Value of Integrated Security in application and web site

Question

3.50/5 (2 votes)

See more:

SQL-Server-2008

Value of Integrated Security in application and web site
Hi
What value Is better for “Integrated Security”? True, false or SSPI (in application and web site)
Thanks very much

Posted 6-Feb-12 5:00am

armm1388

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sander Rossel · Answer 1 · 2012-02-06T08:31:00

Having Integrated Security set to True or SSPI means that a user will be able to login to a database using their Windows login information.
This means that if someone would login with domain\username MYCOMPANY\username and their password on their computer the database will recognize this user as logged in at a domain controller[^]. This is of course easy for the user as SQL Server recognizes them and the user doesn't have to log in again. Of course this is absolutely safe since a hacker would only be able to login if they were actually on the same domain as the user.
A downside to this is that if the user is not currently logged in to the domain they have no way of accessing the database by Integrated Security. In this case a username and password will be necessary (and Integrated Security is false). Luckily the two don't rule each other out.
So when you can you should try to log in using Integrated Security. Of course users should have permission for this. Read here for more information[^]. So as you can see it's not a question of "what's better", but "what is more suited for the current situation". You will see when you login to SQL Server you get a login form asking you if you want to login using Windows Authentication (Integrated Security) or SQL Server Authentication (username/password combination). Now you make the decision what you need :)