One of our coders is trying to get Windows Authentication to work on a new web app that he's developing (.Net 4.0, MVC, via IIS 7.0/7.5).
The application connects to a SQL Server database back-end via a single SQL logon account:
It is mapped to a User account of the same name within a single database, and given the following roles:
Windows Domain users are then somehow authenticated and allowed access to the DB.
Does anyone know if this presents any significant security risks if the web server (but not SQL server) is publicly accessible on the net? It sounds to me almost as bad as giving those privileges to NT AUTHORITY\ANONYMOUS LOGON, but I must admit I'm not exactly clued-up in this area.