0

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers.

We have 2 x Windows 2012 Servers running

  • IIS Server
  • SQL Server 2012

We have kerberos delegation set up and working from IIS server to the SQL Server. Users authenticate to IIS and then these are passed through to SQL Server for any operations that are performed using delegation

Everything works fine with Negotiate (Kerberos then NTLM) set up on IIS and when accessing the site internally but when we try putting the site behind a reverse proxy (Sonicwall SRA), it breaks.

Having done a bit of investigation, it would appear that this is because kerberos authentication doesn't work behind a reverse proxy so we need to switch to basic (as NTLM doesn't work for delegation between IIS and SQL server).

So is best practice in this case to use HTTPS to protect basic authentication or is there a way to get Negotiate (kerberos) working?

It does seem odd that one needs to use Basic because

  • Kerberos cannot be used behind a reverse proxy and
  • NTLM cant be use to delegate

But maybe thats just the way it is.

3
  • Does your reverse proxy support Kerberos Delegation? Maybe you could then tripple-hop...
    – MichelZ
    Apr 11, 2014 at 10:36
  • Its a Sonicwall SRA and there is no mention of kerberos delgation support in the docs or the UI - have updated the post above
    – Phil
    Apr 11, 2014 at 10:48
  • 1
    Well, if the reverse proxy does not support Kerberos at all, then yes, basic authentication is your only option, and that requires HTTPS to be secure. If you don't need pre-authentication on your reverse proxy, you might get away with passing kerberos auth through it? Not sure if that works using Sonicwall tough.
    – MichelZ
    Apr 11, 2014 at 12:42

0

You must log in to answer this question.

Browse other questions tagged .