0
votes
0answers
14 views

Enabling constrained delegation on DC computer account

Is it necessary to have constrained delegation enabled on Microsoft AD domain controller computer account? If yes then why and what are consequences of disabling it? I'm mainly interested in current ...
0
votes
0answers
67 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
3
votes
1answer
130 views

SPNs and Kerberos Delegation

I would like to check my understanding. This is a fully hypothetical scenario below as I am currently studying for a certification. I have an IIS App Pool with a basic website, which accesses data ...
0
votes
1answer
656 views

Multihop Kerberos delegation on IIS7 / Windows 2008

So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
1
vote
0answers
130 views

Kerberos: connection from win app running from IIS to SQL failed

I have an IIS web-application with Windows authentication and impersonation. This application connects to SQL server. In this case Kerberos works fine. But there is a problem. Web-application runs ...
5
votes
2answers
425 views

Risks of Kerberos Delegation

I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
2
votes
0answers
578 views

Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account. I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
0
votes
1answer
136 views

Sorting out delegation

I'm trying to sort out Windows Auth delegation for an IIS box talking to a SQL box, which should be passing through the users credentials. I've detailed the configuration of this double-hop scenario ...
2
votes
1answer
1k views

In Win/AD, does kerberos authentication require the services accounts to be the same?

I am trying to isolate the cause of a KRB5KDC_ERR_BADOPTION (13) that I am seeing come back in a WireShark trace. I have set an SPN to associate xxx/server.fqdn:port with the domain account that ...
3
votes
3answers
2k views

Kerberos Delegation for SQL Bulk insert (access denied)

I have a problem when trying to bulk insert to SQL under the following situation: Running management studio on Workstation A SQL Running on Server B File to bulk upload from located on Server C ...
0
votes
2answers
1k views

Create a linked SQL server across a domain

I am trying to create linked server on a SQL 2008 server to sql server on another domain. I tried following the advice given in this article: ...
0
votes
2answers
365 views

Automate setup of constrained kerberos delegation in AD

I have a web app that uses some backend servers (UNC, HTTP and SQL). To get this working I need to configure ServicePrincipalNames for the account running the IIS AppPool and then allow kerberos ...
0
votes
1answer
318 views

Cross Forest Delegation

Is it possible to do delegation in a cross forest scenario with only a one way trust? I have 2 domains which are in different forests, and there is a one way trust from the resourcedomain to the ...
5
votes
2answers
2k views

Is there a way to get Kerberos credentials to delegate twice? Why not?

All my nerdly life, I've dealt with this limitation of Windows Domains Login - console Integrated auth to something (usually web app) My credentials can't move to another server (e.g. database or ...