0

I know there have been mkore than a dozen articles on this topic, but for some reason I have not been able to find a solution.

Server WEB1 has IIS7.5 with a site using Windows Authentication (kernel mode off, provider: "negotiate:kerberos") and a AppPool running as NETWORK SERVICE and in Integrated mode.

Impersonation is working fine, but delegation to another server STORAGE1 providing CIFS is not.

I get permission errors when trying to access a UNC located there.

WEB1's computer object in AD has been configured to delegate with "Trust this computer for delegation to any service (Kerberos only)" and I have also tried "Trust this computer for delegation to specified services only : User Kerberos only" with services "CIFS/STORAGE1" & "HOST/STORAGE1" (I know cifs is included with host, I figured that it couldn't hurt using both) with 'Expanded' selected to include the FQDN for the CIFS and HOST service too.

I have a packet capture of a file operation that fails from WEB1 to STORAGE1 and it looks like the message for auth only include the hostname WEB1.

I created a test share with the EVERYONE account given full access on the share level and the NTFS level, and I still get access denied error messages.

I have tried using DELEGCONFIG V2. While I can get impersonation to WEB1 all ticked off, the 2nd hop to STORAGE1 cannot be verified and the delegation level is only at "IMPERSONATE".

At this point I really need to get this application deployed so I am happy to use any work-arounds while I try and find the root cause.

If you have ANYTHING to contribute (suggestions, questions, anything) I would greatly appreciate it.

Help me SF, you are my only hope!

EDIT: In case it is helpful, the code to impersonate the authenticated user for the file operations on STORAGE1 looks like:

WindowsImpersonationContext imp = ((WindowsIdentity)User.Identity).Impersonate();
FileInfo fi = Classes.File(id.Value);
bool dir = fi.Directory.Exists;
bool file = fi.Exists;
imp.Undo();
Improve this question
3
  • Sure is. Sure have.
    – Matt
    Apr 1, 2014 at 23:38
  • Try adding the computer account WEB1$ explicitly. If this works, your problem is definitely with impersonation.
    – MichelZ
    Apr 2, 2014 at 5:49
  • Also, this one from SO might be of help: stackoverflow.com/questions/11953262/…
    – MichelZ
    Apr 2, 2014 at 5:51

1 Answer 1

Reset to default
0

Okay. I think I got this.

  • Computer Object delegation in AD set as "Trust this computer for delegation to any service (Kerberos only).
  • SPNs added for virtual host FQDN for HTTP.
  • AppPool Identity as "ApplicationPoolIdentity" NOT NETWORK SERVICE.
  • Configure browser trusted zone to include web host. (toats important)

We came across some other inexplicable things which led us to remove WEB1 from the domain and rejoining as WEB2.

Also worth mentioning NO ADDITIONAL SPNs were added to allow access to STORAGE1.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .