[QUESTION] Client can't access site, but web server can

[ccowin-odhsoha]

Question
I'm getting what I expect is a common error but I'm unsure of how to resolve it. When setting up a completely blank Django project I'm able to access the site via the SQLite and access it from a client machine. When I try and switch to the MSSQL settings it works fine from the web server but when trying to access it from the client

Here is the error I pull from Event Viewer:

pyodbc.InterfaceError: ('28000', "[28000] [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Login failed for user 'DHS\\WDDHSGISL02$'. (18456) (SQLDriverConnect); [28000] [Microsoft][ODBC Driver 17 for SQL Server]Invalid connection string attribute (0); [28000] [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Login failed for user 'DHS\\WDDHSGISL02$'. (18456); [28000] [Microsoft][ODBC Driver 17 for SQL Server]Invalid connection string attribute (0)")

The user is the webserver machine name, which is really confusing me. I would have expected that to be the user I was logged into from the client machine. Do I just need to make sure the webserver machine has privileges and not individual users?

[dlevy-msft-sql]

Hi @ccowin-odhsoha - Thanks for using our driver! It looks like you are trying to do pass-through authentication. For that to work, your AD Admin has to trust that machine for delegation. That comes with some security implications that make them unlikely to do that unless it's a hard requirement.

You can solve this by giving the webserver machine account access to SQL Server and adding it to the same role that your users are in. What I would recommend is to create a managed service account for just that app pool and add that to the role that the users are in. The managed service account comes with a number of benefits over the machine account, like security and portability. The biggest, in my mind, is that by using the managed service account for just the app pool you avoid every process on the machine having access to your database. This gets more important as you put more apps on your web server.

Hope that helps,

Dave