The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
16 views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
0
votes
1answer
19 views

IIS Credential Delegation for AppPool in Integrated Pipeline mode

I know there have been mkore than a dozen articles on this topic, but for some reason I have not been able to find a solution. Server WEB1 has IIS7.5 with a site using Windows Authentication (kernel ...
2
votes
0answers
80 views

SPN settings in a ADFS 3.0 lab setup

I am a developer trying to understand authentication with ADFS (2012 R2), so I am trying to setup an ADFS lab. I have found 2 guides: doc1 - http://technet.microsoft.com/en-us/library/dn280939.aspx ...
6
votes
1answer
275 views

Active Directory 2012 LDAP Integration Service Principal Name Entry is Disappearing?

Creating Python Service to Query AD Attributes I'm integrating our AD with web services running Python on linux using Python-LDAP over SASL(DIGEST-MD5) to query AD 2012 user attributes (division, ...
2
votes
2answers
47 views

Adding new SPNs to existing service ids

We have a tomcat server using spring-security kerberos to authenticate users to the webpage against active directory. There are around 25 domain controllers. The site has two CNAME based DNS ...
0
votes
0answers
33 views

How can I configure Kerberos Key Distribution Center to serve multiple tickets?

On my AD, I've mapped the SPNs of a few Linux services to a domain user. How can my clients request all of the tickets mapped to this domain user, rather than only requesting a ticket based on the ...
3
votes
3answers
153 views

Kerberos - Adding a SPN to a Domain User

When adding a new SPN into the Kerberos domain, you have the option of mapping the SPN to a user. In general, I join the domain through Integrated Windows Authentication, and this creates a new ...
3
votes
1answer
39 views

What SPNs are needed for an intranet web service that reads remote registries

Imagine a website that shows the value of a remote registry key, live, such as the version of the anti-virus definitions on a remote PC. To be clear, there are 3 computers involved, the web server ...
3
votes
1answer
92 views

SPNs and Kerberos Delegation

I would like to check my understanding. This is a fully hypothetical scenario below as I am currently studying for a certification. I have an IIS App Pool with a basic website, which accesses data ...
0
votes
1answer
204 views

Multihop Kerberos delegation on IIS7 / Windows 2008

So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
1
vote
1answer
147 views

“setspn -s” vs. “setspn -a”

According to Setspn Overview it's discouraged to use Setspn -A to add an SPN record and it's suggested to use Setspn -S instead. It's said that Setspn -S checks whether the SPN already exists before ...
2
votes
2answers
2k views

Will kerberos work with CNAMEs if I have the SPN created for the A record as well?

We are currently setting up a SQL 2012 environment and it will be used for storing data that will be accessed by SSRS in sharepoint integrated mode. We will be using Kerberos for authentication. ...
4
votes
1answer
306 views

Kerberos issues after new server of same name joined to domain

Environment: Windows Server 2012, 2 Domain Controllers, 1 domain. A server called Sharepoint1 was joined to the domain (running Sharepoint 2013 using NTLM). The fresh install for Sharepoint1 (OS and ...
1
vote
1answer
210 views

Clear SPN changes from server cache

We have in house IIS apps built on ASP .Net 2.0 running on IIS 7.5- Server 2008 R2 x64. Back end is SQL 2005. It uses Kerberos (Windows integrated) authentication. Once in a while we need to change ...
0
votes
1answer
929 views

SPN's, Kerberos and IIS

I have a dns alias of MyWebServer, which points to the ip of a win 2008 r2 box running iis 7.5. I have the correct HTTP spn's set up for a domain user which has permissions to delegate to a nominated ...
1
vote
2answers
3k views

IIS and Integrated Windows Authentication - login doesn't work for domain.com, works for IP address, localhost, 127.0.0.1

I've installed Windows Server 2003 R2 and IIS role (no Active Directory role). I've setup a virtual directory named 'test' and under Security tab of the 'test' Virtual Directory I've disabled the ...
5
votes
1answer
2k views

Permissions to create an spn

According to some of the documentation I've read the service account for SQL server will create an SPN when the database engine starts up, allowing for kerberos authentication. I haven't been able to ...
3
votes
1answer
146 views

Why deploy Kerberos for Exchange 2010 SP1 RU3?

The first version of Exchange 2010 to support Kerberos is SP1 RU3. It does this through the RollAlternateServiceAccountCredential.ps1 commandlet. Besides implementing "better" security, does this ...
2
votes
2answers
4k views

help using setspn and ktpass

I'm trying to set up the SPNs and create a keytab file for tomcat kerberos spnego Single sign on. the server running tomcat7 is ubuntu-ad1.wad.eng.hytrst.com the KDC is kerberos.wad.eng.hytrust.com ...
1
vote
1answer
2k views

RDP from 2008 R2 through a tunnel fails

I'm trying to RDP from a Win7 to a 2008 R2 machine through a tunnel (think SSH, but not exactly). It fails and the following is in the 2008 R2 (destination) event log: System Event Log, LsaSrv ...
1
vote
1answer
553 views

need help in setting up SPN for Kerberos Authentication

I am using IIS 7 for setting up a website under windows authentication. I am seeing authentication issue which i am almost sure that it is related to kerberos issue and i am wrongly setting up SPN. ...
0
votes
1answer
337 views

How to set the SPN for Postgres SSPI

I am trying to setup Postgres to support SSPI/Kerberos, however I think that I have not found out what the correct SPN that is needed to get it working. The background details: Service account for ...
1
vote
0answers
548 views

Kerberos Issue on Aliased SharePoint Web Front Ends

I am having a problem with Kerberos working on SharePoint. Also note that I am a developer not a network guy so if I use the wrong terms I apologize but I hope my intent is clear. We have two web ...
1
vote
1answer
346 views

Confusion about Kerberos, delegation and SPNs

I already posted this question on SO, but the nature of it is between programming and server configuration, so I'll re-post it here as well. I'm trying to write a proof-of-concept application that ...
4
votes
1answer
11k views

Create SPN with setspn.exe - Insufficient access rights

On a Windown Server 2008 Domain Controller, I'm attempting to add a Service Principal Name (SPN) to a user account 'Postmaster' in order to enable Kerberos authentication from a Communigate email ...
3
votes
1answer
836 views

Can I share one SPN between two service accounts?

I am running IIS and SQL Reporting Server on the same server. IIS runs as d\acct1 and SSRS is running as d\acct2. Initially, I registered an SPN HTTP/server.d.com for both d\acct1 and d\acct2 and ...
4
votes
1answer
7k views

Creating keytabs and service principal names

I'm trying to set up a keytab for a Java server to support Kerberos authentication on a Windows network. I'm struggling to get it working even at the level of the command line tools, haven't even got ...