SQL Server Express Security Nightmare

Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

All Forums

SQL Server 2005 Forums

Express Edition and Compact Edition (2005)

SQL Server Express Security Nightmare

Author

Topic

drdexter33
Starting Member

12 Posts

Posted - 2007-04-16 : 09:21:32

I've built this prototype web app in asp.net 2.0

it uses a sql server express database.

It uses the database to populate a grid control.

It works when I run it from my pc when I

1). run it in debug mode.

2) right click a page in the vs2005 IDE and browse

3). browse a page from the IIS snap in

it doesn't work from other peoples PC on our intranet say if someone types:

http://xxx.xxx.xx.xx/mywebapp/default.aspx because I get this result:

Server Error in '/FocusII_Website' Application.
--------------------------------------------------------------------------------

User does not have permission to perform this action.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: User does not have permission to perform this action.

Source Error:

Line 82:
Line 83: SqlDataAdapter da = new SqlDataAdapter(sql, ConfigurationManager.ConnectionStrings["sqlExpress"].ToString());
Line 84: da.Fill(ds);
Line 85: RadGrid1.DataSource = ds;
Line 86: RadGrid1.DataBind();

Source File: c:\Inetpub\wwwroot\FocusII_Website\UnitGridPrototype.aspx.cs Line: 84

Stack Trace:

[SqlException (0x80131904): User does not have permission to perform this action.]
System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) +437
System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) +82
System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) +105
System.Data.SqlClient.SqlConnection.Open() +111
System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +121
System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +137
System.Data.Common.DbDataAdapter.Fill(DataSet dataSet) +86
UnitGridPrototype.Page_Load(Object sender, EventArgs e) in c:\Inetpub\wwwroot\FocusII_Website\UnitGridPrototype.aspx.cs:84
System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +15
System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +34
System.Web.UI.Control.OnLoad(EventArgs e) +99
System.Web.UI.Control.LoadRecursive() +47
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1061

--------------------------------------------------------------------------------

Version Information: Microsoft .NET Framework Version:2.0.50727.42; ASP.NET Version:2.0.50727.42

Impersonation is set to TRUE

Anonymous access is checked.

Integrated Windows Authentication is checked..

aspnet, iusr accounts have full privs on the data directory,,,,,

I'm at a loss..

SwePeso
Patron Saint of Lost Yaks

30421 Posts

Posted - 2007-04-16 : 11:33:47

Post your connection string here.
Are you using "Integrated security"?

Peter Larsson
Helsingborg, Sweden

Subscribe to SQLTeam.com

SQLTeam.com Articles via RSS

SQLTeam.com Weblog via RSS

- Advertisement -

Resources