RE: Windows Authentication in a NT domain vs in an Active Director

From: Kevin McDonnell [MSFT] (kevmc_at_online.microsoft.com)
Date: 02/25/05 

Date: Fri, 25 Feb 2005 01:19:24 GMT

Yes. This is true. Clients capable of Kerberos will attempt to connect via
Kerberos to SQL Server if you're using Windows Authentication.
If the Kerberos attempt fails, the client will use NTLM. We don't log
anything in SQL to tell you that the connection was made via Kerberos or
NTLM.

Yes. Security Delegation is an option to allow credentials to be passed
from one machine to another. This was not possible in an NT 4 domain. The
typical scenario where this is used is a Web Server application that
connects to SQL via Trusted Authentication. The web client is able to
authenticate to IIS via Kerberos, and then make a Kerberos connection to
SQL using the client credentials. The SQL Server has to have the SPN set
by a Domain Admin in order for this to work correctly.

Thanks,

Kevin McDonnell
Microsoft Corporation

This posting is provided AS IS with no warranties, and confers no rights.

Relevant Pages

  • Problems unwrapping SPNEGO token for Single Signon (SSO) in WebLogic Server 8.1.
    ... but cannot get WebLogic to unwrap the SPNEGO token so it authenticates using Kerberos. ... We've tried adding the AllowTGTSessionKey registry key on client and server, but that didn't change it either. ... Enable Integrated Windows Authentication ...
    (comp.protocols.kerberos)
  • Mixed mode AD domain Kerberos/NTML bump heads?
    ... delegation to win 2k sql server. ... the client had been authenticated. ... authentication fails at random for no apparent reason. ...
    (microsoft.public.sqlserver.security)
  • Keberos / NTLM Bug Using Delegation?
    ... delegation to win 2k sql server. ... the client had been authenticated. ... authentication fails at random for no apparent reason. ...
    (microsoft.public.win2000.security)
  • Re: iis problems with some xp clients - kerberos issue?
    ... is the browser even attempting Kerberos Authentication? ... the webserver failing to get a service ticket for the SQL Server etc. ... Check that the site is in IE's Intranet zone (IE doesn't attempt to Kerberos ... Both access SQL ...
    (microsoft.public.inetserver.iis.security)
  • An issue with SQL 2005 and Kerberos...
    ... I am having trouble getting SQL 2005 to authenticate using Kerberos. ... Regardless of what I try the authentication always goes through NTLM. ... We have a test domain setup with a substantial amount of servers. ... all the connections from these SharePoint servers to the SQL Server ...
    (microsoft.public.sqlserver.security)