Kerberos: connection from win app running from IIS to SQL failed

Question

I have an IIS web-application with Windows authentication and impersonation. This application connects to SQL server. In this case Kerberos works fine.

But there is a problem. Web-application runs windows application (COM), which also connects to the SQL server. Windows application runs with IIS app user credentials and impersonates current site user to connect to SQL server.

scheme: http://i.stack.imgur.com/2cgv7.png

When delegation for IIS user is set to "Trust this computer for delegation to any service" everything works fine. But I can't use this type of delegation according to security requirements.

When I set delegation to "Specific services" and choose MSSQLSvc SPN, connection from windows application fails with "ANONIMOUS" fault. WireShark shows "KRB5KDC_ERR_BADOPTION" packet.

What I'm doing wrong?

Is the application pool identity a user or computer account? — Greg Askew, Nov 22 '12 at 17:19
Pool identity is a user account. And he has a valid SPNs to get delegation-level token of siteuser — Mikhail Kislitsyn, Nov 22 '12 at 19:16
Probably an issue of missing or incorrect SPN's. You may want to download and setup the DelegConfig web application. It does a good job of analyzing if the delegation is configured correctly, including to the back end servers. — Greg Askew, Nov 23 '12 at 04:19
Yes, I've used it. DelegConfig shows me that Kerberos configuration done perfectly. — Mikhail Kislitsyn, Nov 23 '12 at 09:13
If you can access the backend SQL server using DelegConfig, Kerberos is working. It may be that the COM app was not designed to use Constrained Delegation. How old is it? — Greg Askew, Nov 23 '12 at 15:55
I think, I'm missing some SPN for that COM application. With "any service" it's works. — Mikhail Kislitsyn, Nov 24 '12 at 18:01
That sounds curiously "unrestrained", as in not Constrained Delegation. ;-) — Greg Askew, Nov 24 '12 at 21:06
I've done it. There was a problem in our web-application. We had run COM-Server under the "Win32API.LogonUser" token. Now we create COM-server by app-pool user and so Constrained Delegation works. . — Mikhail Kislitsyn, Dec 07 '12 at 14:05

Kerberos: connection from win app running from IIS to SQL failed

0 Answers0