Re: SPS wont use kerberos

From: Al Blake (al_at_blakes.net)
Date: 05/30/04

  • Next message: Joe: "We ALL need to know" 
    Date: Sun, 30 May 2004 11:19:58 +1000

    Fantastic Ken,
    This is just the sort of info/troubleshooting I was looking for.
    I'll check it out and let you know in the next couple of days.
    Thanks again.

    "Ken Schaefer" <kenREMOVE@THISadOpenStatic.com> wrote in message
    news:eVXOU1dREHA.2936@TK2MSFTNGP12.phx.gbl...
    > Is the server actually sending back:
    >
    > WWW-Authenticate: Negotiate
    > WWW-Authenticate: NTLM
    >
    > in the HTTP response headers. You can use WFetch to test this:
    >
    http://www.microsoft.com/downloads/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499&DisplayLang=en
    >
    > Is the client then attempting to use Kerberos to authenticate. You will
    need
    > to use something like Ethereal to test this: www.ethereal.com
    >
    > Cheers
    > Ken
    >
    >
    > "Al Blake" <al@blakes.net> wrote in message
    > news:%23gLHDHdREHA.1160@TK2MSFTNGP09.phx.gbl...
    > : Sure.
    > : But what would you like to know ?
    > : Al.
    > :
    > : "Ken Schaefer" <kenREMOVE@THISadOpenStatic.com> wrote in message
    > : news:uwgvzEYREHA.1644@TK2MSFTNGP09.phx.gbl...
    > : > Hi,
    > : >
    > : > As mentioned in your other thread, let's please look at what is
    actually
    > : > happening between server and client before speculating about causes.
    > : >
    > : > Cheers
    > : > Ken
    > : >
    > : >
    > : > "Al Blake" <al@blakes.net> wrote in message
    > : > news:%23w3uNdWREHA.2112@TK2MSFTNGP11.phx.gbl...
    > : > : We have a windows2003 member server in a native AD domain that runs
    > : > SPS2003
    > : > : as well as a number of non-SPS IIS6 web sites.
    > : > : We have managed to configure all the web sites *except* SPS2003 to
    use
    > : > : kerberos as their preferred authentication - so we know kerberos is
    > : > working
    > : > : on the box.
    > : > :
    > : > : We have followed KB832769 to enable kerberos on the SPS web but
    still
    > : > : whenever a client browser connects (XP + IE6SP1) the authentication
    > : method
    > : > : selected is NTLM. Why?
    > : > :
    > : > : We have:
    > : > : a) Set NTAuthenticationProviders to "Negoatiate,NTLM" in the
    metabase
    > : for
    > : > : the SPS site
    > : > : b) Set the computer account as trusted for delegation in AD
    > : > : c) Set the user account used by the app pool as trusted in AD
    > : > : d) Used setspn to add HTTP/DOMAIN\USER SERVER as an additional spn
    > : > :
    > : > : but still NTLM is used as the authentication mechanism.
    > : > :
    > : > : As a side issue, when tryng to access the box from another
    windows2003
    > : > : server (such as our TS server) which is running IE 6.0.3790.0 we get
    > : > : repeatedly prompted to login if authentication mechanism is
    > : > : "Negotiate,NTLM". Checking in the event log shows a kerberos failure
    > for
    > : a
    > : > : blank username.
    > : > :
    > : > : Trying from XP+IE6SP1 clients we do not get prompted to login (ie
    > : windows
    > : > : authentication works) but checking in the event log indicates that
    > NTLM
    > : > has
    > : > : been used ! So XPIE6SP1 is NOT using kerberos to authenticate with
    the
    > : SPS
    > : > : site. Why not?
    > : > :
    > : > : Al Blake, Canberra, Australia
    > : > :
    > : > :
    > : >
    > : >
    > :
    > :
    >
    >

  • Next message: Joe: "We ALL need to know"

    Relevant Pages

    • Re: SPS wont use kerberos
      ... This is just the sort of info/troubleshooting I was looking for. ... > NTLM ... >: SPS ...
      (microsoft.public.sharepoint.portalserver)
    • Re: Sorting on Column Headers in Sharepoint Designer 2007

      (microsoft.public.sharepoint.windowsservices)
    • Re: how to mix 2 recordsets into one result table?
      ... How about making the sps return an additional column indicating the ... Then you could sort on Foreignkey, ... dilipdotnet at apdiya dot com ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: SPS & offline documents library
      ... He'll need an application for offline handling of document library ... (presumably in WSS sites within SPS 2003) ... documents as this sort of thing ... > I want to open and edit SPS documents on ...
      (microsoft.public.sharepoint.portalserver)
    • Search with "NEAR" in SPS 2003
      ... In Sharepoint Portal 2003, is it possible to seach for two keywords within, ... say 50 words of each other and sort the result according the the distance? ... I've written a web part for SPS 2001 which does this (and features like ...
      (microsoft.public.sharepoint.portalserver)