Can't get rid off "Login failed for user IIS APPPOOL\NETWORKSERVICE"

Question

I'm trying to access a sql server database from an ASP NET app configured to work with IIS.

I have several questions now,

1) Authentication in IIS: I need to know if my authentication settings for the site are ok:

I tried with Windows Authentication set to Disabled, but the problem continues.

2) Are the settings for the user NT AUTHORITY\Sericio de red well configured? ("Servicio de red" means Network Service)

3) When I added the login for network service, I only found "Servicio de red", I guess it's the equivalent for NetworkService, I'm I right?, My windows 7 ultimate is an spanish version, I just changed the windows interface by using a windows upgrade to make it appear in english. Is there a problem with it?, I guess it's right because the access to the database is being done through the IIS APPPOOL\Servicio de red user.

My DefaultAppPool identity is set to to AppPoolIdentity

If you want to see what I have tried, see this thread.

The whole project, along with a backup of the database I'm using can be found here, called MyServiceSolutionInIIS

What I'm trying is to build a WCF Data Service that offers information that comes from an entity data model generated from a sql server database. This service will be used by a WPF App as a client.

I'd like to avoid creating a user for it, I think it can be done with the App Pool

Answer 1

Okay so the way this works is, whatever application pool your endpoint is running under passes its credentials to the SQL Server. So, you have two options:

1. Run the default application pool under NetworkService, or;
2. Use SQL Authentication when connecting with your web service to the SQL Server.

Honestly, the latter is the most common, but in your situation you may be just fine by changing the default application pool to run under NetworkService.

Answer 2

This has nothing to do with the authentication you've chosen (well, mostly nothing.. you can control which credentials anonymous users run under). Every website runs in an app pool, and this app pool has an AppPoolIdentity.

I'm a little confused as to why it would be claiming it's IIS AppPool\NetworkService, since NetworkService should be NT AUTHORITY\NetworkService, or IIS AppPool\MyAspService or IIS AppPool\DefaultAppPool.

There is a lot more information on App Pool Identities here:

http://www.iis.net/learn/manage/configuring-security/application-pool-identities

Note: There is a bug in IIS 7.5 (the version of IIS that comes with Windows 7 and Windows Server 2008 R2) that sometimes causes authentication problems with AppPoolIdentities if the users password changes (say, if you have mandatory password change policies). There is a hotfix here:

http://support.microsoft.com/kb/2545850/en-us

More info here:

IIS application using application pool identity loses primary token?

Answer 3

There so many scenarios in which this issue occurs.

First thing you need to clear if you are using windows authentication and you are not mentioning any username password in your connection string then:

What happens when you run your code through localhost: when you run your wcf test client from localhost, it will be able to communicate to database as local debug mode application is calling database by your account's service. So it has access to database because devenv.exe is running under your user account.

But when you deploy your web service in IIS. Now understand this service runs under IIS not under your account. So you need to assign access rights to IIS service to access the sql server for windows authentication. Here your web service would not be able to communicate to the SQL server because of access rights issue and Login Failed for user_______ (here your user will come)

So if you are using windows authentication to connect your database, you just have to change the IIS Application pool settings. You need to change IIS Application pool's identity to: local System (for single windows user). Network Service (for intranet users or domain users)

Below are the Steps for windows authentication WCF: •Open IIS (windows+R (run) then type inetmgr, then click ok) •double click your PC name under Connections •Click Application Pools •Select your app pool (DefaultAppPool) •Then under actions on the right click Advanced Settings: •Go to Process Model section and •click on Identity. •Now select LocalSystem (for single windows authentication user). or select Network Service (for Intranet users)

Now open your sql server management studio: open run-> then type ssms then press ok in ssms, login using your windows authentication account. open security tab expand logins tab then you will be able to view your account.

Now open properties of your account go to userMapping then select the database you want to connect then check the role membership services you want to use for the selected database click ok. (For network services i.e. intranet users you need to configure above settings for NT AUTHORITY\SYSTEM user too)

add Trusted_Connection=True; property in your connection string. Save it & deploy the web service. Restart app pool.

you will be able to connect the database now.