Configuring ASP.NET MVC app's IIS 7.5 Application Pool identity as login on SQL Server 2008 R2

Question

I am trying to use IIS 7.5 Application Pool identity as login on SQL Server 2008 R2 so that my ASP.NET web app can connect to the database...

Using this approach worked fine on my local dev machine (IIS 7.5 and SQL Server 2008 R2 on same machine).

However, when I try to set up the same on production (IIS and SQL servers are separate) I am unable to add "IIS APPPOOL\MyAppAppPool" login to SQL Server 2008 R2.

Notice that in either case you cannot use "Browse..." when creating a login in SQL Server since "IIS APPPOOL\MyAppAppPool" user identity is dynamic (or "special")...

Any ideas?

Update:

For more info on Application Pool Identities see here.

From article:

Whenever a new Application Pool is created, the IIS management process creates a security identifier (SID) that represents the name of the Application Pool itself. For example, if you create an Application Pool with the name "MyNewAppPool," a security identifier with the name "MyNewAppPool" is created in the Windows Security system. From this point on, resources can be secured by using this identity. However, the identity is not a real user account; it will not show up as a user in the Windows User Management Console.

Answer 1

That articles states (under "Accessing the Network") you still use the <domainname>\<machinename>$ aka machine account in the domain.

So if both servers are in "foobar" domain, and the web box is "bicycle", the login used to the SQL Server Instance is foobar\bicycle$

If you aren't in a domain, then there is no common directory to authenticate against. Use a SQL login with username and password for simplicity

Edit, after comment

If the domains are trusted then you can use the machien account still (use domain local groups for SQL Server, into which add a global groups etc)

As for using app pool identities, they are local to your web server only as per article. They have no meaning to SQL Server. If you need to differentiate sites, then use proper domain accounts for the App Pools.

You can't have it both ways...