Secure login to sql 2012 database for webusers

We build up a new website in .net mvc 4.0 on a w2012 server with MSSQL 2012 database.
We use windows autentification and normal anonymous access through NT AUTHORITY\IUSR who is also a login in the database.
But we make extra login possibility for users who are registered and they can insert and modify data in some tables in the database. And I'am afraid of giving NT AUTHORITY\IUSR insert and update for some column in tables.
I think of set up a new login for the database. Run a new connection string on login and set up special permission for that extra user on the database, set up a new role and let the new user become member, but also let the user become a member of the ordinary
user(roles) in the database.
Have anyone any idea what is the best practice here and the most secure way to do it?
Any links for other resources about this topic?
Or perhaps my fear for using NT AUTHORITY\IUSR is groundless
And perhaps someone has links to resources for using SQL server as a backendserver for websites.
Knut from Norway!

I don't know much about web servers, which may explain your alternatives entirely.
But, if you use the same connection string for reads that you do for updates, then you must control all permission for writes in the web app. And you must be sure that you only use parameterised SQL or stored procedures, so that there is no risk for SQL
injection.
If you give special logins for the users with read access, they would need their own accounts in SQL Server. If this is an intranet site, the web server may be able to impersonate these users and then connect to SQL Server. If that does not work out, you
would have to create SQL logins for these.
Obviously, this requires more administration, but it is also more secure, because you are adding a line of defence. Even if your application is free from SQL injection vulnerabilities today, some new badly educated kid on the block could open a hole two
years later.
Erland Sommarskog, SQL Server MVP, [email protected]

Similar Messages

Add login to sql 2012 server for a virtual account from another sql 2012 server

I have two sql 2012 servers.
Server A has sql server agent running virtual account: NT Service\SQLSERVERAGENT
Server B has some databases.
Server A is running a scheduled SSIS package that needs access to Server B's databases via Windows Auth
Thus I want to grant access by creating a login on Server B to the virtual account on server A: NT Service\SQLSERVERAGENT
Q1 - Is this possible?
Thanks beforehand.
Paulino

Raul,
As a matter of a test and not with the actual intention to use it this way, I did try to add a login using the DOMAIN\MACHINE_NAME$
concept but it did not work anyway. I will not find it.
So I will use one of the approaches recommended by Mr. Gallardy
Thanks!
Paulino

Use a SQL 2012 database server with Reporting Services 2008?

Hello, we have a SQL Server 2008 R2 Reporting Services Standard server with the reporting databases running on a SQL Server 2008 Standard database server. I would like to upgrade the database server to SQL Server 2012 before I upgrade the reporting server.
Can I run SQL Server 2008 R2 Reporting Services against a 2008-version database running on a SQL 2012 database server? Thanks for your help.

Hi Nicole
Thanks for your posting.
Are you asking if we can connect from SSRS 2008 r2 to a database sitting on SQL Server 2012. Am I right?, please ignore me if I misunderstood your question. If that is your question
then I think you will be able to using BIDS 2008, I have created A database on SQL Server 2012 and I use that database table inside my SSRS 2008 R2 dataset. I can even think that you can use a database of compatibility level of 2012(110) as well
Many thanks
Syed Qazafi Anjum

SQL 2005 to SQL 2012 Replication for SSRS

I recently successfully implemented one-way log shipping from a production SQL 2005 database to a new SQL 2012 database in the hopes that I can use the 2012 database to run SSRS 2012 on it.
Unfortunately, the 2012 database is kept offline since log shipping between two DIFFERENT SQL versions can only be done in a NO RECOVERY mode. (Standby mode is NOT available which would make the SQL 2012 read only and therefore workable for SSRS
2012.)
Does anyone have any suggestions on if there is another method on how to achieve this?

Yes, You can try replication. I hope you've latest service pack upgrade for SQL 2005.
http://msdn.microsoft.com/en-us/library/ms143699.aspx
BOL:-
A Subscriber to a transactional publication can be any version within two versions of the Publisher version. For example: a SQL Server 2005 Publisher can have Subscribers running SQL Server 2005, SQL Server 2008 (including SQL Server 2008 R2), or SQL Server
2012; and a SQL Server 2012 Publisher can have Subscribers running SQL Server 2005, SQL Server 2008 (including SQL Server 2008 R2), or SQL Server 2012.
-Prashanth
-Prashanth

Using integrated security to access SQL Server database

Hi,
Currently we are using username/password combination to log in to a SQL Server database. These varaiables are defined as environment variables.
For security reasons we now want to use integrated security of the SQL Server database. This way the connection will be with the NTUser the Nodemanager has been started with.
Can this be done in Fort�?

I do not think there is a way to pass the NT user's security authentication over to the DB in UDS.
ka

How to find the logins,program name and databases for a session id?

I used the following the following query.
select pr.spid ,pr.dbid,pr.program_name,pr.loginame,ss.session_id,ss.host_name,ss.login_time,db.name from master.dbo.sysprocesses pr,sys.dm_exec_sessions ss,sys.databases db
where pr.spid = ss.session_id and pr.dbid = db.database_id
order by ss.login_time desc
Is spid in master.dbo.sysprocesses the same as session_id in sys.dm_exec_sessions and dbid in master.dbo.sysprocesses the same as database_id in sys.databases?
My intention is to get the active sessions with the program name,login Name and database name corresponding to the session?

1)Why you included the clause session_id > 50?
Sessions with session_id <= 50 are system processes.
2)Is there any problem with the query I used?
You query was better than Latheesh's. To wit, his query will only show the database for sessions who are actually running something.
On SQL 2005 and SQL 2008, this is the best solution:
SELECT des.session_id, des.[status], des.login_name,
d.name AS database_name, des.program_name
FROM sys.dm_exec_sessions des
JOIN sys.sysprocesses p ON des.session_id = p.spid
LEFT JOIN sys.databases d ON p.dbid = d.database_id
WHERE   des.session_id > 50
AND   p.ecid =0
ORDER BY des.session_id;
The condition p.ecid = 0 is needed to weed out extra rows when there are parallism in force.
On SQL 2012, you don't need sysprocesses, but this works:
SELECT des.session_id, des.[status], des.login_name,
d.name AS database_name, des.program_name
FROM sys.dm_exec_sessions des
LEFT JOIN sys.databases d ON des.database_id = d.database_id
WHERE   des.session_id > 50
ORDER BY des.session_id;
Erland Sommarskog, SQL Server MVP, [email protected]

Sql 2012 server for SCCM 2012 - Agent not starting

Hi ,
In our environment we have a Sql 2012, and it was working fine till now. but after installation of RDP role and subsequent installation of certificates for remote desktop in the SCCM server ( SQL 2012 is
installed in it)
we are facing the issue - Sql server management studio not connecting ( windows authenticaltion)
1) A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - No process is on the other end of the pipe.) (Microsoft SQL Server, Error: 233)A
2) I tried starting the sql agent service in services.msc and the below error came
The SQL Server Agent (MSSQLSERVER) service on Local Computer started and then stopped.
Some services stop automatically if they are not in use by other services or programs.
3) In the Sql Server configuration manager also tried starting the sql agent but
The request failed or the service did not respond in a timely fashion.
Consult the event log or other applicable error logs for details.
The widows event logs show this error
A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection.
The TLS protocol defined fatal error code is 20. The Windows SChannel error state is 960.
We have removed the certificate and the RDP role in that .
Can anyone please help on this
Anand M

I would check for error messages in the SQL Server ERROLOG file and also Agent's SQLAGENT.OUT file.
Tibor Karaszi, SQL Server MVP |
web | blog

Cannot drop login from SQL 2012

I am trying to drop a login with no mapped dbs, no owned schemas, no rights, no endpoints, nothing what-so-ever and I have been at this for 4 hours. This is the error, is there any global way to determine what in the world SQL 2012 sees this login
as owning?????
Msg 15141, Level 16, State 1, Line 1
The server principal owns one or more server role(s) and cannot be dropped.

****************To check User Own Schema
select * from sys.schemas where principal_id = user_id('user_name')
select * from sys.database_principals where owning_principal_id in (
select principal_id from sys.database_principals where name='DomainName\UserName')
ALTER AUTHORIZATION ON SCHEMA::SchemaName TO dbo
*************** To Transfer any object owned by user/principal
SELECT 'ALTER SCHEMA [dbo] TRANSFER [' + SCHEMA_NAME([schema_id]) + '].[' + [name] + '];'
FROM sys.objects
WHERE [schema_id] IN (SELECT [schema_id] FROM sys.schemas WHERE principal_id = USER_ID('DomainName\UserName'))
************** To Check Role Owner
select dp2.name as role, dp1.name as owner
from sys.database_principals as dp1 inner join sys.database_principals as dp2
on dp1.principal_id = dp2.owning_principal_id
where dp1.name = 'Username'
************** To Change Role Owner
ALTER AUTHORIZATION ON ROLE::[RoleName] TO [dbo];

SQL 2012 Database Availability Group - Force Automatic Failover

Hi All,
I'd appreciate some help in understanding the following scenario in my test environment.
I have created a DAG with 2 replica servers (both of which are HyperV VM's running W2012 Std).
From a client PC in my test lab, I can connect to the virtual listener of my DAG and confirm via the "select @@servername" command that I am connecting to the primary replica server.
Using the Failover Wizard, I can easily move to primary instance between my 2 nodes and the command above confirms that the primary replica server has changed. So far so good.
What I wanted to test, was what would happen to my DAG in the event of a complete loss of power to the server that was acting as the primary replica server. At first, I thought I would stop the SQL Server service on the primary server, but this did not result
in my DAG failing over to the secondary replica. I have found out that the only way I can do this is by effectively shutting down the primary server in a controlled manner.
Is there any reason why either stopping the SQL Server service on the primary replica, or indeed forcing a power off of the primary replica does not result in the DAG failing over to the secondary replica?
Thanks,
Bob

Hi,
I would verify if Database Availability Group means AlwaysOn Availability Group.
How did you set the FailureConditionLevel?
Whether the diagnostic data and health information returned by sp_server_diagnostics warrants an automatic failover depends on the failure-condition level of the availability group. The failure-condition level specifies what failure conditions
trigger an automatic failover. There are five failure-condition levels, which range from the least restrictive (level one) to the most restrictive (level five). For details about failure-conditions level, see:
http://msdn.microsoft.com/en-us/library/hh710061.aspx#FClevel
There are two useful articles may be helpful:
SQL 2012 AlwaysOn Availability groups Automatic Failover doesn’t occur or does it – A look at the logs
http://blogs.msdn.com/b/sql_pfe_blog/archive/2013/04/08/sql-2012-alwayson-availability-groups-automatic-failover-doesn-t-occur-or-does-it-a-look-at-the-logs.aspx
SQL Server 2012 AlwaysOn – Part 7 – Details behind an AlwaysOn Availability Group
http://blogs.msdn.com/b/saponsqlserver/archive/2012/04/24/sql-server-2012-alwayson-part-7-details-behind-an-alwayson-availability-group.aspx
Thanks.
Tracy Cai
TechNet Community Support
Hi,
Thanks for the reply.
It's an AlwaysOn Availability Group.
In my test lab, I have changed the quorum configuration to a file share witness and that has allowed an automatic failover when I turn the primary replica server off (rather than power it off).
I'll take a look at the links you provided.
Regards,
Bob

SQL 2012 installation for Failover Cluster failed

While installation of SQL 2012 on FOC validation fails on "Database Engine configuration" page with following error:
The volume that contains SQL Server data directory g:\MSSQL11.MSSQLSERVER\MSSQL\DATA does not belong to the cluster group.
Want to know how does SQL installation wizard queries volumes configured with Failover Cluster. does it:
- Enumerate "Physical Disk" resources in FOC
- does it enumerate all Storage Class resources in FOC for getting the volume list
- or it depends on WMI (Win32_Volume) to get volumes ?
The wizard correctly discovers volume g:\ in its FOC group on "Cluster Resource Group" and "Cluster Disk Selection" page. but gives the error on Database configuration page.
Any help in this would be appreciated.
Thanks in advance
Rakesh
Rakesh Agrawal

Can you please check if there is any disk in the cluster which is not in online state? Please run below script following the steps.
1. Save a script as "Disk.vbs" and use
use CSCRIPT to run it.
2. Syntax: CSCRIPT <Disk.vbs> <Windows Cluster Name>
< Script>
Option Explicit
Public objArgs, objCluster
Public Function Connect()
' Opens a global cluster object. Using Windows Script Host syntax,
' the cluster name or "" must be passed as the first argument.
Set objArgs = WScript.Arguments
if objArgs.Count=0 then
wscript.Echo "Usage Cscript <script file name> <Windows Cluster Name> "
WScript.Quit
end IF
Set objCluster = CreateObject("MSCluster.Cluster")
objCluster.Open objArgs(0)
End Function
Public Function Disconnect()
' Dereferences global objects. Used with Connect.
Set objCluster = Nothing
Set objArgs = Nothing
End Function
Connect
Dim objEnum
For Each objEnum in objCluster.Resources
If objEnum.ClassInfo = 1 Then
WScript.Echo ObjEnum.Name
Dim objDisk
Dim objPartition
On Error Resume Next
   Set objDisk = objEnum.Disk
   If Err.Number <> 0 Then
    WScript.Echo "Unable to retrieve the disk: " & Err
   Else
    For Each objPartition in objDisk.Partitions
     WScript.Echo objPartition.DeviceName
    Next
   End If
End If
Next
Disconnect
</Script>

SQL 2012 database behaves differently with a unique index and ignore_dup_key = on when inserting data. It works on SQL 2008 db

If you have a table with a unique index and ignore_dup_key = on and you INSERT rows into that table with an ORDER BY clause (because you want to control which of the duplicate
key rows gets inserted), the wrong row gets inserted in SQL2012. It works correctly in SQL 2008.
We have recently migrated a database from SQL 2008 to SQL 2012. We do have few other dbs which are in compatability mode 100. The above operation works fine
in SQL 2008 dbs but not SQL 2012.
I've even tried applying the latest patch for SQL 2012 SP2 with CU2. Still the problem exists. I'm going to call MS support, but want to know if anyone has come across this problem ?

The MS documentation doesn't guarantee that the first row of the duplicates will always be inserted and the next duplicate row(s) get(s) ignored. Where did you find it in the MS documentation? I think you were just lucky that it was always inserting the
first row in SQL 2008 (and ignoring the rest of the duplicates) - I don't think this is guaranteed
Satish Kartan http://www.sqlfood.com/

Backup and Restore of DQS (Data Quality Service SQL 2012) Databases

We are currently using DPM 2010 running on Server 2008 R2 as our backup solution. We will soon be leveraging the Data Quality Services in SQL 2012 along with the Master Data Service.
In the SQL 2012 documentation from Microsoft it states, “The backup and restore operations of the DQS databases must be synchronized.”
Otherwise the restored Data Quality Server will not be functional. Currently I believe that DPM will run serialized backups of databases from one SQL server.
I was hoping someone could point me towards some documentation for backing up DQS with DPM.
Is anybody currently doing this? If so have you been successful restoring?

LogicalName cant be same for mdf and ldf. verify again with FILELISTONLY. Also you have put wrong logical name
MOVE N'OriginalDB' TO N'D:\sql data\TargetDB.mdf'
Please paste the output of
RESTORE FILELISTONLY FROM DISK = 'D:\backup.bak'

Required SQL 2012 features for RDS2012 HA

what features are required (basic) for SQL 2012 in RDS 2012 HA FARM?
Would just SQL Server Agent, SQL Server Database Engine, SQL Server Browser be enough for start?
Thanks.
--- When you hit a wrong note its the next note that makes it good or bad. --- Miles Davis

Hi,
Thank you for posting in Windows Server Forum.
As per my research it’s good to go for initial setup. But ensure that all RDCB Servers have the SQL Server Native Client Installed and configured so that they can communicate with the SQL Server.
More information.
RD Connection Broker High Availability in Windows Server 2012
http://blogs.msdn.com/b/rds/archive/2012/06/27/rd-connection-broker-high-availability-in-windows-server-2012.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

MS SQL 2012 Supported for v6.2?

Hi -
We are still on P6 6.2. The client with enterprise db (no web). We have other tools (non Primavera) that now require to upgrade to MSSQL 2012. Our IT department would like to apply this to our Primavera as well. Is this possible? The last tested configuration document that I can find is from 2012 and of course doesnt list SQL 2012 as a tested config. If there is an updated config file can someone send the link? Why Oracle doesnt make these simple inquires easier to find I do not know.
PS Long story why we have not upgraded but basically my company doesnt want to shell out the $ for both the maintenance and license upgrade with what we use it for (schedule only not costs, web, reporting). Believe me I would love to use the new features but managment and IT do not want to unless it is mandatory coming from our customers or Oracle states no more version 6.
Thanks for any feedback.

Hi Boomer,
There is no official document published about incompatibilities between AD FS 2.0 and SQL 2012. Though many people have issues about this combination, please see this thread below:
ADFS 2.0 + SQL 2012
http://social.msdn.microsoft.com/Forums/vstudio/en-US/6842274e-dca6-423d-9ddb-f5949fa83076/adfs-20-sql-2012?forum=Geneva
In the meantime, SQL Server 2012 is supported with AD FS 2.1 for sure, you can try to upgrade AD FS 2.0 to AD FS 2.1 if the issue persists.
In addition, I couldn’t find any resource about migrating AD FS configuration database from SQL to WID, only the other way around.
More information for you:
Federation Server Farm Using SQL Server
http://technet.microsoft.com/en-us/library/gg982487.aspx
FAQ on ADFS - Part 1
http://blogs.technet.com/b/askpfeplat/archive/2013/07/22/faq-on-adfs-part-1.aspx
Best Regards,
Amy

SQL 2012 support for ADFS 2.0

We recently upgraded to SQL 2012 Enterprise from SQL 2008. Since that happened we are now seeing errors when trying to create Relying Party Trusts in our ADFS 2.0 environment.
The error is as follows:
An error occurred during an attempt to access the AD FS configuration database. Error message: Exception of type 'Microsoft.IdentityServer.PolicyModel.Client.StorageOperationException' was thrown.
That brings 3 specific questions:
1. Does ADFS 2.0 support SQL 2012 as a backend?
2. Can we move the AD FS configuration database back to WID?
3. If the answer to question 2 is yes, how do I do it?
Thanks in advance for any help or suggestions.
Just a Network Administrator in a Developers World

Hi Boomer,
There is no official document published about incompatibilities between AD FS 2.0 and SQL 2012. Though many people have issues about this combination, please see this thread below:
ADFS 2.0 + SQL 2012
http://social.msdn.microsoft.com/Forums/vstudio/en-US/6842274e-dca6-423d-9ddb-f5949fa83076/adfs-20-sql-2012?forum=Geneva
In the meantime, SQL Server 2012 is supported with AD FS 2.1 for sure, you can try to upgrade AD FS 2.0 to AD FS 2.1 if the issue persists.
In addition, I couldn’t find any resource about migrating AD FS configuration database from SQL to WID, only the other way around.
More information for you:
Federation Server Farm Using SQL Server
http://technet.microsoft.com/en-us/library/gg982487.aspx
FAQ on ADFS - Part 1
http://blogs.technet.com/b/askpfeplat/archive/2013/07/22/faq-on-adfs-part-1.aspx
Best Regards,
Amy

Secure login to sql 2012 database for webusers

Similar Messages

Maybe you are looking for