Re: Kerberos Constrained Delegation For Access To Single Application P

When you configure different (domain) worker process accounts for each application you can register a SPN for every application - but you need separate DNS names

e.g.

setspn -a app1/domain domain\App1Account
setspn -a app2/domain domain\App2Account

afterwards you can configure constrained delegation for these specific SPNs

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Is there some way to configure a service account used to run an
ASP.NET application pool to delegate identity only to specific virtual
directories or application pools on a remote server?

From what I've read, I've only ever seen constaining delegation down
to the HTTP service on a web service. This is insufficient for our
scenarios because we have many applications that run in various farms
and want to control access between specific applications.

For example:

- 2 Web Servers
- Server 1 Has Web Services: A & B
- Server 2 Has Web Services: C & D
- Web Service A should be able to delegate identity to web service C,
but
not D
- Web Service B should be able to delegate identity to web service D,
but
not C
- A & B Can Run as separate service accounts
How do I restrict access from the various service accounts to only
specific virtual directories or application pools on a server?
Possible?

Thanks!



.

Relevant Pages

  • RE: Web Service Implementation Security Question
    ... Server was unable to process ... CompilerParameters parameters, Assembly assembly, Hashtable assemblies) at ... > As for the security problems regarding on using TypedDAtaset in asp.net ... Web Service Implementation Security Question ...
    (microsoft.public.inetserver.iis.security)
  • Re: Permission Errors
    ... >a domain account so that it can be validated on the win2k server machine. ... However I have discovered that I can deploy the web service to the W2K ... domain server and there it runs with no problems, ... for me to decide that the new XP dev machine is up and usable. ...
    (microsoft.public.dotnet.general)
  • Re: Kerberos Constrained Delegation For Access To A Single Application Pool
    ... When you say delegate identity, ... across pool A and C but not B and D. ... Server 1 Has Web Services: ... Web Service A should be able to delegate identity to web service C, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Permission Errors
    ... I built the TempConvert3 sample web service on the XP work ... Next I looked at the 2003 server and saw that the local path was ... XP work station. ... >>local workstation, not the server. ...
    (microsoft.public.dotnet.general)
  • Re: Permission Errors
    ... So when we move a webproject to a new server (creating the new virtual ... I built the TempConvert3 sample web service on the XP work ... |>>local workstation, not the server. ... visual studio automatically selected my work station as the ...
    (microsoft.public.dotnet.general)