About SQL Server security

I have an ASP.NET application which runs under the Classic .NET AppPool in IIS.

I have a report to render from my website.

The p开发者_如何学Croblem is SQL Server keeps telling me that it failed to create a connection to the datasource, because login failed for user IUSR.

After adding that user directly to the databse I could get the report to work, but I'm concerned about security.

By doing that, am I opening my specified databases to all websites hosted on IIS? Or is that account identity-specific?

---

A better way to so it would be to change the application pool identity to a specific user and add that user to the database, otherwise you are giving the standard IIS anonymous user access to the database.

---

You're using Windows Authentication. You could use Sql Server authentication so you're independent of the current user of your client application. You should have a sql server user created with just the necessary credentials for your application and use it like this on the connection string.

Data Source=SERVER;Initial Catalog=DATABASE;Persist Security Info=True;User ID=USER;Password=PASSWORD