Re: Constrained Delegation Problem: SQL partially delegated

Glad you got it working. Kerberos service tickets are based on the SPN (as
you have discovered). the SPN contains a name (NetBIOS, FQDN etc) only. It
does not differentiate between server technologies (e.g. ASP and ASP.NET
pages) for example. If your ASP page is working fine, but your ASP.NET one
isn't, then something else is the matter.

Cheers
Ken

--
My IIS Blog: www.adOpenStatic.com/cs/blogs/ken


"JimLad" <jamesdbirch@xxxxxxxxxxx> wrote in message
news:1163783113.460418.276160@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Apologies! Turns out my ASP code was pointing at one db server and
asp.net was pointing at a different db server. Sorry!!

James

JimLad wrote:

Hi,

I have set up delegation and IT WORKS to link through to a back end SQL
server.

However for security reasons I want to limit the services that can be
delegated to to MSSQLSvc on the db server. An SPN has been set up for
the SQL server account on port 1433.

When I swap to constrained delegation a simple asp page with ADO still
works, but my main app doesn't. The technologies used are ASP.NET 1.1
(ADO.NET), ASP (ADO), and SQLXML virtual directory.

I assume that either I need to enable another port or add another
service. Can someone enlighten me?

Cheers,

James



.

Relevant Pages

  • Re: Single Sign On using NTLM
    ... You should be able to Kerb auth from your client to your server by specifying an SPN on the service account that runs the service and then specifying that SPN in your target parameter for your NegotiateStream. ... Getting this working can be a bit of a pain and will likely require that you read up on the TechNet docs on implementing constrained delegation and protocol transition. ...
    (microsoft.public.dotnet.security)
  • Re: Delegation: IIS Server setup in typical 3-tier scenario.
    ... doesn't already have an SPN and/or you need to change the existing SPN. ... Kerberos is being used - it just means that an API is used to determine what ... so I'm trying to set up delegation. ... Authenticated using NTLM not Kerberos on the Web Server. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Constrained delegation question!
    ... You are right there is a service called HOST on the target server which I ... You should not need to create a new SPN though. ... Active Directory under the delegation tab, ... For allowing Service Control Manager, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Constrained delegation question!
    ... You are right there is a service called HOST on the target server which I ... You should not need to create a new SPN though. ... Active Directory under the delegation tab, ... For allowing Service Control Manager, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: SPN for SSL over common name
    ... That SPN should be registered under the SQL ... Server's service account and *removed* from the SQL Server's ... Lastly, since the SQL Server is not being used for delegation anywhere, it's ...
    (microsoft.public.inetserver.iis.security)