Now I've got a question for you. I'm running a ASP.NET REST Web API using OWIN running as a windows service. Now I've got SQL Server running on a different host, containing a table with binary data and FILESTREAM enabled.
I want to pass this binary data from the web API to the caller. How do I get owin to access SQL Server with credentials that can access the FILESTREAM?
Appreciate your help!
Related
I want to deploy my web application including a SQL Server 2008 database from my local machine to my hoster.
So far I used the Windows authentication, is it necessary to switch to username and password when I want to make my application public on the internet?
And if that's the case, what's the best practice to hide that information if they are saved as strings in the web.config?
Side note: I use Linq to Entities as Object Mapper and within the code I use
HttpContext.Current.User to authenticate the user
If you are not using shared hosting, then you can keep using windows authentication which is more secure than having SQL server user.
You should also disable remote connections so that no one can directly access SQL server to make it more secure.
For encrypting connection string check this site.
I have an Asp.Net MVC 3 website that uses asp.net membership services for authentication. The membership database has been running on Sql Server Express 2008 and I am attempting to convert it to Sql Sever Compact 4.0.
Following the instructions here I have created the Sql Server Compact 4.0 database. I used the code from here to switch the membership provider in the MVC app.
Using the new provider and database I am able to successfully create new users and log in using the new user's password. However, I am not able to login to any of the users that previously existed in the Sql Server Express database. I am able to browse the new database and have verified that the users are all there, so I believe the problem is somehow related to not being able to successfully access the encrypted passwords that had been previously created. I really don't want to have all of the existing users change their passwords. Can anyone shed some light as to how I can make this happen?
Is it possible it has something to do with the ApplicationName property in the web.config file?
See this blog post from ScottGu for more information:
Always set the "applicationName" property when configuring ASP.NET 2.0 Membership and other Providers
I'm learning WCF. I've created a WCF service which uses a local SQL Server database. I've configured the database server to use Windows authentication. When I use the WCF service with a WPF application, everything works.
When I use the WCF service with a WPF browser application, however, I get an error which, I believe, means I don't have security configured properly. The specific error is: "That assembly does not allow partially trusted callers."
I'm trying to figure out how to configure the security properly, starting with the security in SQL Server, but I'm having trouble finding answers. Can anyone help me with these questions?
1) Do I need to reconfigure SQL Server to use SQL Server authentication instead of Windows authentication? If so, are there recommended guidelines for naming the user and configuring the privileges of the account created for the WCF service?
2) The database is on the local machine now only so I can experiment. Down the road, I'm going to move the database to a server. Will the security configuration required by WCF change when I do that?
-TC
do you host your WCF in IIS (which version) or self hosted? If IIS then probably need to run IIS it in Full Trust mode
try not to use SQL Server Authentication if you don't have to.
I have one web server & one DB server (running SQL SERVER 2008). Both the servers are in different domains. The web server is allowed to communicate(the communication takes place internally without the intervention of firewall) directly with the DB server, it is given Admin privileges & the DB access through SQL is going on without any problems.But whenever the web server tries to access the Reporting Server & its services, its asking for a separate authentication(Local system account authentication has been configured for SQL Server). I want to know whether is there any way to get rid of this separate authentication for Reporting Services
If you are being prompted for credentials when running a report, then your data source is configured to prompt at run time. You'll need to change the DS to use a SQL login if you don't want this to happen. Your windows credentials cannot be passed from one server to another.
If you are being prompted to log on to the RS site - I've only experienced that on firefox but fixed with a firefox config setting to save the cred for the domain.
I've been developing a site using ASP.NET MVC, and have decided to use the new SQL Server 2008 FILESTREAM facility to store files 'within' the database rather than as separate entities. While initially working within VS2008 (using a trusted connection to the database), everything was fine and dandy. Issues arose, however, when I shifted the site to IIS7 and changed over to SQL authentication on the database.
It seems that streaming a FILESTREAM doesn't work with SQL authentication, only with Windows authentication. Given this, what is the best practice to follow?
Is there a way to force this sort of thing to work under SQL authentication?
Should I add NETWORK SERVICE as a database user and then use Trusted authentication?
Should I create another user, and run both the IIS site and the database connection under this?
Any other suggestions?
Take a look at this article. I don't know a whole lot about FileStreaming and security, but there are a couple of interesting options in the FileStreaming setup such as allowing remote connections and allow remote clients to access FileStreaming