Re: Constrained delegation question!


Hi Joe,

Thanks for the reply. For this application, I have already setup delegation
for SQL Server access so I have an SPN for my DNS/IIS App Pool Identity. In
Active Directory under the delegation tab (for IIS App Pool Identity), I have
allowed delegation to the SQL Server service, however, I don't know how to
allow delegation to the Service Control Manager eg, for SQL Server, under the
delegation tab, I click add and then type in the account that I created the
SQL Server SPN for. For allowing Service Control Manager, which user would I
need to type in and then what service should I add? Alternatively, how would
I setup an SPN to allow delegation to Window Services?

Cheers,
Tan

"Joe Kaplan" wrote:

It should work although I've never tested this scenario.

I'd suggest delegating the SPN for HOST/server to the IIS app pool identity
(or the computer account if you use network service or system) to see if
that works. If you are using the full DNS name to connect to the remote
machine, use that SPN instead. You can also delegate both.

If you are getting Kerberos authentication to the remote machine, then the
constrained delegation should work here. You can check the security event
logs on the remote machine to discover how you are authenticating. If you
get NTLM, then it will not work.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
"Tony201" <Tony201@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:53E59DB5-B9AC-4D85-B65C-29667E94C725@xxxxxxxxxxxxxxxx
Can I use constrained delegation to alllow my web application to control
services on a remote server? At the moment, I have code that when run on
my
local machine (XP - no double hop) is able to control services on remote
servers. However, when I move the web application to an IIS server, I get
the
error llisted below. I am guessing that I need to setup an SPN but don't
know
how to do it for the Service Control Manager. Any ideas?

[Win32Exception (0x80004005): Access is denied]

[InvalidOperationException: Cannot open Service Control Manager on
computer
'serverxxxx'. This operation might require other privileges.]

System.ServiceProcess.ServiceController.GetDataBaseHandleWithAccess(String
machineName, Int32 serviceControlManaqerAccess) +35775

System.ServiceProcess.ServiceController.GetDataBaseHandleWithEnumerateAccess(String
machineName) +9
System.ServiceProcess.ServiceController.GetServicesOfType(String
machineName, Int32 serviceType) +143
System.ServiceProcess.ServiceController.GetServices(String machineName)
+9
AutonomyAdmin.test.test2() +400
AutonomyAdmin.test.Page_Load(Object sender, EventArgs e) +137
System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o,
Object t, EventArgs e) +14
System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender,
EventArgs e) +35
System.Web.UI.Control.OnLoad(EventArgs e) +99
System.Web.UI.Control.LoadRecursive() +50
System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +627



.

Relevant Pages

  • Re: Constrained delegation question!
    ... You should not need to create a new SPN though. ... The HOST/xxx SPNs for the computer account are created automatically when the machine is joined to the domain. ... for SQL Server access so I have an SPN for my DNS/IIS App Pool Identity. ... Active Directory under the delegation tab, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: PROBLEM: ASP on IIS 5 secured via "Windows Integrated Authentication" accessing "
    ... uses NT group based permissons on the SQL Server, ... > transfered to the IIS box and IIS does a local logon. ... > delegation for all accounts. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Kerberos ( Web Service)
    ... I know I'm supposed to create an SPN for a domain account and run the ... The only account that needs the rights to delegate is the service process ... The target of the delegation doesn't need ...
    (microsoft.public.platformsdk.security)
  • Re: "Account is trusted for delegation" is not shown
    ... Where SPN is the servicename/computername (MESSENGER/SERVERNAME for ... This will add the delegation tab to the useraccount you specified. ... account with the Setspn utility in the support tools on your CD. ... It should be caused by raising functional level to windows 2003. ...
    (microsoft.public.windows.server.general)
  • Re: Single Sign On using NTLM
    ... You should be able to Kerb auth from your client to your server by specifying an SPN on the service account that runs the service and then specifying that SPN in your target parameter for your NegotiateStream. ... Getting this working can be a bit of a pain and will likely require that you read up on the TechNet docs on implementing constrained delegation and protocol transition. ...
    (microsoft.public.dotnet.security)