Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have ASP.NET 2.0 site configured to perform Windows Integrated Security using Kerberos delegation. The servers including DC are running on Windows 2003 and the delegation is raised to Windows 2003 level.

BTW, all servers are set to EST

The authentication work well and suddenly server writes a LsaSrv warning event (event id 40960) in System log complaining about time difference between the servers. During this time the clients get a 401.2 message for all requests. After 20-30 mins, the auth starts working "magically"

I ran a wireshark and fiddler trace and found that the timestamp in the response header is in GMT even though the server is configured in EST. I'm not sure how this is picked up. any ideas?

Any other suggestions are much appreciated.

share|improve this question

3 Answers 3

GMT and EST is not likely the problem.

Kerberos requires that all participants have a clock that is within 5 minutes of each other. I suspect you need to ensure that the servers and clients all have a time that is within that window.

I use NTP, personally, even on windows. There is probably a "windows way" though.

share|improve this answer
up vote 1 down vote accepted

Chris, Mike

Thanks for the guidance. We opened a call with Microsoft and they were able to narrow it down to kerberos ticket expiration bug. The call was opened on 2/10 and hotfix was provided. So, far no issues were reported.

Below is the support link,

http://support.microsoft.com/default.aspx?scid=kb;EN-US;979159

thanks again

share|improve this answer

Kerberos is extremely time sensitive - you need to make sure that the time on the IIS server matches your Domain Controller's time.

This article How Windows Time Service Works has a basic overview.

First, you need to make sure your PDC emulator's time is correct How to configure an authoritative time server in Windows Server

Next, on the IIS Server, set it to sync with the domain: Configure a client computer for automatic domain time synchronization.

That should do it.

share|improve this answer
    
Note that domain members will perform time sync with a DC by default, the only reason to mess with this is to revert the Windows Time service to its default settings in the event that someone else has messed with it previously. –  ThatGraemeGuy Feb 23 '10 at 15:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.