The ApplicationPoolIdentity is a virtual account in Windows that is dynamically generated when the application pools is created and takes on the name of the application pool in this manner: IIS Apppool<name of application pool> . For instance, the application pool MyApp would have a virtual account created under the name IIS ApppoolMyApp when instantiated. Read here for more information about the ApplicationPoolIdentity and here for Windows virtual accounts.
Since Windows is creating a dynamic virtual account for the application pool, there is not set identity or Windows user account to assign to a SQL login for data access. This makes it difficult to assign the application pool to the SQL login. This blog post shows how to add a SQL login for local and a remote SQL Server to allow the applications hosted in an application pool to access the SQL Server.
Side note: The IIS authentication method, anonymous or Windows, will not make a difference on the access to the SQL Server. The security principle used to connect to the SQL Server is the one setup in the application pool configuration Identity.
On a local SQL Server, the login request will appear as the IIS application pool identity. For instance, if the application pool is called AuthTest, the login will appear as IIS ApppoolAuthTest.
On a remote SQL Server, the login request will appears as the machine name since the built in account is attempting to access SQL. For example, the server IIS01 will appear as domainIIS01$ in a SQL trace.
To validate the connection to SQL, run a SQL trace with the Audit Login Failed and User Error Message events enabled and this will show the account attempting to access SQL. Or, check the SQL log files.
To Add the Account to SQL:
The steps are the same to add the login to SQL for a local or remote SQL Server. However, the identities are different depending on the server if SQL Server is installed locally or on a remote server.
For a local SQL Server:
- Open SQL Server Management Studio (SSMS) and connect to the SQL Server.
- Open the Security folder at the server level and not the security folder for the database.
- Right click on the logins and select New Login.
- For the login, type IIS APPPOOLAppPoolName and DO NOT CLICK SEARCH and select OK (If a search is executed, it will resolve to an account with ServerNameAppPool Name and SQL will be unable to resolve the account’s SID since it is virtual)
- Select the defaults for the account and select OK to close dialog
The same can be accomplished using T-SQL:
CREATE LOGIN [IIS APPPOOLAuthTest] FROM WINDOWS;
CREATE USER AuthTest FOR LOGIN [IIS APPPOOLAuthTest];
For a remote SQL Server:
- Open SQL Server Management Studio (SSMS) and connect to the SQL Server.
- Open the Security folder at the server level and not the security folder for the database.
- Right click on the logins and select New Login.
- For the login, type DomainServerName$ and DO NOT CLICK SEARCH
- Select OK
- Select the defaults for the account and select OK to close dialog
Using T-SQL:
CREATE LOGIN [computername$] FROM WINDOWS;
web.config SET integrated security=SSPI;