NTLM and Kerberos

I have a website using Windows Authentication and Delegation to access a
backend SQL Server.

Everything works when I am on the LAN. When I try to access the website
from home I get the Login failed for User NULL...

I am using the same name to access when I am on the LAN as when I am at home
and it resolves to the same IP address.
http://server.domain.com
I have put this into my trusted sites in IE (I have also tried Local
Intranet).
I can see in the event log on the web server that when I am at home it is
using NTLM authentication wheras when I am on the network it is using
Kerberos.
I added the SPN for the FQDN with this:
setspn -A http/sever.domain.com NtDomain\ServerName
(not sure if that is required)
IIS is running under the local system account
I have delegation set to Trust this computer for delegation to any service
(Kerberos only)
The server is Windows 2003
IIS Security is set up for Integrated Windows Authention


The only differences that I can think of are (1) my computer at home is not
a memeber of the domain and (2) I only have port 80 open when I am at home.

Anyone know how to get this to work?





.

Relevant Pages

  • Re: Windows authentication from ASP.net application to Sql Server
    ... | Subject: Re: Windows authentication from ASP.net application to Sql Server ... | server or on the same server with the IIS/ASP.Net? ... Use a single fixed impersonate account, ... | client/server to use restricted kerberos delegation which has critical ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Troubleshoot Security Issues
    ... I just spit out the server variables, Auth_Type did = Negotiate, so I guess ... so I guess the only thing left is delegation... ... Checked the box in IE "Enable Integrated Windows Authentication", ... running under the Localsystem account. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Windows authentication from ASP.net application to Sql Server
    ... with windows authentication and also use windows authenitcation in asp.net ... server or on the same server with the IIS/ASP.Net? ... Use a single fixed impersonate account, ... For general info on ASP.NET delegation: ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: ASP.NET (IIS6) Accessing files on another server
    ... It's likely to be related to configuration of delegation on your Win2003 IIS ... configured to use impersonation and Windows Authentication: ... > How can I configure my application that it works on my W2003/IIS6 server? ...
    (microsoft.public.dotnet.security)
  • Re: Constrained delegation question!
    ... remote server running the services in terms of the security audits on the ... AUTHORITY\ANONYMOUS LOGON event. ... you won't be able to get Kerb delegation to ...
    (microsoft.public.dotnet.framework.aspnet.security)