Imagine a website that shows the value of a remote registry key, live, such as the version of the anti-virus definitions on a remote PC. To be clear, there are 3 computers involved, the web server acting as a go-between.
The website uses Windows Authentication, so from a browser on Windows, your AD credentials are passed through and IIS authenticates the user (in ASP.NET, the user token is attached and can programmatically checked).
We're running on IIS 7.5 with kernel-mode authentication, does an SPN need setting-up in AD to allow the Kerberos part of the Windows Authentication to happen??
The site runs under an Application Pool under AD account DOMAIN\AV1, this account is a member of a group that has rights to the computers on the LAN.
The code in the site does not perform impersonation, for it doesn't want to assume the ID of the site user (who doesn't have remote reg rights), so it simply makes a remote registry call.
Does the web server machine account or the DOMAIN\AV1 account need an SPN to negotiate and perform Kerberos auth to the remote computers??