Re: How to set spn to use kerberos Authentication in IIS7 ?

You would set the SPN to be the hostname, and you would register it under the user account that is running the application pool.

Please see Kerberos and IIS FAQ here (part 2 on SPNs) at www.adopenstatic.com/faq

Cheers
Ken

"vx" <vx@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:BB732A46-897F-4046-A69A-515C73529772@xxxxxxxxxxxxxxxx
How to set spn to use kerberos Authentication in IIS7 when site hostname is
different to default computer netbios name,and username that runs
application pool is different to network_service?

.

Relevant Pages

  • Re: Kerberos Authentication to VWMare...
    ... A Kerberos Error Message was received: ... Server Realm: ... We have checked the SPN using SetSPN with -L option and see that both MOSS ...
    (microsoft.public.windows.server.security)
  • Re: Delegation: IIS Server setup in typical 3-tier scenario.
    ... doesn't already have an SPN and/or you need to change the existing SPN. ... Kerberos is being used - it just means that an API is used to determine what ... so I'm trying to set up delegation. ... Authenticated using NTLM not Kerberos on the Web Server. ...
    (microsoft.public.inetserver.iis.security)
  • kerberos TGS for an IP address
    ... Vista never uses kerberos for servers which name is specified by an IP address, is that right? ... By using the work ASKS I would like to stress the fact XP always asks for a TGS, which may not be available because of an appropriate SPN is missing. ...
    (microsoft.public.windows.vista.security)
  • Re: IIS 6 Integrated Authentication and IE 6 - security credentials seem to not get passed from brow
    ... Kerberos fails and you must force IIS to use ... I also tried setting the Application Pool Identity for the entire web site ... >> associated with the default Network Service identity then the request ...
    (microsoft.public.inetserver.iis.security)
  • Re: kerberos logon to IP address
    ... So we are going to create SPN and enable kerberos for the alias. ... the Vista client not even asks for TGT - once again as observed by using Wireshark ...
    (microsoft.public.windows.vista.security)