We have installed DNN 4.0.4 successfully. The application is on a Win2k3 machine connecting to a SQL 2000 database. Our dba has concerns over the security of the application, namely the fact that IIS initially contacts the database as [domain name]\[machine name]$. (e.g. RDomain\WinSvr123$) To get this to even connect, I've had to give the machine account db_owner privileges. Once it looks up a user, it then seems to use the domain user credentials. We have ADgroups that I can map to SQL Roles to take care of the users access but cannot figure out what to do to alleviate the machine account accessing the SQL Server. Does anyone know how to do this?

Additionally, what can we do to lock down the user to only the objects they need in the database. We'd prefer not to let them have access to the db_owner role. These issues don't really seem to be addressed anywhere in the documentation.

Thanks in advance!

One of the many hangups they have with this at this point is security. They are pretty insistent on using "Windows Authentication" and are frightened when it initially connects with the machine account to the database. I cannot think of a way to use integrated security without this happening.

Am I correct on my assumption of the process flow?

1. Domain user requests default.aspx
2. IIS queries SQL w/machine account (DOMAIN/MACHINE$) to determine if user (DOMAIN/UserName) has permissions to DNN
3. Domain user is authenticated and queries DNN for content
4. ISS Serves up correct DNN web page

You have mentioned the upgradeConnectionString. I see little documentation on the use of that. I am assuming that it is just another connectionstring that DNN uses when installing or updating the DNN installation. Am I also correct in assuming that you intend for that to use a SQL Login as well?

Thanks for the information, it will be very helpful when I go to discuss this with the dba and system admins.

 - Todd

P.S. Can there be a documentation section specifically documenting how to securely install DNN?

It's been a few months since we looked into this. We're just getting back to this as we're going to move ahead and put this into production. I have a few follow up questions.

1. DNN still makes the first call from IIS to SQL Server as the machine account. (RDomain\WinSvr123$) I can't seem to eliminate that. Is there a way to troubleshoot the sequence of events? If so, how?

2. When is 4.5.0 coming out. Would this help any of our authentication issues?

I'm also looking into modifying the connection string as Sean mentioned above.