I've found the following whitepaper from MS to be helpful: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technolog ies/security/tkerbdel.mspx
Also, there are several articles on MS's site for troubleshooting Kerberos: http://www.google.com/search?&q=site%3Amicrosoft%2Ecom+troubleshoot+kerb eros Granted these are more step-by-step walkthroughs than actually pinpointing the problem, but, since there are so many places that Kerberos can fail, it's hard to determine the exact POF in any particular case (at least that's been my experience). Some helpful things I've learned getting Kerberos to work: * Have IIS (meaning the App Pool in IIS6) and SQL run under (limited access) domain accounts instead of system accounts * Audit success AND failure security events on the servers * Use SQL Profiler to make sure SQL is using TCP/IP and not named pipes (this one had me stuck for 2 days) and to verify the account accessing SQL * Turn on IIS Logging for the web site to see which account is authenticating each request Good Luck! - You're gonna need it ;) Don -----Original Message----- From: Discussion of advanced .NET topics. [mailto:[EMAIL PROTECTED] On Behalf Of Erick Thompson Sent: Thursday, June 01, 2006 3:34 PM To: [email protected] Subject: [ADVANCED-DOTNET] How to debug Kerberos delegation I have a web services based application that is using WSE3 and Kerberos for security. The application uses Kerb delegation to go from the web service to a database server. Getting delegation to work correctly is a headache, mainly because there are no tools to see what is failing, at least none that I know of. The framework, when using default credentials, simply returns an empty credential, so I have no wait to properly debug problems when the system changes (server rollovers, etc). Does anyone know of a good way to debug this problem? Thanks, Erick =================================== This list is hosted by DevelopMentor® http://www.develop.com View archives and manage your subscription(s) at http://discuss.develop.com
