Re: Application Pools, Domain User Accounts and Service Principal Names
- From: "Joe Kaplan \(MVP - ADSI\)" <joseph.e.kaplan@xxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 17 Feb 2006 14:02:29 -0600
My experience has been that to have an SPN that belongs to the domain
service account that does not conflict with the SPNs already assigned to the
machine account, you need a new DNS name and a new A record in DNS for that
name. Then, if you give the machine account the SPN corresponding to the
new DNS name, should be ok.
Note that I've recently tried to do this with a CNAME record in DNS that
just aliases the A record associated with the machine account's DNS/SPN, but
Kerberos seems to be too clever and resolves the alias back to the A record
name before creating its SPN.
I feel your pain. :)
HTH,
Joe K.
"Tom McDonnell" <qirexrd_@xxxxxxxxxxxx> wrote in message
news:u8mJNz3MGHA.1180@xxxxxxxxxxxxxxxxxxxxxxx
I've been involved in building an application in ASP.NET which has
utilised application pools in IIS6 to allow the site to run under the
credentials of a domain user and authenticate with SQL Server.
Having recently rolled this application out to a number of sites, we have
encountered a problem where Windows integrated authentication is enabled,
but users credentials are not accepted. I've figured out the problem to be
due to there being no Service Principal Name for the domain account.
Having found some documentation from Microsoft about this issue, I've
tried to create the SPN, but it causes authentication to then fail with
the NETWORK SERVICE user.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/paght000009.asp#paght000009_additionalconsiderations
How can Windows be configured so both the NETWORK SERVICE and domain users
can be used to perform Windows authentication in IIS6 application pools?
.
- Follow-Ups:
- Re: Application Pools, Domain User Accounts and Service Principal Names
- From: Tom McDonnell
- Re: Application Pools, Domain User Accounts and Service Principal Names
- From: Dominick Baier [DevelopMentor]
- Re: Application Pools, Domain User Accounts and Service Principal Names
- References:
- Application Pools, Domain User Accounts and Service Principal Names
- From: Tom McDonnell
- Application Pools, Domain User Accounts and Service Principal Names
- Prev by Date: Re: How can I impersonate a user in code?
- Next by Date: Re: Application Pools, Domain User Accounts and Service Principal Names
- Previous by thread: Application Pools, Domain User Accounts and Service Principal Names
- Next by thread: Re: Application Pools, Domain User Accounts and Service Principal Names
- Index(es):
Relevant Pages
|
|
