Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web app to authenticate against the SQL server. However, now the Intranet application being on a different domain must use SQL authentication and thus we have to set SQL server to SQL Server and Windows Authentication mixed mode instead of recommended Windows Authentication mode

What are the security concerns of this setting?

  • There are no one or two way trusts between the domains? If so, why not? – Jeroen Jan 3 '15 at 5:51
  • No, we did not set trust on purpose, so if the application account on the Internet facing app gets compromised, it cannot access the internal app. – Goli E Jan 5 '15 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.