Solved

How to to use sql server application role in my connection string

Posted on 2014-02-05
7
1,352 Views
Last Modified: 2014-03-04
My current application uses very powerful credential to access the sqlserver backend database. I want to improve this security hole in my application by using application role created.
I created one call:app-role, and it password =password.
In my webconfig file i just the app-role with it password. but when i trying to log in it fail.
Can some tell me what am doing wrong .I will appreciate a sample
0
Comment
Question by:Atouray
  • 3
  • 2
  • 2
7 Comments
 
LVL 16

Expert Comment

by:Surendra Nath
ID: 39835579
for authenticating in SQL Server, you can choose either a windows authentication or a SQL authentication or both of them...

in your case I suggest you to use the SQL Authentication and put them in the webconfig file.....

and add all the roles that you want to the SQL authenticated User....
0
 

Author Comment

by:Atouray
ID: 39835689
I know about the two types of authentication on sqlserver.
The sqslserver database user account my application uses to login can be easily access for example our internal developers. once they are able to get the credentials from the web configuration, they can use it to login with management studio.But with Application role, the web application can use it and even is access by some one else , it cannot be use to login with management studio. This is my objective of using application role in my connection string
0
 
LVL 16

Expert Comment

by:Surendra Nath
ID: 39835744
instead of it you can use the firewall on the SQL Server machine, to allow only your webserver or application servers incoming connections and block any other IP's.

This way any one who will have the physical or remote access to your application server can only login into the SQL Server.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:Atouray
ID: 39835959
Application Roles;
This application role enable you to grant permissions to specific application.
For Example you might have a web application that needs to interact with a database hosted on a back-end sqlserver instance.
Rather that having a user access the database with a database user permission, the user accesses the data by the permission assigned to the
application role.
This is why am using this approach.After this, i can configure my application to be access via certain port through fire wall.
0
 
LVL 75

Accepted Solution

by:
Anthony Perkins earned 500 total points
ID: 39842584
I suggest you read up on Application Roles and in particular the use if sp_setapprole
0
 

Author Closing Comment

by:Atouray
ID: 39903443
My question was not fully answer but your link is useful
0
 
LVL 75

Expert Comment

by:Anthony Perkins
ID: 39905198
My question was not fully answer but your link is useful
Perhaps next time you will take the time to re-read the EE Guideline regarding grading.  Clearly you need a re-refresher.
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

In this article I will describe the Backup & Restore method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
Ever needed a SQL 2008 Database replicated/mirrored/log shipped on another server but you can't take the downtime inflicted by initial snapshot or disconnect while T-logs are restored or mirror applied? You can use SQL Server Initialize from Backup…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
A simple description of email encryption using a secure portal service. This is one of the choices offered by The Email Laundry for email encryption. The other choices are pdf encryption which creates an encrypted pdf of your email and any attachmen…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now