views:

629

answers:

2

I know this is almost duplicate of : http://stackoverflow.com/questions/1269706/the-error-login-failed-for-user-nt-authority-iusr-in-asp-net-and-sql-server-2 and http://stackoverflow.com/questions/97594/login-failed-for-user-username-system-data-sqlclient-sqlexception-with-linq-i but some things don't add up compared to other appliations on my server and I am not sure why.

Boxes being used:

Web Box
SQL Box
SQL Test Box

My Application:

I've got aASP.NET Web Application, which references a class library that uses LINQ-to-SQL. Connection string set up properly in the class library. As per http://stackoverflow.com/questions/97594/login-failed-for-user-username-system-data-sqlclient-sqlexception-with-linq-i I also added this connection string to the Web Application.

The connection string uses SQL credentials as so (in both web app and class library):

 <add name="Namespace.My.MySettings.ConnectionStringProduction"
        connectionString="Data Source=(SQL Test Box);Initial Catalog=(db name);Persist Security Info=True;User ID=ID;Password=Password"
        providerName="System.Data.SqlClient" />

This connection confirmed as working via adding it to server explorer. This is the connection string my .dbml file is using.

The problem:

I get the following error:

System.Data.SqlClient.SqlException: Login failed for user 'DOMAIN\MACHINENAME$'.

Now referencing this http://stackoverflow.com/questions/1269706/the-error-login-failed-for-user-nt-authority-iusr-in-asp-net-and-sql-server-2 it says that's really the local network service and using any other non-domain name will not work.

But I am confused because I've checked both SQL Box and SQL Test Box SQL Management Studio and both have NT AUTHORITY/NETWORK SERVICE under Security -> Logins, at the database level, that isn't listed under Security -> Users, but at the database level Security -> Users I have the user displayed in the connection string.

At NTFS level on web server, the permissions have NETWORK SERVICE has full control.

The reason why I am confused is because I have many other web applications on my Web Server, that reference databases on both SQL Box and SQL Test Box, and they all work. But I cannot find a difference between them and my current application, other than I am using a class library. Will that matter? Checking NTFS permissions, setup of Security Logins at the server and databases levels, connection string and method of connecting (SQL Server credentials), and IIS application pool and other folder options, are all the same.

Why do these applications work without adding the machinename$ to the permissions of either of my SQL boxes? But that is what the one link is telling me to do to fix this problem.

+3  A: 

NETWORK SERVICE and LocalSystem will authenticate themselves always as the correpsonding account locally (builtin\network service and builtin\system) but both will authenticate as the machine account remotely.

If you see a failure like Login failed for user 'DOMAIN\MACHINENAME$' it means that a process running as NETWORK SERVICE or as LocalSystem has accessed a remote resource, has authenticated itself as the machine account and was denied authorization.

Typical example would be an ASP application running in an app pool set to use NETWORK SERVICE credential and connecting to a remote SQL Server: the app pool will authenticate as the machine running the app pool, and is this machine account that needs to be granted access.

When access is denied to a machine account, then access must be granted to the machine account. If the server refuses to login 'DOMAIN\MACHINE$', then you must grant login rights to 'DOMAIN\MACHINE$' not to NETWORK SERVICE. Granting access to NETWORK SERVICE would allow a local process running as NETWORK SERVICE to connect, not a remote one, since the remote one will authenticate as, you guessed, DOMAIN\MACHINE$.

If you expect the asp application to connect to the remote SQL Server as a SQL login and you get exceptions about DOMAIN\MACHINE$ it means you use Integrated Security in the connection string. If this is unexpected, it means you screwed up the connection strings you use.

Remus Rusanu
Right that what was I gathered, thank you for the explanation. However, the question still remains, all of my apps are hosted on my Web Server but access a database on SQL or SQL Test boxes, that would be remote access yes? Yet they are working...but neither of my SQL boxes are granting DOMAIN\MACHINENAME$ access.
sah302
Oh Also, I do expect to connect to SQL server as a SQL Login but I've posted my connection strings, I am not using Integrated Security=True option, what else could it be??
sah302
There are three possible explanations: 1) they use SQL auth instead of integrated auth (which seems to be the most plausible one, since you example has an userid and password in conn string) 2) they use integrated auth and run in an app poll that uses a different credential or 3) they use integrated auth but the ASP app impersonates the caller, thus triggering constrained delegation: http://technet.microsoft.com/en-us/library/cc739587%28WS.10%29.aspx.
Remus Rusanu
Most likely is that your app is not using the connection string you expect it to use. Do you pass in a connection string to your datacontext constructor?
Remus Rusanu
Not sure if I am or not to be honest, I just use SQL Metal to generate the LINQ-to-SQL classes. But when opening my .dbml file, the connection property is set to the one I want to use. Both the application I am getting this error with, and my other applications that are working, are in the same application pool, and both are using SQL auth.
sah302
You're going to have to track down how the data context generated from the .dbml is instantiated in your code.
Remus Rusanu
See http://msdn.microsoft.com/en-us/library/Bb399375%28v=VS.90%29.aspx
Remus Rusanu
I am not passing it anything, I just instantiate it with new MyDataContext()
sah302
The app pool its using a predefined identity of Network Service, not sure if that helps.
sah302
Well I feel stupid....but it seems like my Web App didn't get the most updated version of my class library dll, So I guess what happened was I built the class library to debug and not release and my web app was referencing release folder dll. This is the only explanation I can come up with because I just deleted the class library reference, re-built class library, re-added reference, and then re-published while choosing to delete all files on there, and it works...
sah302
Your web app project should reference the class library *project*, not the dll. Add the class library project to the web app solution, then remove the reference to the dll and add reference to the project. This way, when deploying or testing, the retail web app will reference retail class dll and debug will reference debug, automatically.
Remus Rusanu
Ah, okay thanks for that tip!
sah302
A: 

I have getting same kind of issue. I have an application on a sever with SQL. I shifted it from one server to other. Configured all the connection strings correctly. Now, when I am trying to access login page..it is showing below error

Error authenticating user. Cannot open database "DBAPP" requested by the login. The login failed.Login failed for user Domain\Server$'.

Strange thing is I am trying to connect with SQL authentication and not sure why this domian\server coming into picture. As you guys suggested this kind of error occur whn we try to connect a remote resource whn app is running on NETWORK SERVICE which is not in my case. My app is trying to connect SQL with SQL auth..I have checked and connection strings are working fine.

I tried to search a lot on internet but did not find something helpful.

Please please advice!!

manik
Did you re-add the security logins to the new server and also to the database level users? Also if you use references to other projects in your projects, make sure you re-compile correctly like I did hehe.My error never said anything about not being able to open the database requested by the login, so it leads me to believe it may be a database issue. Post some of your code.
sah302