Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to sort out Windows Auth delegation for an IIS box talking to a SQL box, which should be passing through the users credentials. I've detailed the configuration of this double-hop scenario and the configuration below:

Issue description

When I access the site as http://localhost:8085, it works. With the machine's hosthaeder, it doesn't - giving the error:

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

In the Event Log for the SQL box, there's also the detail:

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.

I'm struggling to pin-point which part of the chain is failing, and reverting to anonymous logon.

The configuration is:

Mostly following this guide. Which namely sets:

  • IIS service account (or group behind it) trusted for delegation
  • Machine is trusted for delegation
  • Certain GPO items

The setup is:

  • A client machine connecting with IE6
  • A Windows Server 2003 box, with IIS6.
    • Set to use integrated auth only.
    • The app is ASP Classic.
  • A SQL 2008 box.

In IIS, it's running:

  • App pool domain\xxservice
  • SPNs set for:
    • http/machinename:8085
    • http/machinename.[FQDN]:8085

And SQL has its SPNs set against the SQL box name + the SQL service account.

The user + service account both have sufficient permissions, and I've confirmed it connects with the user's credentials when the app runs against the http://localhost header

The hardest part

... Is seeing the point at which is fails.

Currently I've been Googling, taking another step, Googling, then another step. I'm trying to understand the chain of events as I go.

Are there any suggestions as to what I need to see in the audit trail, and how I can see it? I mostly live in the Event Log, and have tried bits of SetSPN -L, and KerbTray. (Still, it's not ideal...)

And of course, and suggestions as to what I'm likely missing in the configuration of these two boxes would be much appreciated.

Thanks.

share|improve this question

1 Answer 1

Have you got the reg key for IE configured on client as per http://support.microsoft.com/default.aspx?scid=kb;EN-US;899417. See http://blogs.technet.com/b/askds/archive/2009/06/22/internet-explorer-behaviors-with-kerberos-authentication.aspx. I also recommend you take network traces to see whether kerberos auth to the web app itself is working.

Use http://blogs.technet.com/b/askds/archive/tags/kerberos/ as the main resource for learning how this works. I also recommend http://blogs.msdn.com/b/spatdsg/archive/2007/11/14/kerberos-delegation-end-to-end-part-i.aspx and other parts at spat's blog.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.