I need help with configuring IIS, SQL Server, and the web.config file to have a .Net ASP (C#) application connect to a SQL Server 2005 database. This is an internet site, with the web application and the database on the same machine. Would like to avoid using a password/user name in the web.config file and DB connection string. I have been testing with Trusted_Connection, <identity impersonate="true" />, Integrated Security=SSPI, and other settings, but I don't understand the whole process. Errors occur and no results. Can you provide help with what to do?

Can you tell us what the errors are?

The web site will typically run under the limited access 'NETWORK SERVICE' account. It's very likely that this account won't have the right access to SQL Server. I have never connected to MSSQL from a web app with anything other than a SQL Server login.

What is your motivation for not wanting a username/password in the web.config file? If the concern is someone seeing the security information, there are ways to encrypt sections of config files. I haven't done this myself so I can't offer any specifics.

-Peter
peterlanoie.blog