Home All Groups Group Topic Archive Search About

IIS permissions while accessing a database from a CGI application

Author
5 Jul 2009 9:24 AM
ElCarso
Hi,
I have a VC++ CGI application that shall work with a database (for now a MS
Access database) through the ODBC driver.
The code (see below) works fine when embedded in ordinary applications, and
works also fine when the CGI applciation is activated manually from the
server keyboard.
However the code cannot connect to the data source when activated through
HTTP/CGI call (error on SQLConnect() call).

It seems to be a security issue, but I'm not able to find out what and where
to change in order to make the CGI app able to connect to the database.
In the IIS Manager Panel?
In the ODBC Data Source Administrator?
In the code?
Somewhere else?

Please advice.
Thank you in advance.

Code used:
---------------------------------------
SQLAllocHandle( SQL_HANDLE_ENV, SQL_NULL_HANDLE, &HdlEnv );
SQLSetEnvAttr( HdlEnv, SQL_ATTR_ODBC_VERSION, (SQLPOINTER)SQL_OV_ODBC3, 0 );
SQLAllocHandle( SQL_HANDLE_DBC, HdlEnv, &HdlConn );
SQLConnect( HdlConn, (SQLWCHAR*)Dsn, SQL_NTS, (SQLWCHAR*)UserId, SQL_NTS,
(SQLWCHAR*)Password, SQL_NTS );
---------------------------------------

Author
5 Jul 2009 5:46 PM
Roberto Franceschetti
When you're executing the CGI thru IIS, remember that the code is being
executed under different credential than when you run code interactively.

In this case, you'll likely need to examine more closely the "Dsn"
you're passing in the the SQLConnect. That connection string must both
(1) be a valid Dsn when executed on the IIS server, and (2) be a valid
Dsn when called by the credential used by IIS to run your CGI.

It should thus be a "System" Dsn and not a "User" Dsn, and must be
defined on your IIS server's ODBC Data Source Administrator. You can
also try to explicitly spell out the whole connection string there
rather than using a Dsn.


--
Roberto Franceschetti
LogSat Software
http://www.logsat.com


ElCarso wrote:
Show quoteHide quote
> Hi,
> I have a VC++ CGI application that shall work with a database (for now a MS
> Access database) through the ODBC driver.
> The code (see below) works fine when embedded in ordinary applications, and
> works also fine when the CGI applciation is activated manually from the
> server keyboard.
> However the code cannot connect to the data source when activated through
> HTTP/CGI call (error on SQLConnect() call).
>
> It seems to be a security issue, but I'm not able to find out what and where
> to change in order to make the CGI app able to connect to the database.
> In the IIS Manager Panel?
> In the ODBC Data Source Administrator?
> In the code?
> Somewhere else?
>
> Please advice.
> Thank you in advance.
>
> Code used:
> ---------------------------------------
> SQLAllocHandle( SQL_HANDLE_ENV, SQL_NULL_HANDLE, &HdlEnv );
> SQLSetEnvAttr( HdlEnv, SQL_ATTR_ODBC_VERSION, (SQLPOINTER)SQL_OV_ODBC3, 0 );
> SQLAllocHandle( SQL_HANDLE_DBC, HdlEnv, &HdlConn );
> SQLConnect( HdlConn, (SQLWCHAR*)Dsn, SQL_NTS, (SQLWCHAR*)UserId, SQL_NTS,
> (SQLWCHAR*)Password, SQL_NTS );
> ---------------------------------------
>
Author
5 Jul 2009 6:22 PM
ElCarso
Thanks Roberto,
I changed the Dsn type from "User" to "System" and now the connection to the
data source works fine.




Show quoteHide quote
"Roberto Franceschetti" wrote:

> When you're executing the CGI thru IIS, remember that the code is being
> executed under different credential than when you run code interactively.
>
> In this case, you'll likely need to examine more closely the "Dsn"
> you're passing in the the SQLConnect. That connection string must both
> (1) be a valid Dsn when executed on the IIS server, and (2) be a valid
> Dsn when called by the credential used by IIS to run your CGI.
>
> It should thus be a "System" Dsn and not a "User" Dsn, and must be
> defined on your IIS server's ODBC Data Source Administrator. You can
> also try to explicitly spell out the whole connection string there
> rather than using a Dsn.
>
>
> --
> Roberto Franceschetti
> LogSat Software
> http://www.logsat.com
>
>
> ElCarso wrote:
> > Hi,
> > I have a VC++ CGI application that shall work with a database (for now a MS
> > Access database) through the ODBC driver.
> > The code (see below) works fine when embedded in ordinary applications, and
> > works also fine when the CGI applciation is activated manually from the
> > server keyboard.
> > However the code cannot connect to the data source when activated through
> > HTTP/CGI call (error on SQLConnect() call).
> >
> > It seems to be a security issue, but I'm not able to find out what and where
> > to change in order to make the CGI app able to connect to the database.
> > In the IIS Manager Panel?
> > In the ODBC Data Source Administrator?
> > In the code?
> > Somewhere else?
> >
> > Please advice.
> > Thank you in advance.
> >
> > Code used:
> > ---------------------------------------
> > SQLAllocHandle( SQL_HANDLE_ENV, SQL_NULL_HANDLE, &HdlEnv );
> > SQLSetEnvAttr( HdlEnv, SQL_ATTR_ODBC_VERSION, (SQLPOINTER)SQL_OV_ODBC3, 0 );
> > SQLAllocHandle( SQL_HANDLE_DBC, HdlEnv, &HdlConn );
> > SQLConnect( HdlConn, (SQLWCHAR*)Dsn, SQL_NTS, (SQLWCHAR*)UserId, SQL_NTS,
> > (SQLWCHAR*)Password, SQL_NTS );
> > ---------------------------------------
> >
>