I am developing an asp.net web application for my company and am at a crossroads. I will give the backround and ask for opinions.

• Windows authentication, all users have an account. All users are employees

• IP restricted acces to Intranet for users hitting Intranet from outside the LAN

• Data is on SQL 2005 Server

Have been developing with an IIS that was on the same machine as the sql server. Using AD roles as users on the sql server and wanted to use logged on user credentials to access data. Everything worked fine during development. When I published the app to the test Production IIS server which is on a different machine than the sql server, you guessed it, I had permmision issues. Now I have researched this quite a bit and it seems I have options.

• Use Kerberos
• control users ability to alter data at the web form level, add username field to every record to identify last user to alter data(which will happen regardlessof security model)

I am in a bit of a hurry to get this app in production and I believe that I can go with the second option for now and come back and hit the learning curve on Kerberos later and impement it down the road if I even need to.

Any thoughts would be appreciated. Thanks.

• No Related Post