Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

All my nerdly life, I've dealt with this limitation of Windows Domains

  1. Login - console
  2. Integrated auth to something (usually web app)
  3. My credentials can't move to another server (e.g. database or file system). They have to trust machine 2.

Is there a configuration that changes this behavior? In many many cases, 3 hops would be amazingly convenient.

What is the specific reason that credentials should not delegate twice (client->server->server)?

share|improve this question

2 Answers 2

up vote 7 down vote accepted

Absolutely - this is Kerberos delgation, and it's extremely powerful.

You need to read a couple of TechNet articles first:

And then read Ken Schaefer's fanstastic blog posts on Kerberos:

But basically, once your SPN's are setup and you know Kerberos is working, you go to the Computer Object in the Active Directory and select the "Trust this computer for delegation" radio button on the Delegation tab.

From: Ask the Directory Services Team

Ken's article on simple delegation should cover everything you need.

BTW: You were so close to the right search: "Double Hop Authentication" would lead you right to this article from the Ask the Directory Services Team blog: Understanding Kerberos Double Hop

share|improve this answer
    
Fantastic - thanks! I suspect the reason I haven't commonly seen this solved is that the code guys don't talk to the sysadmin guys -- and most apps just work around double hops. –  Precipitous Jun 1 '09 at 6:17

While I don't know the answer for Windows (being a Linux/UNIX person), what you need to ensure under the hood is that you request a forwardable ticket.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.