Cloud Service user

[Uffe]

Hi all,


I'm helping a client set up a cloud service for their intranet, specifically to enable reusable assets. The environment is all-Windows, with SQL Server for the DBMS. IIS extensions will not be used.

We're using domain groups to control database access, and out of the box the Cloud Service sets itself up to be run by the local System user, which doesn't have access to any databases.

What is the best practice in this situation?

Should we create a local user on the server, give it access to the database, and make the Cloud Service run as that user?

Or should we give the local System user database access? This sounds iffy to me.

Any suggestions appreciated,


/Uffe

[smendonc]

I don't know if its a best practice, however I've used the first option (or variant) proposed in the past i.e. create a local service account that can access the database - assuming the database and cloud service are running on the same machine.  If the database and cloud service are on different machines, you might have to create a domain account as the service account and add it to the security group just like a regular user.

It's probably not a good idea as noted to grant the local system user access to the database.

qwerty, the cloud service exposes the repository via http calls from a web server included with the service.  The web server in turn communicates with a Windows service that connects to the database and runs the actual queries whose results get repackaged back into content for the EA client.

Stan.

[PeterHeintz]

Hello Uffe,
we are doing pretty the same as mentioned by smendonc.

[Uffe]

OK, thanks guys.

The cloud service will indeed run on the same host as the database server, so a local account will fit the bill nicely.

Thanks again,


/Uffe