1

I'm new to IIS/ASP .Net development, my application is using connection string which are declared to my web.config.

Now I read/heard that I can use IIS App Pool Identities to use instead of web.config.

Here's what I did:

  • I've deleted my connection string from my web.config
  • setup my app pool Identity property -> (Identity = ApplicationPoolIdentity)
  • Added my connection string declared/within the App Site Connection Strings under "Custom" like "Data Source=sql...blah;Initial Catalog=dbname;Integrated Security=False;Persist Security Info=False;User ID=MyDBUserName;Password=MyPassword;Connect Timeout=60;Encrypt=False;Current Language=English;"

It works as far as I know, but my question is, is this really how you configure it?

I was under the impression that you could use some variable (username, pass, dbname..etc), declared it on your web.config and binds it thru your app pool identities but I cannot find any article regarding that.

Thank You

vegetta
  • 13
  • 3
  • Before diving too deep into the mystery, you should ask yourself what the connection string means. Why `Integrated Security=False` and why `User ID` and `Password` are required? What authentication mode is used on your database side. Learn from your database administrators or hire someone. Only when you are very clear of those areas, you can come back to IIS and its pool settings. – Lex Li May 16 '22 at 22:50

1 Answers1

1

You can set the user that the app-pool runs under. All that does is make the app-pool think that the user is some particular user who is logged on to the server.

This tends to NOT effect your database code, since you STILL need to tell your code what database to use. Even if your host computer and network is say using a domain controller, and you using windows logons to consume sql server. Your .net code behind will WILL need some connection string to specify the database and server anyway. And you having added that user under app-pool identify (I assume this one):

enter image description here

Well, now that "user" is for your file and network rights. So, that user can say be restricted to some set of folders - maybe a another server with large number of documents.

Added my connection string declared/within the App Site Connection Strings under "Custom"

Yes, and that puts the connection string in web.config - if you check the web config after doing above, you should see that string in web.config.

So, in theory, in your code, you can connect to the database server - and your app-pool user will be used, but you STILL have a connection string - what database, what server, etc. still needs to be defined (and used in your code). I mean, say desktop with windows authentication to SQL server does not get you off the hook as having a defined connection string some place to use. While the user might be running in the context of the "defined" app-pool user, you still need some place to store and eventually use some connection string. So, the fact of defining what user in app pool the code behind will run as? You still need a connection string and the connection string you use to the database would not be stored, nor come from app-pool settings anyway.

Albert D. Kallal
  • 42,205
  • 3
  • 34
  • 51