SharePoint and <identity impersonate="false" />

sharepoint sharepoint-api
ArjanP picture ArjanP · Jun 30, 2009 · Viewed 9.3k times · Source

I would like to use integrated authentication to access a SQL database from a web part. It should use the IIS Application pool identity.

By default you will get the error:

System.Data.SqlClient.SqlException: Login failed for user 'SERVER\IUSR_VIRTUALMACHINE'.

Because in web.config impersonation is set to true:

<identity impersonate="true" />

I can set this to false and the database code will work. Anonymously accessed sites will also work. Any SharePoint site that uses authentication will fail however so this is not really a solution..

To solve this would I have to encapsulate all my database access code to run with elevated priviliges, is that how SharePoint does it internally? Somehow that doesn't seem like the most performant solution. Is that still the way to go, just use SQL security to access databases from SharePoint custom web parts?

Answer

dariom picture dariom · Jun 30, 2009

The <identity /> and <authentication /> elements in the web.config file will together determine the account that is used in to connect to SQL Server when using integrated authentication.

When <authentication mode="Windows" /> is configured, you're deferring to IIS to authenticate users. I'm guessing that your your web.config contains:

<authentication mode="Windows" />
<identity impersonate="true" />

and that IIS is configured to allow anonymous users. Setting <identity impersonate="true" /> causes IIS to pass the identity of the IIS anonymous access account to SQL Server.

As Lars point out, using SPSecurity.RunWithElevatedPrivileges will achieve what you want. I don't believe you'll see any noticeable impact on performance but that's something you can test :-)

Related questions

Easiest way to extract SharePoint list data to a separate SQL Server table?

Edited: What is the easiest way to scrape extract SharePoint list data to a separate SQL Server table? One condition: you're in a work environment where you don't control the SQL Server behind the SharePoint Server, so you can't just …

Read More
How to get request digest value from provider hosted app?

I am developing SharePoint 2013 Provider hosted app using javascript REST Api. In order to perform create (POST), or update (MERGE) operations on sharepoint items I need to set the 'X-RequestDigest' header with the request. When in SharePoint-hosted apps I was …

Read More
Adding list items with SharePoint 2013 REST API

I'm trying to add a new item in a existing list using SharePoint 2013 with the REST API. There is pretty good documentation for this here: http://msdn.microsoft.com/en-us/library/jj164022(office.15).aspx#ListItems The list I am trying …

Read More