<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="http://forums.iis.net/utility/FeedStylesheets/rss.xsl" media="screen"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:cs="http://blogs.iis.net/"><channel><title>IIS7 - Security</title><link>http://forums.iis.net/1043.aspx</link><description>Discussions around the security of IIS 7 including compentization, hidden directories, or authentication\authorization</description><dc:language>en</dc:language><generator>CommunityServer 2007 SP1 (Build: 20510.895)</generator><item><title>Re: Authentication for Membership Provider not working with IIS7</title><link>http://forums.iis.net/thread/1884841.aspx</link><pubDate>Fri, 14 Nov 2008 12:49:16 GMT</pubDate><guid isPermaLink="false">50bcf3b4-f6fe-4638-adff-0c150e922e99:1884841</guid><dc:creator>MoonCSD</dc:creator><slash:comments>0</slash:comments><comments>http://forums.iis.net/thread/1884841.aspx</comments><wfw:commentRss>http://forums.iis.net/commentrss.aspx?SectionID=1043&amp;PostID=1884841</wfw:commentRss><description>&lt;p&gt;Thanks to Rick Anderson, I was able to get this working:&lt;/p&gt;
&lt;p&gt;&lt;a href="http://weblogs.asp.net/nannettethacker/archive/2008/11/14/membership-provider-connections-to-remote-database.aspx"&gt;http://weblogs.asp.net/nannettethacker/archive/2008/11/14/membership-provider-connections-to-remote-database.aspx&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;</description></item><item><title>Authentication for Membership Provider not working with IIS7</title><link>http://forums.iis.net/thread/1884788.aspx</link><pubDate>Thu, 13 Nov 2008 21:56:14 GMT</pubDate><guid isPermaLink="false">50bcf3b4-f6fe-4638-adff-0c150e922e99:1884788</guid><dc:creator>MoonCSD</dc:creator><slash:comments>0</slash:comments><comments>http://forums.iis.net/thread/1884788.aspx</comments><wfw:commentRss>http://forums.iis.net/commentrss.aspx?SectionID=1043&amp;PostID=1884788</wfw:commentRss><description>&lt;p&gt;I have windows 2008 web server edition and IIS7, and sql server 2008 web server edition.&lt;/p&gt;
&lt;p&gt;On my windows 2000 server and database servers, I use asp.net membership with no problems. But I am having login problems using the membership provider with 2008 and IIS7. I have no problems viewing grids and doing database things that do not require log in. It only effects the membership provider logins and other functionality.&lt;/p&gt;
&lt;p&gt;In the app pool I did this:&lt;/p&gt;
&lt;p&gt;Set the identity on the app pool in IIS7 to &amp;quot;NetworkService&amp;quot; I tried both Integrated and Classic.&lt;/p&gt;
&lt;p&gt;I have forms authentication enabled and anonymous authentication with my SQLIISUser and the password inserted in the IIS7 for this website.&lt;/p&gt;
&lt;p&gt;I have tried a connection string with both windows authentication and sql server authentication:&lt;/p&gt;
&lt;p&gt;I was told to: update your connection string to &amp;quot;Integrated Security=SSPI;&amp;quot; not &amp;quot;Integrated Security=true;&amp;quot; - which I did.&lt;/p&gt;
&lt;p&gt;This gives login failed for anonymous user error: &lt;/p&gt;
&lt;p&gt;&amp;lt;add name=&amp;quot;XXConnectionString&amp;quot; connectionString=&amp;quot;Data Source=xx.xx.xx.xx;Initial Catalog=XX;Integrated Security=SSPI&amp;quot; providerName=&amp;quot;System.Data.SqlClient&amp;quot; /&amp;gt;&lt;/p&gt;
&lt;p&gt;This gives log in failed for SQLIISUser.&lt;/p&gt;
&lt;p&gt;&amp;lt;add name=&amp;quot;XXConnectionString&amp;quot; connectionString=&amp;quot;Data Source=xx.xx.xx.xx;Initial Catalog=XX;&lt;/p&gt;
&lt;p&gt;Persist Security Info=True;User ID=SQLIISUser;Password=XXXXXX&amp;quot;&lt;/p&gt;
&lt;p&gt;providerName=&amp;quot;System.Data.SqlClient&amp;quot; /&amp;gt;&lt;/p&gt;
&lt;p&gt;My membership settings also include:&lt;/p&gt;
&lt;p&gt;&amp;lt;appSettings&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;add key=&amp;quot;MembershipConnectionStringName&amp;quot; value=&amp;quot;XXConnectionString&amp;quot; /&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;/appSettings&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;system.web&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;membership defaultProvider=&amp;quot;AspNetSqlMembershipProvider&amp;quot; hashAlgorithmType=&amp;quot;SHA1&amp;quot; userIsOnlineTimeWindow=&amp;quot;15&amp;quot;&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;providers&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;clear /&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;add name=&amp;quot;AspNetSqlMembershipProvider&amp;quot; type=&amp;quot;System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a&amp;quot; connectionStringName=&amp;quot;XXConnectionString&amp;quot; applicationName=&amp;quot;/&amp;quot; passwordFormat=&amp;quot;Hashed&amp;quot; enablePasswordRetrieval=&amp;quot;false&amp;quot; enablePasswordReset=&amp;quot;true&amp;quot; requiresQuestionAndAnswer=&amp;quot;true&amp;quot; requiresUniqueEmail=&amp;quot;false&amp;quot; maxInvalidPasswordAttempts=&amp;quot;5&amp;quot; minRequiredPasswordLength=&amp;quot;7&amp;quot; minRequiredNonalphanumericCharacters=&amp;quot;1&amp;quot; passwordStrengthRegularExpression=&amp;quot;&amp;quot; passwordAttemptWindow=&amp;quot;10&amp;quot; /&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;/providers&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;/membership&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;roleManager defaultProvider=&amp;quot;AspNetSqlRoleProvider&amp;quot; cacheRolesInCookie=&amp;quot;true&amp;quot; cookieName=&amp;quot;.ASPXROLES&amp;quot; cookiePath=&amp;quot;/&amp;quot; cookieProtection=&amp;quot;All&amp;quot; cookieRequireSSL=&amp;quot;false&amp;quot; cookieSlidingExpiration=&amp;quot;true&amp;quot; cookieTimeout=&amp;quot;30&amp;quot; createPersistentCookie=&amp;quot;false&amp;quot; maxCachedResults=&amp;quot;25&amp;quot; enabled=&amp;quot;true&amp;quot;&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;providers&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;clear /&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;add name=&amp;quot;AspNetSqlRoleProvider&amp;quot; connectionStringName=&amp;quot;XXConnectionString&amp;quot; applicationName=&amp;quot;/&amp;quot; type=&amp;quot;System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a&amp;quot; /&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;/providers&amp;gt;&lt;/p&gt;
&lt;p&gt;&amp;lt;/roleManager&amp;gt;&lt;/p&gt;
&lt;p&gt;On the SQL Server 2008 database, I have the SQLIISUser setup as a user, and given dbdatareader and dbdatawriter and public permissions on the database. I also have a &amp;quot;NT AUTHORITY\NETWORK SERVICE&amp;quot; user with db_owner access.&lt;/p&gt;
&lt;p&gt;Again, all database connections work fine remotely, with windows authentication and with sql server authentication if only viewing data in a grid or doing inserts or updates, etc. But once I try to use the membership stuff, that&amp;#39;s where it fails.&lt;/p&gt;
&lt;p&gt;Please help.&lt;/p&gt;
&lt;p&gt;Partial stack trace for login failed for sql user:&lt;/p&gt;
&lt;p&gt;System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +4844759&lt;/p&gt;
&lt;p&gt;System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) +194&lt;/p&gt;
&lt;p&gt;System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +2392&lt;/p&gt;
&lt;p&gt;System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK) +35&lt;/p&gt;
&lt;p&gt;Thanks!&lt;/p&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;</description></item></channel></rss>