Ryfujk

Sum letters are not two different

Is there hard evidence that the grant peer review system performs significantly better than random?

What initially awakened the Balrog?

Why are vacuum tubes still used in amateur radios?

Would it be easier to apply for a UK visa if there is a host family to sponsor for you in going there?

Central Vacuuming: Is it worth it, and how does it compare to normal vacuuming?

AppleTVs create a chatty alternate WiFi network

Misunderstanding of Sylow theory

One-one communication

If Windows 7 doesn't support WSL, then what is "Subsystem for UNIX-based Applications"?

What is an "asse" in Elizabethan English?

What is the chair depicted in Cesare Maccari's 1889 painting "Cicerone denuncia Catilina"?

Dynamic filling of a region of a polar plot

Lagrange four-squares theorem --- deterministic complexity

Do I really need to have a message in a novel to appeal to readers?

How could we fake a moon landing now?

Why can't I install Tomboy in Ubuntu Mate 19.04?

What's the difference between the capability remove_users and delete_users?

Significance of Cersei's obsession with elephants?

Semigroups with no morphisms between them

What's the point of the test set?

Is multiple magic items in one inherently imbalanced?

The Nth Gryphon Number

Flight departed from the gate 5 min before scheduled departure time. Refund options

Can't get client to Authenticate with IIS over Kerberos

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}

2

1

WHAT I WANT:
An App running on an IIS Server
SQL running on SQLServer

And my user running the site on thier machine and connecting to SQL using their credentials.

WHAT I HAVE SET UP:
I have 3 machines 1 running AD (ADMachine), 1 running SQL Server (mySQLSERVER) and one running IIS (MyIIS).

I have a site on IIS running under the Default Website which navigates to http://MySite/MyApp

I have an app pool with a custom identify of MyDomainMyServiceUser

have set up 2 SPN's using
setspn -a HTTP/mySite MyDomainMyServiceUser
setspn -a HTTP/mySite/MyApp MyDomainMyServiceUser

MY ISSUE:
Error: Login failed for user 'NT AUTHORITYANONYMOUS LOGON'
on the page that connects to SQL

I have set up this test page on my site, and am getting an Authentication Method of Negotiate(NTLM) and not Negotiate(Kerberos)
http://blogs.msdn.com/b/friis/archive/2013/01/08/asp-net-authentication-test-page.aspx

To confuse matters even more, Kerberos is correctly used when fiddler is open, and stops being used when fiddler is closed.

windows authentication kerberos iis-8

share|improve this question

edited Jan 2 '18 at 22:01

Todd Wilcox

2,47421529

asked Feb 16 '15 at 15:18

NoreenNoreen

1113

bumped to the homepage by Community♦ 6 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Have you run the DelegConfig utility? blogs.msdn.com/b/chaun/archive/2013/09/15/…
  
  – Greg Askew
  Feb 16 '15 at 15:38
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I have tried, but it doesn't seem to work, all the documentation is for lower versions of IIS than 8 so not sure if that is why.
  
  – Noreen
  Feb 16 '15 at 15:39
  

  
  
  
  

add a comment | 

2

1

WHAT I WANT:
An App running on an IIS Server
SQL running on SQLServer

And my user running the site on thier machine and connecting to SQL using their credentials.

WHAT I HAVE SET UP:
I have 3 machines 1 running AD (ADMachine), 1 running SQL Server (mySQLSERVER) and one running IIS (MyIIS).

I have a site on IIS running under the Default Website which navigates to http://MySite/MyApp

I have an app pool with a custom identify of MyDomainMyServiceUser

have set up 2 SPN's using
setspn -a HTTP/mySite MyDomainMyServiceUser
setspn -a HTTP/mySite/MyApp MyDomainMyServiceUser

MY ISSUE:
Error: Login failed for user 'NT AUTHORITYANONYMOUS LOGON'
on the page that connects to SQL

I have set up this test page on my site, and am getting an Authentication Method of Negotiate(NTLM) and not Negotiate(Kerberos)
http://blogs.msdn.com/b/friis/archive/2013/01/08/asp-net-authentication-test-page.aspx

To confuse matters even more, Kerberos is correctly used when fiddler is open, and stops being used when fiddler is closed.

windows authentication kerberos iis-8

share|improve this question

edited Jan 2 '18 at 22:01

Todd Wilcox

2,47421529

asked Feb 16 '15 at 15:18

NoreenNoreen

1113

bumped to the homepage by Community♦ 6 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Have you run the DelegConfig utility? blogs.msdn.com/b/chaun/archive/2013/09/15/…
  
  – Greg Askew
  Feb 16 '15 at 15:38
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I have tried, but it doesn't seem to work, all the documentation is for lower versions of IIS than 8 so not sure if that is why.
  
  – Noreen
  Feb 16 '15 at 15:39
  

  
  
  
  

add a comment | 

WHAT I WANT:
An App running on an IIS Server
SQL running on SQLServer

And my user running the site on thier machine and connecting to SQL using their credentials.

WHAT I HAVE SET UP:
I have 3 machines 1 running AD (ADMachine), 1 running SQL Server (mySQLSERVER) and one running IIS (MyIIS).

I have a site on IIS running under the Default Website which navigates to http://MySite/MyApp

I have an app pool with a custom identify of MyDomainMyServiceUser

have set up 2 SPN's using
setspn -a HTTP/mySite MyDomainMyServiceUser
setspn -a HTTP/mySite/MyApp MyDomainMyServiceUser

MY ISSUE:
Error: Login failed for user 'NT AUTHORITYANONYMOUS LOGON'
on the page that connects to SQL

I have set up this test page on my site, and am getting an Authentication Method of Negotiate(NTLM) and not Negotiate(Kerberos)
http://blogs.msdn.com/b/friis/archive/2013/01/08/asp-net-authentication-test-page.aspx

To confuse matters even more, Kerberos is correctly used when fiddler is open, and stops being used when fiddler is closed.

windows authentication kerberos iis-8

share|improve this question

edited Jan 2 '18 at 22:01

Todd Wilcox

2,47421529

asked Feb 16 '15 at 15:18

NoreenNoreen

1113

share|improve this question

edited Jan 2 '18 at 22:01

Todd Wilcox

2,47421529

asked Feb 16 '15 at 15:18

NoreenNoreen

1113

share|improve this question

edited Jan 2 '18 at 22:01

Todd Wilcox

2,47421529

asked Feb 16 '15 at 15:18

NoreenNoreen

1113

edited Jan 2 '18 at 22:01

Todd Wilcox

2,47421529

edited Jan 2 '18 at 22:01

Todd Wilcox

2,47421529

asked Feb 16 '15 at 15:18

NoreenNoreen

1113

asked Feb 16 '15 at 15:18

NoreenNoreen

1113

1 Answer
1

active

oldest

votes

0

Windows design issue, it's a negotiation issue, you can go for Kerberos only in authentication(and adapt the clients to that) or configure IIS for both. An extensive guide has been published here http://blogs.msdn.com/b/chiranth/archive/2014/04/17/setting-up-kerberos-authentication-for-a-website-in-iis.aspx

share|improve this answer

edited Feb 16 '15 at 16:11

answered Feb 16 '15 at 15:25

Alex HAlex H

1,713918

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  To add insult to injury my site works correctly if I have fiddler open. I need the authentication to be Kerberos in order for this to work.
  
  – Noreen
  Feb 16 '15 at 15:34
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  This covers IIS 6 and IIS 5, I am using IIS 8
  
  – Noreen
  Feb 16 '15 at 15:40
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  blogs.msdn.com/b/chiranth/archive/2014/04/17/… just put it to negotiate afterwards. It's for IIS 7/ 7.5 from what I've seen but you will have no issues for 8.
  
  – Alex H
  Feb 16 '15 at 16:08
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Here you can see some troubleshooting tips developers.de/blogs/damir_dobric/archive/2009/08/16/….
  
  – Alex H
  Feb 16 '15 at 16:10
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f668068%2fcant-get-client-to-authenticate-with-iis-over-kerberos%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

0

Windows design issue, it's a negotiation issue, you can go for Kerberos only in authentication(and adapt the clients to that) or configure IIS for both. An extensive guide has been published here http://blogs.msdn.com/b/chiranth/archive/2014/04/17/setting-up-kerberos-authentication-for-a-website-in-iis.aspx

share|improve this answer

edited Feb 16 '15 at 16:11

answered Feb 16 '15 at 15:25

Alex HAlex H

1,713918

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  To add insult to injury my site works correctly if I have fiddler open. I need the authentication to be Kerberos in order for this to work.
  
  – Noreen
  Feb 16 '15 at 15:34
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  This covers IIS 6 and IIS 5, I am using IIS 8
  
  – Noreen
  Feb 16 '15 at 15:40
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  blogs.msdn.com/b/chiranth/archive/2014/04/17/… just put it to negotiate afterwards. It's for IIS 7/ 7.5 from what I've seen but you will have no issues for 8.
  
  – Alex H
  Feb 16 '15 at 16:08
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Here you can see some troubleshooting tips developers.de/blogs/damir_dobric/archive/2009/08/16/….
  
  – Alex H
  Feb 16 '15 at 16:10
  

  
  
  
  

add a comment | 

0

Windows design issue, it's a negotiation issue, you can go for Kerberos only in authentication(and adapt the clients to that) or configure IIS for both. An extensive guide has been published here http://blogs.msdn.com/b/chiranth/archive/2014/04/17/setting-up-kerberos-authentication-for-a-website-in-iis.aspx

share|improve this answer

edited Feb 16 '15 at 16:11

answered Feb 16 '15 at 15:25

Alex HAlex H

1,713918

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  To add insult to injury my site works correctly if I have fiddler open. I need the authentication to be Kerberos in order for this to work.
  
  – Noreen
  Feb 16 '15 at 15:34
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  This covers IIS 6 and IIS 5, I am using IIS 8
  
  – Noreen
  Feb 16 '15 at 15:40
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  blogs.msdn.com/b/chiranth/archive/2014/04/17/… just put it to negotiate afterwards. It's for IIS 7/ 7.5 from what I've seen but you will have no issues for 8.
  
  – Alex H
  Feb 16 '15 at 16:08
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Here you can see some troubleshooting tips developers.de/blogs/damir_dobric/archive/2009/08/16/….
  
  – Alex H
  Feb 16 '15 at 16:10
  

  
  
  
  

add a comment | 

Windows design issue, it's a negotiation issue, you can go for Kerberos only in authentication(and adapt the clients to that) or configure IIS for both. An extensive guide has been published here http://blogs.msdn.com/b/chiranth/archive/2014/04/17/setting-up-kerberos-authentication-for-a-website-in-iis.aspx

share|improve this answer

edited Feb 16 '15 at 16:11

answered Feb 16 '15 at 15:25

Alex HAlex H

1,713918

share|improve this answer

edited Feb 16 '15 at 16:11

answered Feb 16 '15 at 15:25

Alex HAlex H

1,713918

answered Feb 16 '15 at 15:25

Alex HAlex H

1,713918

answered Feb 16 '15 at 15:25

Alex HAlex H

1,713918