1

I have a similar problem as described here: ARR 3 IIS 7.5 Windows Authentication not working

Unfortunately that solution does not work on our servers.

In our test environment we have an ARR server (Win 2012, IIS 8.0) and a web server (Win 2008R2). The web application on the webserver requires Windows authentication and it already works when the client is using NTLM as a response to the negotiate request. But when the client sends a Kerberos ticket the request is not forwarded to the webserver but instead answered by the ARR server with a HTTP 401 message.

I already tried a lot of recommendations without success. Either the authentication fails on the ARR or the webserver.

We had ARR 2.5 running but I also already tested with ARR 3.0 without success.

I also configured the SPN entries for the ARR and the web server (http://blogs.iis.net/brian-murphy-booth/archive/2007/03/09/the-biggest-mistake-serviceprincipalname-s.aspx). And tried to use the same user accounts for the app pool on the ARR and web server.

------- EDIT-------

  • I tried the whole approach from the other working solution (ARR 3 IIS 7.5 Windows Authentication not working)
  • Disable Kerberos on the ARR and Web (separatly) so that only NTLM is supported (fails on ARR)
  • App pool with app pool identity and real account (same on ARR and web) with different SPN approaches
  • Upgrade to ARR 3.0 and repeat all tries

The problem is always that the ARR server is reacting on the negotiate header even if the ARR is configured for anonymous.

BTW: KB 2732764 was installed long time ago

1
  • Can you list the things you have tried, please?
    – BE77Y
    Feb 10, 2015 at 11:09

1 Answer 1

1

I finally found a solution for us:

Since we don't have the requirement for "multi-hop" authentication (=kerberos) I was able to force NTLM. On the web server under auhtentication (site) I changed the providers for Windows Authentication and removed everything but NTLM. So NTLM is the only available way for authentication.

On the ARR I changed everything back to the original settings and enabled anonymous access only. Then ARR is able to pass-through the authentication to the web server.

In my opinion Microsoft has a bug in the Kerberos handling and it does not depend on whether the authentication is proceeded in ther Kernel or by the ARR.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .