I am using IIS 7 for setting up a website under windows authentication. I am seeing authentication issue which i am almost sure that it is related to kerberos issue and i am wrongly setting up SPN. The scenario which i am using is as below.
I have created a new test Domain (FQDN of which let call as "test.net") governed by a Domain-Controller (lets call this mc as 'test-DC'). Under this new domain (test) i have hosted a IIS server which is suppose to use windows authentication with kerberos delegation. I have enabled windows auth enabled while other disabled in IIS manager. Lets say this IIS machine name is 'test-iis' and active directory has it username for IIS server as 'user-iis'. Application pool in IIS server is running under service account as "TEST\user-iis". I am trying to setup SPN for HTTP service type.
First question: I am setting SPN as
setspn -a http/test-iis.test.net
Is this SPN setting right??
My second question is. I am setting this SPN value in Domain Controller thinking DC is the entity that will verify credentials and all. Is my thinking right??
Any advice with this issue will be much helpful to me and others..
[Edit] One more thing, i am able to ping from IIS server to 2 other machine in the same domain but i could not ping the IIS server with other two machines. can anyone help me understand why that is so?