Re: integrated authentication

Hi

I have try all this but .. I think that this is IIS authentication who is
not functional.
When the client connetct to http://app.mydomain.com I have a popup asking
for user and password. With the only "basic authentication" the user can
connect with "mydomain\user" synthax, with only "integrated" authentication,
I also have the same popup but the same user with the same synthaxe of login
can not connect. I with my first problem is IIS delegation of
authentication...
How to track this ?

IIS run on a server and SQL on a other, this two servers as member of the
domain and the two server have "trust the computer for delagation" checked.
The account service for IIS application pool and the account service for SQL
service have an association with a SPN and also have the "account is trusted
for delegation" checked.

thanks

"Robert Ginsburg" <robert.ginsburg@xxxxxxxx> a écrit dans le message de
news: OpwFGgzfGHA.2456@xxxxxxxxxxxxxxxxxxxxxxx
Yes, thats all, so if you have done that and SQL auth is still not
working, try thie recomendations from this kb article
http://support.microsoft.com/?id=319723

"Frédéric de Thysebaert" <frdt@xxxxxxxxxxxxxx> wrote in message
news:uarDPFzfGHA.1456@xxxxxxxxxxxxxxxxxxxxxxx
yes I think that's right for me, ..
To do this I have check the delegation check box on the general tab of
computer object in AD. Is it right ?
Thanks

"Robert Ginsburg" <robert.ginsburg@xxxxxxxx> a écrit dans le message de
news: eNRxU2yfGHA.4900@xxxxxxxxxxxxxxxxxxxxxxx
Have you configured the server as trusted for kerberos delegation ?
"Frédéric de Thysebaert" <frdt@xxxxxxxxxxxxxx> wrote in message
news:OcgmL0vfGHA.1520@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

I have a intranet asp application runing on IIS6. with data on SQL
server runing on an other computer (the two servers are member server
of our active directory domain). Access to the data are based on the
user account who connect to the IIS application.
The application is runing on the port 80 with a host header as
app.mydomain.com (others applications are runing on port 80 without
hostheader).
The application run in an application pool with a domain account from
active directory.
With basic authentication, the user can launch the application and have
access to the data. ( I use impersonate = true in the web.config file)
I try now to activate the integrated authentication .. but nothing is
runing, I always have a popup asking for user and password and the same
user account cant access the application
I had set using the documentation a SPN for the identity runing the
application pool with the tool setspn and the synthaxe setspn -A
HTTP/app.mydomain.com mydomain\myuserapp
I had set the NTAuthenticationProviders to "Negociate,NTLM" within the
right virtual directory and using the script adsutil.vbs
I had restart the iis server (iisreset)

using the authentication & diagnostique tools from microsoft on the web
server and verifying kerberos security I just see " Service principal
name (SPN) for user mydomain\myuserapp' not found in Active Directory"
but with adsiedit on the same account I have a SPN set .. It's the only
one trace i have to debug my authentication problem ..

Do you have some ideas











.

Relevant Pages

  • Re: Basic Authentication + IIS 5 + Windows 2000 + Frontpage 2002 = failure?
    ... Everytime I attempt to login under Basic Authentication, ... IUSR_blah account. ... the anonymous user impersonated by the IIS Server is the ... > Event Viewer Security log. ...
    (microsoft.public.inetserver.iis.security)
  • RE: SOME Users cannot access OWA others do, error HTTP 500
    ... I understand that some account access OWA ... IIS 6.0 compression corruption causes access violations ... compressed copy of the affected files on the SBS server: ...
    (microsoft.public.windows.server.sbs)
  • Re: Basic Authentication fails with Error 401.2 where Integrated s
    ... I didn't realise the Web Sites folder in IIS manager threw up a global ... sure that Basic Authentication is allowed to function on your server. ... ACCOUNTNAME, this is the account that I am trying to grant access to: ... Account: COMPUTERNAME\ACCOUNTNAME Access type: FULL ...
    (microsoft.public.inetserver.iis.security)
  • Re: WM5 can not sync to exchange
    ... I checked all the authentication settings and they are as you requested. ... After running the internet connection wizard I had to uncheck the Require ... On the SBS 2003 Server open the Server Management console. ... Open IIS Manager ...
    (microsoft.public.windows.server.sbs)
  • Re: Basic Authentication fails with Error 401.2 where Integrated s
    ... On the IIS directory security tab, anonymous access is disabled, digest ... authentication is disabled, integrated authentication is disabled and basic ... account created has full permissions for the folder and the file that's in it. ...
    (microsoft.public.inetserver.iis.security)