Question

SQL Server Windows authentication uses application’s process identity or thread identity to connect. So for an ASP.NET application, which identity will be used to connect

1. Current User Identity
2. Application Pool Identity
3. Process Identity

or another identity?!

Answer 1

It really depends of your IIS Website configuration.

By default it will use the application pool’s identity if you disabled the anonymous access. But if you configure your application with Impersonation=true, then it will use your user’s identity as described:

The configuration illustrated in the example enables the entire application to run using the contoso\Jane identity, regardless of the identity of the request. This type of impersonation can be delegated to another computer. That is, if you specify the user name and password for the impersonated user, you can connect to another computer on the network and request resources, such as files or access to SQL Server, using integrated security. If you enable impersonation and do not specify a domain account as the identity, you will not be able to connect to another computer on the network unless your IIS application is configured to use Basic authentication.

See all details in this MSDN article.