Home » Community » View question
Question
database user best practice?
In the Scensum startup solution the database connection string has a set sql user. What is the recommended approach?
1. Keep the user (change password of course)
2. Run as windows authentication
3. other...?
What access, server roles does the user have to have in the database?
Answers
It depends on the server setup. Preferred is of course with windows authentication thus using the SSPI connection setting and using the application pool identity or impersonation setting in web.config. This way password is only stored in the account database of the machine. In order for this to work across many machines, you simply create the same account and password on every local machine (if no domain is used) and you set the permissions and privileges on this account on each machine. The drawback is that when you change password, you have to change it on many boxes. But on the other hand you do not have the password visible in config files. So generally it´s considered to be a higher security this way.
/Fredrik
You need to login to answer this question