If a connection string specifies
Trusted_Connection=true with SQL Server authentication mode, will performance of my web application be impacted?
Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.
Not 100% sure what you mean:
IS using Windows credentials and is 100% equivalent to:
If you don’t want to use integrated security / trusted connection, you need to specify user id and password explicitly in the connection string (and leave out any reference to
Only in this case, the SQL Server authentication mode is used.
If any of these two settings is present (
Integrated Security=true/SSPI), then the Windows credentials of the current user are used to authenticate against SQL Server and any
user iD= setting will be ignored and not used.
For reference, see the Connection Strings site for SQL Server 2005 with lots of samples and explanations.
Using Windows Authentication is the preferred and recommended way of doing things, but it might incur a slight delay since SQL Server would have to authenticate your credentials against Active Directory (typically). I have no idea how much that slight delay might be, and I haven’t found any references for that.
If you specify either
Integrated Security=SSPI; or
Integrated Security=true; in your connection string
==> THEN (and only then) you have Windows Authentication happening. Any
user id= setting in the connection string will be ignored.
If you DO NOT specify either of those settings,
==> then you DO NOT have Windows Authentication happening (SQL Authentication mode will be used)
When you use trusted connections, username and password are IGNORED, because SQL Server using windows authentication.
This will probably have some performance costs when creating the connection but as connections are pooled, they are created only once and then reused, so it won’t make any difference to your application. But as always: measure it.
There are two authentication modes:
- Windows Authentication mode (corresponding to a trusted connection). Clients need to be members of a domain.
- SQL Server Authentication mode. Clients are sending username/password at each connection
If your web application is configured to impersonate a client, then using a trusted connection will potentially have a negative performance impact. This is because each client must use a different connection pool (with the client’s credentials).
Most web applications don’t use impersonation / delegation, and hence don’t have this problem.
See this MSDN article for more information.