPPOOLMyAppPool];

    As a side note processes that uses virtual accounts (NT ServiceMyService and IIS AppPoolMyAppPool) are still running under the "NETWORK SERVICE" account as this post suggests http://www.adopenstatic.com/cs/blogs/ken/archive/2008/01/29/15759.aspx. The only difference is that these processes are members of the "NT ServiceMyService" or "IIS AppPoolMyAppPool" groups (as these are actually groups and not users). This is also the reason why the processes authenticate at the network as the machine the same way NETWORK SERVICE account does.

    The way to secure access is not to depend upon this accounts not having NETWORK SERVICE privileges but to grant more permissions specifically to "NT ServiceMyService" or "IIS AppPoolMyAppPool" and to remove permissions for "Users" if necessary.

    If anyone has more accurate or contradictional information please post.

    链接地址: http://www.djcxy.com/p/7726.html

    上一篇: 如何在SQL Server中将Active Directory用户组添加为登录名

    下一篇: 将IIS 7 AppPool标识添加为SQL Server登录