I'm trying to sort out Windows Auth delegation for an IIS box talking to a SQL box, which should be passing through the users credentials. I've detailed the configuration of this double-hop scenario and the configuration below:
Issue description
When I access the site as http://localhost:8085, it works. With the machine's hosthaeder, it doesn't - giving the error:
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'
In the Event Log for the SQL box, there's also the detail:
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.
I'm struggling to pin-point which part of the chain is failing, and reverting to anonymous logon.
The configuration is:
Mostly following this guide. Which namely sets:
- IIS service account (or group behind it) trusted for delegation
- Machine is trusted for delegation
- Certain GPO items
The setup is:
- A client machine connecting with IE6
- A Windows Server 2003 box, with IIS6.
- Set to use integrated auth only.
- The app is ASP Classic.
- A SQL 2008 box.
In IIS, it's running:
- App pool domain\xxservice
- SPNs set for:
- http/machinename:8085
- http/machinename.[FQDN]:8085
And SQL has its SPNs set against the SQL box name + the SQL service account.
The user + service account both have sufficient permissions, and I've confirmed it connects with the user's credentials when the app runs against the http://localhost header
The hardest part
... Is seeing the point at which is fails.
Currently I've been Googling, taking another step, Googling, then another step. I'm trying to understand the chain of events as I go.
Are there any suggestions as to what I need to see in the audit trail, and how I can see it? I mostly live in the Event Log, and have tried bits of SetSPN -L, and KerbTray. (Still, it's not ideal...)
And of course, and suggestions as to what I'm likely missing in the configuration of these two boxes would be much appreciated.
Thanks.
