Credential delegation and IIS Kerberos authentication
I’m back. I’d like to share with you some tips on how to enable Kerberos authentication and credential delegation on IIS6.0. I’ve been beating my head against the wall to see this thing working on one of our customers.
I didn’t know how much this kind of integrated authentication with Kerberos has to do with DNS and reverse resolution. When you find yourself with problems setting up Kerberos, ALWAYS check the DNS before start.
One good KB article showing how to setup Kerberos and delegation is
- Kerberos authentication and troubleshooting delegation issues http://support.microsoft.com/default.aspx?scid=kb;en-us;907272
If you are using ServerXMLHttp COM component as my customer was, keep in mind that you also need setup the WinInet proxy using proxycfg. The following articles show how to do that
- How To Use Kerberos with the ServerXMLHTTP Component in MSXML http://support.microsoft.com/default.aspx?scid=kb;en-us;314404
- You may need to run the Proxycfg tool for ServerXMLHTTP to work http://support.microsoft.com/kb/289481/EN-US/
Have you followed all the instructions and Kerberos is not working? I have another tip:
Call PSS and ask them for a copy of the DelegConfig Tool. It’s a great tool developed by Brian Murphy-Booth that check all the related settings to have Kerberos and delegation working.
Best Regards, Cris.
This posting is provided "AS IS" with no warranties, and confers no rights.
