Kerberos in Cross-Forest trust - Fails back to NTLM or Cannot

I established a Windows 2003 level cross-forest trust between
domain.local and domain.com .
I cannot get domain.com to allow kerberos authenication using a
domain.local user.
I am using SQL Server 2005 w/SQL Server Management Studio as the
application.
I can test which authentication scheme (NTLM or Kerberos) is used by
issuing this query:
select auth_scheme from sys.dm_exec_connections where
session_id=@.@.spid
I've tested a few different scenarios with user, workstation and
server:
USER WORKSTATION SERVER Result
domain.local domain.local domain.local KERBEROS
domain.local domain.local domain.com Cannot generate SSPI Context
domain.local domain.com domain.com NTLM
domain.com domain.com domain.com KERBEROS
So basically, using the domain.local user, I can connect between two
domain.local servers using KERBEROS, between two domain.com servers
using NTLM, but can't connect from domain.local to domain.com with the
error "Cannot Generate SSPI Contect".
I've gone through tons of online blogs, whitepapers, etc. I have
checked the SPNs, ensured the accounts and computers are trusted for
delegation, checked the firewall for blocked traffic...
Any ideas?None?
On Nov 28, 5:01 pm, Neufusion <mikeymil...@.gmail.com> wrote:
> I established a Windows 2003 level cross-forest trust between
> domain.local and domain.com .
> I cannot get domain.com to allow kerberos authenication using a
> domain.local user.
> I am using SQL Server 2005 w/SQL Server Management Studio as the
> application.
> I can test which authentication scheme (NTLM or Kerberos) is used by
> issuing this query:
> select auth_scheme from sys.dm_exec_connections where
> session_id=@.@.spid
> I've tested a few different scenarios with user, workstation and
> server:
> USER WORKSTATION SERVER Re
sult
> domain.local domain.local domain.local KERBEROS
> domain.local domain.local domain.com Cannot generate SS
PI Context
> domain.local domain.com domain.com NTLM
> domain.com domain.com domain.com KE
RBEROS
> So basically, using the domain.local user, I can connect between two
> domain.local servers using KERBEROS, between two domain.com servers
> using NTLM, but can't connect from domain.local to domain.com with the
> error "Cannot Generate SSPI Contect".
> I've gone through tons of online blogs, whitepapers, etc. I have
> checked the SPNs, ensured the accounts and computers are trusted for
> delegation, checked the firewall for blocked traffic...
> Any ideas?

Keep all servers registered and connected

I have 5 servers in my Server Mgmt Studio divided into 4 groups,

Local

Production

Test

Development

In Sql 2000 Enterprise Manager would put the little green arrow next to your db if it was connected, I noticed that Sql 2005 does do that but it wont allow me to keep all 5 servers connected and I need them all to stay connected.

If I look under Registered Servers it shows all 5 servers there but again only 2 show as connected even if I connect the other ones they dont stay connected. I have deleted the registerd ones and re added them and still no difference.

How can I keep all servers registered and connected and then have them show up on start-up?

Thanks!

Stokh

Launch Mgmt Studio

In the Registered Servers tool window right-click on the server and select Properties

On the Properties dialog select the Connection Properties tab

Set Connection time-out to 0 (the default is 15 seconds; 0 indicates no time-out).

|||I already did that and it still does the same thing, only shows 2 servers registered and doesnt keep the other 3 connected|||I suggest you file a bug using the Product Feedback Center: http://lab.msdn.microsoft.com/productfeedback/Default.aspx.|||I would also like to complain about this new 2005 behavior. As a DBA managing dozens of servers, it is ridiculous to keep jumping through the connection hoops in 2005 whenever I switch server context. It's hard to believe MS could screw up something so basic... and something that worked perfectly well in 2000.|||The best thing to do is search the Product Feedback Center for the issue and vote on it. In SP2 we are targeting many of the annoyances of the Mgmt Studio but we need your votes. The voting system let's us know what issues are causing pain for people and those tend to float to the top part of the list.