Login failed for user

I have been following the WebMatrix guided tour for the End to End application for VB.net. Everything went very smooth on my local box, but when I transferred the code to our dev server and made it into an Application through IIS, it fails after I enter in a bogus username and password. Below is my debug info. CORP is our domain and USHOUVMET01D is the machine name.

Can someone point me in the right direction on how to fix this?

------------------------

Login failed for user 'CORP\USHOUVMET01D$'.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Login failed for user 'CORP\USHOUVMET01D$'.

Source Error:

Line 41: dataAdapter.SelectCommand = dbCommand
Line 42: Dim dataSet As System.Data.DataSet = New System.Data.DataSet
Line 43: dataAdapter.Fill(dataSet)
Line 44:
Line 45: Return dataSet

Source File: D:\InetPub\Wwwroot\jason\EndToEndVB\login.aspx Line: 43

Stack Trace:

[SqlException: Login failed for user 'CORP\USHOUVMET01D$'.]
System.Data.SqlClient.ConnectionPool.GetConnection(Boolean& isInTransaction) +472
System.Data.SqlClient.SqlConnectionPoolManager.GetPooledConnection(SqlConnectionString options, Boolean& isInTransaction) +372
System.Data.SqlClient.SqlConnection.Open() +384
System.Data.Common.DbDataAdapter.QuietOpen(IDbConnection connection, ConnectionState& originalState) +44
System.Data.Common.DbDataAdapter.FillFromCommand(Object data, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +304
System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +77
System.Data.Common.DbDataAdapter.Fill(DataSet dataSet) +38
ASP.Login_aspx.GetUser(String userName, String userPassword) in D:\InetPub\Wwwroot\jason\EndToEndVB\login.aspx:43
ASP.Login_aspx.LoginBtn_Click(Object Sender, EventArgs E) in D:\InetPub\Wwwroot\jason\EndToEndVB\login.aspx:8
System.Web.UI.WebControls.Button.OnClick(EventArgs e) +108
System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +57
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +18
System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +33
System.Web.UI.Page.ProcessRequestMain() +1292

Version Information: Microsoft .NET Framework Version:1.1.4322.2032; ASP.NET Version:1.1.4322.2032bump!|||What happens when you enter a valid username and password?

What type of authentication are you using? (forms/windows)

How are you connecting to SQL? Looks like a trusted connection. Your error looks like a delegation issue (web server is not trusted for delegation).

Are you using WIN2K or 2003?

(note: I'm not familiar with the tutorial)|||Thank you for your response!

To answer your questions:
Same thing happens for valid username/pass.
Forms.
I do have a trusted connection. Should I take that out?
2003 for web server, 2000 for db server.|||
You have a few choices:

1) run the web application pool as a domain user with database access

2) run the web application pool as a local user and create an identical user (same username and password) on the database server with database access

3) use SQL Authentication and specify the username and password in the connection string

Each alternative has it's own advantages and disadvantages in terms of security and setup effort.

The first option is relatively secure from a database access perspective since the username and password are not stored in the connection string, but it runs the web application as a domain user. An attacker who comprimises the security of your application may be able to gain access to network resources. Also, you would need permissions to add a domain user to your current domain.

The second option keeps the username and password out of your connection string and runs the application as a local user, so an attacker would not be able to gain access to network resources. I'm not sure if it is possible when the database server and web server are running different versions of Windows (haven't tried it personally).

The third option seems to be the most popular, especially in hosted internet solutions, although it is the least secure. The security of the third option can be enhanced by encrypting the username and password, or the whole connection string for that matter, and decrypting it at runtime. The third option is the easiest to setup.

Ultimately the choice is yours. Let me know if you still need help after you've decided which route to take. If you are doing this for learning purposes, it might be a good idea to try each one.

|||That all makes sense now! I used Option 3, since I'll most likely be developing internal applications. We also have our own version of database security that was custom built.

Anyway, thanks for all your help on this. I'm sure this is the first of many more posts to come!