Service Principal Names for the Services you use need to be fully qualified domain names. If you use netbios then sometimes it will work, sometimes it won't. Also, the DNS settings for the servers need to be right - Kerberos is a little like DTC communication; it needs to be able to reverse-lookup the originating server.
KerbTray and KList are good tools to see what tickets are being granted. Ethereal or NetMon can show you the traffic on your network and you can easily see Kerberos Errors. There's a registry key to show Errors in the event log though I can't find the reference to it this morning. Hope this helps, Ciaran On 01/06/06, Erick Thompson <[EMAIL PROTECTED]> wrote:
I have a web services based application that is using WSE3 and Kerberos for security. The application uses Kerb delegation to go from the web service to a database server. Getting delegation to work correctly is a headache, mainly because there are no tools to see what is failing, at least none that I know of. The framework, when using default credentials, simply returns an empty credential, so I have no wait to properly debug problems when the system changes (server rollovers, etc). Does anyone know of a good way to debug this problem? Thanks, Erick
=================================== This list is hosted by DevelopMentor® http://www.develop.com View archives and manage your subscription(s) at http://discuss.develop.com
