Sql-server – SQL application connection using one Windows user

best practicessql serverusers

We are currently looking to update an old application security structure and would like to go for an approach where the application connects to SQL via one Windows login with the required Read/Write access.

We don't want to give access to the DB to all users otherwise they might connect via another application (SSMS or Excel) and run commands on SQL. I know we can use Application Roles to achieve this however, the application connects to many databases and we wouldn't like to enable the Guest user.

Do you have any other suggested approaches or in that case we would need to use an SQL encrypted login instead of a Windows login?

Best Answer

If you're using IIS manager for application pools to configure identity for your application and your servers are Windows 2012 or later, you can look into using either a Managed Service Account or a Group Managed Service Account to run your app. Either approach will eliminate the need to deal with passwords yet maintain a secure application login.

The comment provided by sepupic above is spot on though in that you should manage user permissions directly against the database separately, and how that's done will heavily depend upon what level of permissions are needed.

Hopefully this provides an approach to your situation though.