Having a hell of a time trying to get a .NET web app to use Kerberos auth successfully, and would appreciate some assistance from the SF community.
Currently there is a Win2003/IIS6 server hosting a web site out of the default "network service" application pool. Based on the MS How To Create a Service Account page, I performed the following steps:
- Created a new domain account
MYDOMAIN\CustomASP
- Registered the account on the server with
aspnet_regiis -ga MYDOMAIN\CustomASP
- Created new SPNs
HTTP/SERVERNAME
andHTTP/SERVERNAME.fqdn.here
on the domain account - Made an application pool
MyPool
running under theMYDOMAIN\CustomASP
identity - Created a new virtual directory
MyASP
running in the new app pool - Made sure that
SERVERNAME
is in the Intranet zone, and IE has IWA enabled
According to what I've read, this is all that should be necessary. The existing site is using Kerberos and it works fine; but trying to browse to http://servername/MyASP results in a failed login attempt being recorded, and an Event 529 being written to the security log with a blank username.
NTLM authentication will work for this (tested by turning off IE's IWA or accessing the server by IP address) but Kerberos will just not work. I have the option to force NTLM and require SSL for the virtual directory, but that seems like the "ugly hack" way to fix this. Surely I'm just missing some glaringly obvious step in the procedure here caused by an epic lack of sleep.
Any help, suggestions, or stories of people who've been here and fixed it would be greatly appreciated. Thanks in advance.