Re: The pest of Impersonation

Ok, so in this case it is just the delegation that is failing. This is
actually a good sign.

What you are seeing is that Kerberos auth using impersonation cannot be done
for whatever reason (which we need to figure out), so Negotiate auth tries
NTLM instead and logs in the anonymous (NULL token) user. Since no one in
their right mind grants any access to the anonymous user, you get a 401.

Since it looks like the app pool identity (impersonation off) CAN do Kerb
auth the other web server and you don't have a configuration problem with an
SPN or IIS setting, it looks like you just don't have rights to delegate.

Are you certain that the app pool identity for the front end web server has
permissions to delegate in AD? Also, are the browser clients being
authenticated with Kerberos on the front end? If those two are true, then
delegation should be possible.

It has been a little while since I looked at this thread, so you might have
to remind me exactly which steps have been confirmed.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
right, I have lots more information

I've done some thourough testing, and I've got myself access to the
foreign webserver.

If i access the java webserver via ie....I see "Kerberos" based
authentication events in the security log.

I've tried just about everything under the sun with my website, but
with "impersonation" off, I only ever authenticate as the servername,
with impersonation on (and it doesn't seem to matter what type of
impersonation i use) I get access denied, or more preciecely 401 which
is autorization failed.

I've looked at the Security log on the Java website and when the
asp.net server is not impersonating, I get a kerberos login for the
server name

When impersonation is switched on, I get an "Anonymous Logon" and some
talk of NTLM:

Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x9FF8B8A)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: asp.net web server
Logon GUID: -
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: removed
Source Port: 1773

So, to summarise

The Java website does accept KERBEROS authentication
I am definatly logged on and authenticated to the ASP.NET website
The authentication isn't getting through when I switch to
impersonation.

Cliff.



.

Relevant Pages

  • Re: Kerberos machine authentication - apparent authentication fail
    ... until a user logon event. ... the Netdiag utility will show the Kerberos error in this scenario ... On these machines I ... me a plausible starting point to solve my Kerberos authentication problem. ...
    (microsoft.public.windows.server.security)
  • Re: Kerberos machine authentication - apparent authentication fail
    ... Subsequent Netdiag attempts after a reboot show the failed Kerberos ... >>> mean that kerberos authentication is not being used. ... >>> computer for logon events and the domain controller for account logon ...
    (microsoft.public.windows.server.security)
  • Re: Integrated Authentication with SQL
    ... On the IIS level there is no trouble authenticating with kerberos. ... problem is in when I try to flow those credentials over to the SQL server. ... Successful Network Logon: ... Authentication Package: Kerberos ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Kerberos machine authentication - apparent authentication fail
    ... Kerberos result when I hardwired a laptop to a switch port. ... to authenticate with K on reboot AND authentication appears to take place ... > denied access until you can authenticate to a domain controller as a user. ... > You should have logging of account logon events enabled in Domain Controller ...
    (microsoft.public.windows.server.security)
  • Re: All accounts get locked out!
    ... I am going through the same trouble now...I get alot of NTLM authentication ... Kerberos logging. ... I have checked the Domain Security Policy as well as the ... > Logon Failure: ...
    (microsoft.public.win2000.security)