Hi. I'm trying to make my website more secure. Here is the environment:
- Web Server (IIS 6.0)
- SQL Server (setup with Mixed Mode authentication)
- Both in same domain
- For VB apps, we use a trusted Windows Authentication connection
The only way I can get the app on the Web Server to talk to the database on the SQL Server is to put the username and password of a SQL logon in the connection string of the web.config file. I'd rather have it impersonate a service account, but the best I can get is "Invalid login for user '(null)' : Not associated with a trust SQL Connection". I tried to get it to impersonate a network account, but still had to type in the full username and password in the web.config file. When doing that, I got an error that the user didn't have access to a temp folder in the framework folder. I'd rather not leave the username and password in web.config. Is there another way to do this? Thanks!!