Re: Kerberos Problem with App Pool running as Domain Account

Thank you for the response.

There are some authentication types of "Negotiate" however, there are no
duplicate SPNs, and as far as I can tell everything is setup as it should be.
My only thought might be that the application pool is running under a domain
account, perhaps IIS itself has to as well (instead of the IUSR_IISSERVER
account). But is this even supported, or likely to be the cause of the
problem?

Here is an error from the security log:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 6/23/2008
Time: 10:36:56 AM
User: NT AUTHORITY\SYSTEM
Computer: IISSERVER
Description:
Logon Failure:
Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: IISSERVER
Status code: 0xC000040A
Substatus code: 0x0
Caller User Name: IISSERVER$
Caller Domain: TIB
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1048
Transited Services: -
Source Network Address: -
Source Port: -

And here's the negotiate authentication which occurs after:

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 528
Date: 6/23/2008
Time: 10:36:56 AM
User: DOMAIN\USER
Computer: IISSERVER
Description:
Successful Logon:
User Name: user
Domain: DOMAIN
Logon ID: (0x0,0xA2489CC)
Logon Type: 4
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: IISSERVER
Logon GUID: {e241c991-82ad-2241-b533-510eff0f2c75}
Caller User Name: IISSERVER$
Caller Domain: DOMAIN
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 840
Transited Services: -
Source Network Address: -
Source Port: -

Any further help would be appreciated.

"Ken Schaefer" wrote:

a) you need to make sure that the browser is authenticating using Kerberos
(and not NTLM). Check the Windows Event logs for this

b) you need to remove any duplicate SPNs you might have registered under the
original computer account

http://adopenstatic.com/faq has a list of IIS and Kerberos articles that
explain everything you ened to do/check.

Cheers
Ken

"VC" <VC@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:394285B1-438C-42D7-8EA8-D35CFAF63CD5@xxxxxxxxxxxxxxxx
Good Morning,

I have multiple applications running with integrated security to connect
to
a SQL back-end database. Everything works fine on our production servers
which use the default system accounts for the Application Pool. However,
I
had to change this to use a domain account because our DR server needed to
work with the same DNS Alias which conflicted with the already registered
SPNs.

As recommended, on our DR server, I began testing by changing the
Application Pool to run under a domain account. I then registered the
following SPNs:

setspn –A HTTP/iisserver domain\user
setspn –A HTTP/iisserver.domain.com domain\user
setspn –A MSSQLSvc/sqlserver:1433 domain\user

Additionally, I set the domain\user account to "Account is trusted for
delegation" and the iiserver computer account to "Trust computer for
delegation". Still, I receive the following error when connecting to the
database:

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

This works fine on the live server, so I'm assuming this is related to
changing the Application Pool to run under a domain account. Any
suggestions
would be greatly appreciated.

Thank you


.

Relevant Pages

  • Re: Authentication on AS
    ... The actual NT account being used is the SQL service account. ... domain account in common with AS and the RDBMS machines. ... linked server from the RDBMS machine itself? ...
    (microsoft.public.sqlserver.olap)
  • Send SMTP mail permission problem
    ... domain account is assigned to the local administrator account. ... SMTP mail messages to be sent through an SMTP server, ... The machine "owner" user domain account can not run the custom application ...
    (microsoft.public.windowsxp.general)
  • Re: Sql Service Account Password not retained through reboots
    ... The server is a production server that was recently commissioned. ... The domain account is a dedicated account for this server. ...
    (microsoft.public.sqlserver.server)
  • Re: Services starting with Local Service Account not working as expected...
    ... We believe the problem is the print service utility that we wrote is not ... being allowed to access that print server on the other server. ... I just read about the "NTSUTHORITY/NetworkService" account. ... account is treated like a domain account. ...
    (microsoft.public.win2000.advanced_server)
  • Re: HTTP Access to SSAS with anonymous even possible?
    ... tell SSAS is that it should serve up this data to an anonymous caller. ... made a domain account, had IIS run under that domain account, then added ... server, but a compromised domain account leaves all the servers it's ...
    (microsoft.public.sqlserver.olap)