ASP ms-access security issue 1

[Periko]

Hello folks,

I have this problem : I have an asp-page in frontpage, published on my windows2003 server. This page is using odbc to an accessdatabase local on this machine, no problem. When I change the odbc to a networkdrive where the same database is running, it doesn't work. I tried on this second server to give rights to the internet-account-user from the original server, even that doesn't work.

Anybody an idea ?

Greets...
Pedro...

 

[theniteowl]

The ODBC connection should be configured on the machine the database now resides on and that machine will handle access privledges to it locally.

As far as I know the ODBC is handled at the system level not under the IIS account so when you are pointing to the database on a different server it is the permissions of the System not the IUSR account that come into play.

As an example, on Server1 you have the ODBC to the database on the same server and you have the IIS server, the ODBC connection is made available to the IIS server directly not via the IUSR account so you never have to set permissions for IUSR, your ASP code can just establish a connection as long as you know any database level ID/Password that might be required.

When you move the database to Server2 but try doing it through the ODBC on Server1, then Server2 is treating the database as a file in a file share and it wants to know who is accessing it and control that access so you would have to setup permissions for Server1 (again nothing to do with the IUSR account as that only relates to the web server).
You probably could get it to work with enough playing with permissions but you open yourself up to a lot more places for failure.

By far the easiest thing is to setup the ODBC on the machine hosting the database then you can access it from anywhere else.

Don't even consider trying to use a DSNLess connection to the remote file share you will find yourself in an even more difficult position trying to get it to connect than you are now as then you have to also deal with how the authentication process is handled between the two different servers on top of just setting file/folder permissions and the best solution is one that opens up potential security issues.




Stamp out, eliminate and abolish redundancy!

 

[Periko]

Hello NiteOwl,

Thx for the information. I'm just wandering, just going further on the testcase :

Machine 1 : xxx.mdb : shared as \\machine1\share1

Machine 2 : IIS and website online

Actual case : Machine 2 has odbc-connection to machine1 where on the driveletter q:\ (\\machine1\share1) is my xxx.mdb. This is not working, therefore, i made a copy of my xxx.mdb on the machine 2 and my odbc connects to this C:\yyy\xxx.mdb

So what you suggest is that i set up the odbc on machine 1 and use that odbc-settings from my machine 2 ? I just don't know how to establish that.

Thx for the effort yet.

Pedro...

 

[theniteowl]

Exactly.
Setting up the ODBC on the other machine is no different than having set it up on the IIS server, just look at the current settings there.

In your ASP code you already specify the server and ODBC connection name so you just have to change the server name to point to the other server.



Paranoid? ME?? Who wants to know????

 

[Periko]

I suppose that my problem is that i mentioned in my asp-code in ms frontpage in the web-settings (database connection properties) that my database is "system data source on web server".

and you are going to tell me it has to be ????? network connection to data server ? no ?

Thx...
Pedro...

 

[theniteowl]

Got me there. I do not have FrontPage to look at to see how it is doing things. I do my ASP directly without using FrontPage.
A typical ASP ODBC connection to a database on another server goes like this:

<%
  ' Open connection to database
  sConnect = "Provider=SQLOLEDB;Data Source=MYSERVER" 
  sConnect = sConnect & ";Initial Catalog=DATABASENAME"
  sConnect = sConnect & "; User Id=USERID"
  sConnect = sConnect & ";Password=PASSWORD"
  Set conn = Server.CreateObject("ADODB.Connection")
  conn.Open sConnect
%>

Paranoid? ME?? Who wants to know????