Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at every forum post I can think to search for and nothing has worked.

I am simply trying to make my web application and its respective service use windows authentication so that, in code, I can pull the currently logged in user's credentials, without prompting them, and pass them to my database stored procedure via my service.

Sounds easy enough, right?


With WireShark running, I keep getting a response of KRB_ERROR (30) with further details of:

error_code: KRB5KRB_AP_ERR_MODIFIED (41)

I'll be trying this tomorrow, but I thought I'd post now in case someone has an idea as to why I keep getting the KRB5KRB_AP_ERR_MODIFIED error based on my current setup that I'll list below.

Here's my current setup:

Windows Server 2008 R2 Standard SP1 64-bit 4.00 GB RAM.

For the sake of this post, we'll call this server DALDEP01.TEST.LOCAL, and on it I have the following:

  • MS SQL Server 2008 R2 which has a database we'll call Deploy.

    1. Only one user account has access to the Deploy db which is TEST\DeploySvc.

    2. This user account is a datareader / datawriter and has been granted EXEC.

  • IIS 7.5 which hosts 2 web sites:

    1. Deploy.Service that makes CRUD operations against the Deploy db.

    2. Deploy.Web that hosts a Silverlight 4 application which makes calls to the Deploy.Service.

    3. Both sites are configured identically (because I'm not sure how else to do it):

      • They use DeployAppPool which runs under custom user account TEST\DeploySvc.

      • Anonymous Authentication is Disabled.

      • Windows Authentication is Enabled

        1. Extended Protection is Accept.

        2. Enable Kernel-mode authentication is Checked.

        3. Providers are just Negotiate, as I removed NTLM because I only want Kerberos.

  • SPNs are configured as follows:

          C:\> setspn -l deploysvc

          Registered ServicePrincipalNames for CN=DeploySvc,OU=Services Accounts,DC=test,DC=local:

2 Answers 2


It's possible for a duplicate SPN to cause this issue...

setspn -X

...will show you if there are any duplicates in your domain and you will need to remove the offending one. Or you could use the SPN Query Utility. I'm also assuming you've already modified the delegation tab in AD for the service account so it's trusted for delegation?

  • There are no duplicates. As for as delegation and trust goes, am I supposed to trust the user account the application pool runs under or am I supposed to trust the user accounts that will be accessing the website or both or neither? Commented Apr 17, 2014 at 13:50
  • The service account running the application pool should be the one where delegation is allowed. Also, after rereading your original question, it occurred to me that you'll need SPNs set on the database server or whichever service account is running SQL there. Or have you done that already? Commented Apr 20, 2014 at 3:38
  • The application pool account is what has access to SQL Commented Apr 20, 2014 at 13:33

I recently had the same issue.

It turned out to be SPN related. The SPN had been mapped to the machine account of the SQL Server instead of mapped to the service account that was running SQL Server.

We deleted and recreated the SPN - mapped to the service account running SQL Server 2012R2 on the host and everything was gravy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .