Also check to make sure the SPNs are correct for the various services... Don
-----Original Message----- From: Discussion of advanced .NET topics. [mailto:[EMAIL PROTECTED] On Behalf Of Erick Thompson Sent: Thursday, June 01, 2006 4:23 PM To: [email protected] Subject: Re: [ADVANCED-DOTNET] How to debug Kerberos delegation I've done the step by step walkthrough, and even got it working, but now I need to change servers and applications, and my steps don't seem to work. I'll read these documents and see if I'm missing something. Thanks, Erick > -----Original Message----- > From: Discussion of advanced .NET topics. > [mailto:[EMAIL PROTECTED] On Behalf Of Don Stanley > Sent: Thursday, June 01, 2006 1:53 PM > To: [email protected] > Subject: Re: [ADVANCED-DOTNET] How to debug Kerberos delegation > > I've found the following whitepaper from MS to be helpful: > > http://www.microsoft.com/technet/prodtechnol/windowsserver2003 > /technolog > ies/security/tkerbdel.mspx > > Also, there are several articles on MS's site for troubleshooting > Kerberos: > > http://www.google.com/search?&q=site%3Amicrosoft%2Ecom+trouble > shoot+kerb > eros > > Granted these are more step-by-step walkthroughs than > actually pinpointing the problem, but, since there are so > many places that Kerberos can fail, it's hard to determine > the exact POF in any particular case (at least that's been my > experience). > > Some helpful things I've learned getting Kerberos to work: > > * Have IIS (meaning the App Pool in IIS6) and SQL run under (limited > access) domain accounts instead of system accounts > * Audit success AND failure security events on the servers > * Use SQL Profiler to make sure SQL is using TCP/IP and not > named pipes (this one had me stuck for 2 days) and to verify > the account accessing SQL > * Turn on IIS Logging for the web site to see which account > is authenticating each request > > Good Luck! - You're gonna need it ;) > > Don > > -----Original Message----- > From: Discussion of advanced .NET topics. > [mailto:[EMAIL PROTECTED] On Behalf Of > Erick Thompson > Sent: Thursday, June 01, 2006 3:34 PM > To: [email protected] > Subject: [ADVANCED-DOTNET] How to debug Kerberos delegation > > I have a web services based application that is using WSE3 > and Kerberos for security. The application uses Kerb > delegation to go from the web service to a database server. > Getting delegation to work correctly is a headache, mainly > because there are no tools to see what is failing, at least > none that I know of. The framework, when using default > credentials, simply returns an empty credential, so I have no > wait to properly debug problems when the system changes > (server rollovers, etc). > Does anyone know of a good way to debug this problem? > > Thanks, > Erick > > =================================== > This list is hosted by DevelopMentor(r) http://www.develop.com > > View archives and manage your subscription(s) at > http://discuss.develop.com > =================================== This list is hosted by DevelopMentor(r) http://www.develop.com View archives and manage your subscription(s) at http://discuss.develop.com =================================== This list is hosted by DevelopMentor® http://www.develop.com View archives and manage your subscription(s) at http://discuss.develop.com
