Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an IIS web-application with Windows authentication and impersonation. This application connects to SQL server. In this case Kerberos works fine.

But there is a problem. Web-application runs windows application (COM), which also connects to the SQL server. Windows application runs with IIS app user credentials and impersonates current site user to connect to SQL server.


When delegation for IIS user is set to "Trust this computer for delegation to any service" everything works fine. But I can't use this type of delegation according to security requirements.

When I set delegation to "Specific services" and choose MSSQLSvc SPN, connection from windows application fails with "ANONIMOUS" fault. WireShark shows "KRB5KDC_ERR_BADOPTION" packet.

What I'm doing wrong?

share|improve this question
Is the application pool identity a user or computer account? – Greg Askew Nov 22 '12 at 17:19
Pool identity is a user account. And he has a valid SPNs to get delegation-level token of siteuser – Mikhail Kislitsyn Nov 22 '12 at 19:16
Probably an issue of missing or incorrect SPN's. You may want to download and setup the DelegConfig web application. It does a good job of analyzing if the delegation is configured correctly, including to the back end servers. – Greg Askew Nov 23 '12 at 4:19
Yes, I've used it. DelegConfig shows me that Kerberos configuration done perfectly. – Mikhail Kislitsyn Nov 23 '12 at 9:13
That sounds curiously "unrestrained", as in not Constrained Delegation. ;-) – Greg Askew Nov 24 '12 at 21:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.