IIS 6 and Kerberos Authentication

From: Alex Sorcinelli (asorcinelli_at_itconsult.it)
Date: 06/17/05 

Date: Fri, 17 Jun 2005 08:54:19 +0200

Hello,
i try to set-up kerberos delegation in a Windows 2003 server with IIS 6.0.
I have a web service installed in the default web site and it call another
application installed in another server. The credentials of the user that
call the web service need to be passed to the second application.
I read all the Microsoft documents about delegation but i still have the
problem. This is my situation:

- IIS 6 is running with Local System.
- For the default web site i have setup the NTAuthenticationProviders with
"Negotiate,NTLM"
- In AD i set the check Trusted for delegation
- The web service use Impersonate, and i Windows authentication.

When i call the web service i see on the event viewer that the user connect
with the kerberos protocol, but then in the second machine i see that is the
anonymous user that try to authenticate.
I use kerbtray utility to see the tickets in the first machine and i don't
see a kerberos ticket for the second machine.
Any suggestions? Do i need to setup IIS 6 in a different way?

Thanks, Alex

P.S. Sorry if this isn't the right newsgroup, but i think that the problem
can be IIS 6 and not AD or other components.

Relevant Pages

  • Re: Serializing credentials and reauthenticating. How?
    ... if your calling process is trusted for delegation with any protocol in AD ... In IIS, to get Kerberos you need to enable IWA auth and ensure the metabase ... We may go SSL/Basic from client to ALSB. ...
    (microsoft.public.dotnet.security)
  • Windows Authentication problem with IIS6 (Win2k3)
    ... I believe the problem to be something related to the Kerberos technology, ... Internet Information Services (IIS) ... Shouldn't integrated windows authentication use their ... Windows 2000) that talked about Kerberos and Delegation. ...
    (microsoft.public.inetserver.iis)
  • Windows Authentication problem with IIS6 (Win2k3)
    ... I believe the problem to be something related to the Kerberos technology, ... Internet Information Services (IIS) ... Shouldn't integrated windows authentication use their ... Windows 2000) that talked about Kerberos and Delegation. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Delegation / IIS6 / share located on another computer
    ... Can you look in the Security Event log of the webserver, and verify that the client is actually authenticating using Kerberos? ... SERVER B is in the Local Intranet zone and I have "Automatic logon only in Intranet Zone" enabled. ... IIS and Kerberos Part 2 - What are Service Principal Names? ... I have read a lot of articles on how to configure delegation correctly to enable me to use IWA to gain access to an IIS site which is based on a shared folder located on another computer in the domain but it doesn't let me in and was wondering if someone knew why. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Delegation / IIS6 / share located on another computer
    ... IIS and Kerberos Part 1 - What is Kerberos and how does it work? ... I have read a lot of articles on how to configure delegation correctly to enable me to use IWA to gain access to an IIS site which is based on a shared folder located on another computer in the domain but it doesn't let me in and was wondering if someone knew why. ... SERVER A - has the shared folder ...
    (microsoft.public.inetserver.iis.security)