First of all, not sure which site is best suited for this question be it SO, SF or SU so please feel free to suggest migration!

I have a requirement to constrain delegation between several machines to enable identity impersonation between different services.

Here's the different machines:

  • Machine1 - Has IIS 8.0 with an AppPool running under the local service account Local System
  • Machine2 - Has SQL Server 2008 R2 with SSRS both running under local service account Network Service
  • Machine3 - Has SQL Server 2008 R2 and mirrors several databases from Machine2

The app I'm developing needs to be able to impersonate the client identity to enable access to the SQL Server Backend and Reporting Services. There is also a requirement to impersonate the user to enable the app to upload files to a shared network location.

All the machines run under the same domain.

I've sat down with a domain administrator and have enabled Enable this computer for delegation to any service (kerberos only) to all three machines. The reason for this is because I've tried to constrain delegation to certain services to no avail.

I haven't amended any SPN's as my understanding is that SQL Sever will automatically create the required SPN's to do the job.

With my application, I have specified in the web.config file the follow to enable impersonation:

<authentication mode="Windows" />
<identity impersonate="true"/>

IIS has only windows authentication enabled.

The Issue

Delegation appears not to be working at all as when the app is deployed to IIS, authentication issues arise (i.e. 401 errors) when trying to access the SSRS service and when trying to upload a file to the network share.

The Question

Is there anything else that I'm missing / need to check to get delegation working across the machines and which services do I need to enable to allow the above requirements.

Please note I have read many questions surrounding delegation which have not solved my issue.

  • I believe SQL Server only creates the SPN when SQL Server installation happens. My gospel for such things is Adam Saxton Kerberos Checklist – billinkc Sep 16 '15 at 13:26
  • @billinkc Thanks for the link. I've been through the checklist and still doesn't seem to want to work. I've double checked the SPN's which all seem to be in order. – Gareth Sep 17 '15 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.