Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following setup:

  • ServerA, a web server with an mvc site
  • ServerB, a web server with an Web Api service

The MVC site on ServerA consumes the Web Api service on ServerB. Users log into the MVC site but certain service methods in the Web Api require that the user is in a particular role etc so I need to be able to authenticate the user at the Web Api level.

For this reason, I have tried to set up Kerberos. ServerA has been trusted for delegation. The MVC website is running under a network user account (we'll call it ServiceAccount here) which has been set for delegation. I have set up an SPN for this. However, all requests from the MVC site to the Web Api show that the user is ServiceAccount and not the actual logged in user of the MVC site.

Information around Kerberos seems fragmented so I'm struggling to find a solution. Has anyone got any ideas what may be wrong here?


share|improve this question
Lots of good info on troubleshooting Kerberos auth on here:… – Trondh Sep 26 '13 at 9:18
Have you tried setting useAppPoolCredentials =true?… – Greg Askew Sep 26 '13 at 9:26

After getting nowhere with this I eventually found the following article: in particular the instuctions in "Section 5". This describes how to set up a very basic test to troubleshoot Kerberos double hops which has helped me to get my own set up working.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.