How to allow access to web service running under ApplicationPoolIdentity

Question

Hi All,
I have a WCF web service hosted in IIS 7 (or maybe 7.5, whichever comes with Windows server 2008 R2) using DefaultAppPool running under ApplicationPoolIdentity per Microsoft's recommendation. The web service needs to call a stored procedure to insert data
to a db. The web server is on a different VM than the database server. The db server is running SQL 2008 R2. Both VMs run Windows server 2008 R2.
When the web service tries to connect to db, it encounters this exception:
Exception in InsertToDb()System.Data.SqlClient.SqlException (0x80131904): Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
   at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
Here's the connection string in web.config:
Application Name=somewebservice;Server=somewebserver;Integrated Security=SSPI;Database=somedatabase;Connection Timeout=60"
How should I configure SQL security to make this work?
Thanks in advanced.

Answer 1

Thanks for the link Dan. Maybe I'm the one who cause the confusion :)
If I understand you(and Erland) correctly, you suggest using a custom, domain account for application pool identity. However, if we do that, our IT will need to maintain those accounts, and they don't  want that. So I'm choosing a built-in account called
ApplicationPoolIdentity as the application pool identity, but it's not working. Network Service, on the other hand, works, but my boss wants us to follow MS's best practice.
What's puzzling is that according to this: http://learn.iis.net/page.aspx/624/application-pool-identities/, both Network Service and ApplicationPoolIdentity uses machine account to access network resource (like db in this case), but in my case, Network Service
works, but not ApplicationPoolIdentity.
Hallo Stephen,
with respect - it seems to me that only idiots are working at your IT ;)... It is absolutely useful to work with "service accounts" created within the domain. That's the only way to manage and control accounts!
If you want to "pass through" the identity of the web user (SSO) you have to check whether the app pool is set to "allow impersonate". As far as I understand the ApplicationPoolIdentity-function the app pool will create a unique user named as the service.
I assume that will not work with the connection to the sql server because this user is unknown.
Local Service will not work because it's restriction is located to the local machine.
Network Service will work because access to network resources will be available.
So my recommendation is to use a dedicated service account or impersonation:
http://msdn.microsoft.com/en-us/library/xh507fc5.aspx
Uwe Ricken
MCITP Database Administrator 2005
MCITP Database Administrator 2008
MCITS Microsoft SQL Server 2008, Database Development
db Berater GmbH
http://www-db-berater.de