Question

I have a website written in ASP.NET and am trying to deploy it on Windows 7.

I have successfully deployed the website and it works fine, until I try to access a page which connects to a database. The following error is displayed:

Server Error in ‘/’ Application.

---

Cannot open database “Bank” requested by the login. The login failed.
Login failed for user ‘IIS APPPOOL\ASP.NET v4.0’.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Cannot open database “Bank” requested by the login. The login failed.
Login failed for user ‘IIS APPPOOL\ASP.NET v4.0’.

Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[SqlException (0x80131904): Cannot open database “Bank” requested by the login. The login failed.
Login failed for user ‘IIS APPPOOL\ASP.NET v4.0’.]
System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +6351920
System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning() +412
System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +1363
System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK) +53
System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(ServerInfo serverInfo, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, TimeoutTimer timeout) +6366878
System.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, TimeoutTimer timeout, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance) +6366793
System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance) +352
System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection) +831
System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options) +49
System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject) +6368598
System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject) +78
System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) +2194
System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) +89
System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) +6372110
System.Data.SqlClient.SqlConnection.Open() +300
SQL_Injection_Vulnerable.LogIn.ImageButton_LogIn_Click(Object sender, ImageClickEventArgs e) in C:\Users\Matthew\Desktop\Thesis\Code\Vulnerability 6 – Information Leakage\Version 16 – Changed Connection Strings\Info_Leakage_Vulnerable\Info_Leakage_Vulnerable\LogIn.aspx.cs:51
System.Web.UI.WebControls.ImageButton.OnClick(ImageClickEventArgs e) +187
System.Web.UI.WebControls.ImageButton.RaisePostBackEvent(String eventArgument) +165
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3707

---

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.272

I used the following procedure to deploy the website in IIS:

1. Go to Desktop/Code/Info_Leakage_Vulnerable
2. Copy Info_Leakage_Vulnerable
3. Go to C:/inetpub/wwwroot
4. Paste the folder there
5. Open the Start menu
6. Type inetmgr
7. Open HOME-PC/Sites
8. Right-click on Sites and click on Add Web Site

Site Name = Info_Leakage_Vulnerable

Application Pool = ASP.NET Version 4

Physical Path = Path to folder in C:/inetpub/wwwroot/Info_Leakage_Vulnerable

Port = 1000

1. Right-click on Info_Leakage_Vulnerable in web sites menu and click on Switch to Content View
2. Click on HomePage.aspx and click Browse

The website works perfectly in Visual Studio. The problems I am experiencing crop up when running the website from IIS. How can I solve the problem with Database Connectivity please? Thanks

Answer 1

Execute below query in master database. you have to create the login for IIS APPPOOL\ASP.NET v4.0

CREATE LOGIN [IIS APPPOOL\ASP.NET v4.0] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]
GO

CREATE LOGIN [NT AUTHORITY\NETWORK SERVICE] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]
GO

If still you are facing issue after execution of query then follow these steps

1. In IIS Choose the ASP.NET v4.0 application pool from the Applications Pools
2. Right Click on ASP.NET v4.0 –> Choose Advanced Settings...
3. Under the Process Model section change the Identity value to LocalSystem.
4. iisreset

Hope this helps.