I have an ASP.NET application which runs under the Classic .NET AppPool in IIS.
I have a report to render from my website.
The problem is SQL Server keeps telling me that it failed to create a connection to the datasource, because login failed for user IUSR.
After adding that user directly to the databse I could get the report to work, but I'm concerned about security.
By doing that, am I opening my specified databases to all websites hosted on IIS? Or is that account identity-specific?
A better way to so it would be to change the application pool identity to a specific user and add that user to the database, otherwise you are giving the standard IIS anonymous user access to the database.
You're using Windows Authentication. You could use Sql Server authentication so you're independent of the current user of your client application. You should have a sql server user created with just the necessary credentials for your application and use it like this on the connection string.
Data Source=SERVER;Initial Catalog=DATABASE;Persist Security Info=True;User ID=USER;Password=PASSWORD