I have a typical double hop scenario, User ->IIS->SQL.
I am using IIS 7.5, which is using Kernal Model Authentication, so I am setting up the IIS server account for delegation.
If I set this to "Trust this computer for delegation to any service"
Then it works fine. However, I would like to use constrained delegation to work. I have setup SPN's for the SQL server (for both SQLServer and SQLServer.domain.com) and tested the setup using DelegConfig, which says it is fine, but it does not work.
Does anyone know of a way to see what SPN is being used when I run this with Unconstrained delegation, so I can set this up for constrained? Or any other solutions?