Credential delegation and IIS Kerberos authentication

crisag — Tue, 26 Sep 2006 01:29:00 GMT

I’m back. I’d like to share with you some tips on how to enable Kerberos authentication and credential delegation on IIS6.0. I’ve been beating my head against the wall to see this thing working on one of our customers.

I didn’t know how much this kind of integrated authentication with Kerberos has to do with DNS and reverse resolution. When you find yourself with problems setting up Kerberos, ALWAYS check the DNS before start.

One good KB article showing how to setup Kerberos and delegation is

Kerberos authentication and troubleshooting delegation issues http://support.microsoft.com/default.aspx?scid=kb;en-us;907272

If you are using ServerXMLHttp COM component as my customer was, keep in mind that you also need setup the WinInet proxy using proxycfg. The following articles show how to do that

How To Use Kerberos with the ServerXMLHTTP Component in MSXML http://support.microsoft.com/default.aspx?scid=kb;en-us;314404
You may need to run the Proxycfg tool for ServerXMLHTTP to work http://support.microsoft.com/kb/289481/EN-US/

Have you followed all the instructions and Kerberos is not working? I have another tip:

Call PSS and ask them for a copy of the DelegConfig Tool. It’s a great tool developed by Brian Murphy-Booth that check all the related settings to have Kerberos and delegation working.

Best Regards, Cris.

This posting is provided "AS IS" with no warranties, and confers no rights.

Cristiano WebLog : Internet Information Server

Credential delegation and IIS Kerberos authentication