Kerberos Delegation win2k3 AD/IIS/SQLSERVER seperate machines

We have 3 seperate machines. All win2k3. One is the dc with ad, one with an
issserver and one with a sqlserver 2000. The isserver is configured with
"Integrated security". We want only domain users to get on the local website
and to have their credentials impersonated to the sqlserver that also
checkes the accounts.
I'm trying for a few days now, but i can't get this security model to work.
I use this msdn document for troubleshooting:
http://www.microsoft.com/technet/pr...y/tkerbdel.mspx
I've been searching google for the error: Login failed for user '(null)'.
Reason: Not associated with a trusted SQL Server connection
Nothing helps.
So far i checked all spn's for the 3 machines, made sure the machines were
trusted for delegation, made sure the users are ok for delegation, added the
correct logons on the sqlserver. edited the machine.config with impersonate
= true. tried various connection strings including trusted_connection=yes
and integrated security=SSPI.
Any suggestion are appriciated..Follow the tshooting steps in this article.
319723 INF: SQL Server 2000 Kerberos support including SQL Server virtual
http://support.microsoft.com/?id=319723
The three tools you need to resolve/tshoot this are:
1. Kerbtray
2. Network Monitor
3. Netdiag
You'll want to enable Kerberos logging on IIS as well.
You need to first make sure a web client can authenticate to IIS via
Kerberos. If this isn't working, (this is the first hop), then everything
else
will fail.
Hope this helps.
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||Well so far i got the Kerberos to the IIS server working.
The test page gives me Negotiate and a domain username when i open it from a
remote machine.
The SQLServer won't get the Kerberos ticket though.
On my IIS machine i see the following tickets:
host/iisserver.domain.local
krbtgt/domain.local
So that should be ok i guess.
The SQL Server is upgraded with SP3 and on tcp/ip connection only.
I set the spn MSSQLSvc/sqlserver.domain.local:1433, though i presume that's
not neccesary, it runs on a local admin account and is the only one in the
domain.
I gave domain users full control on all tables for testing ...
Someone some suggestion how to correctly debug the connection between the
IIS end the SQL server?
"Kevin McDonnell [MSFT]" <kevmc@.online.microsoft.com> schreef in bericht
news:EcrzgqQGFHA.1136@.TK2MSFTNGXA02.phx.gbl...
> Follow the tshooting steps in this article.
> 319723 INF: SQL Server 2000 Kerberos support including SQL Server virtual
> http://support.microsoft.com/?id=319723
> The three tools you need to resolve/tshoot this are:
> 1. Kerbtray
> 2. Network Monitor
> 3. Netdiag
> You'll want to enable Kerberos logging on IIS as well.
> You need to first make sure a web client can authenticate to IIS via
> Kerberos. If this isn't working, (this is the first hop), then everything
> else
> will fail.
> Hope this helps.
> Kevin McDonnell
> Microsoft Corporation
> This posting is provided AS IS with no warranties, and confers no rights.
>
>|||Yes. Check the DC logs for errors like duplicate SPN's. The problem with
this message is that it doesn't tell you
where the duplicates are or with what account.
To do some more digging.
There's also a quick query you can run to check for duplicate spn's.
ldifde -d "CN=Users,DC=<betaland>" -l servicePrincipalName -F
<NewoutputUsers>.txt This syntax creates a file named NewoutputUsers.txt
that contains information that is similar to the output in the "Domain
level
output of NewouputUsers.txt" section in this article.
Then check the output for multiple references to your SQL Server hostname.
Last step is to make a network trace and look for Kerberos failures. Run
the trace from IIS and capture all the traffic to SQL.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.

Keeping IIS and SQL Server on seperate boxes

Hi,
I have a problem in that I have one server with IIS and another with SQL
Server 2000. I would like to run SSRS from the SQL Server and then store all
my pages on the IIS server. Is there a way of doing this. Only installing
SSRS on the SQL Server and then everything else on the IIS server. I have
installed SSRS on a server that has both SQL Server and IIS on it and no
problems. The thing is I need the Virtual Directories on the IIS server and
not the SQL Server box. I am not allowed to install SSRS on the IIS box as
this would mean another license which my company is not prepared to do.
Please any help on how this could be done would be greatly appreciated.
ThanksThe license is clear. Anywhere you install the server component of RS you
need a license. What you are asking not only can not be done from a
licensing perspective but RS itself is an asp.net application. The SQL
Server DB is an object repository and can reside either on the same box or
on another box. However, if it is on another box you need a server license.
You didn't say if you are doing an intranet or internet application. If you
are not doing a processor license (which is what you would have to do if it
was for the internet but if intranet is optional) but instead have CALs.
Assuming the people accessing it already have CALs (in my case they do) then
all you need to do is buy the server license. For standard addition it is
very inexpensive to buy another server license. Even for enterprise
(assuming you have the CALs, a very important point) it is still much less
expensive than any other solution I am aware of.
Bruce L-C
"PLSH" <PLSH@.discussions.microsoft.com> wrote in message
news:AC4DF146-4A24-4A12-8440-6D6230AD6C4E@.microsoft.com...
> Hi,
> I have a problem in that I have one server with IIS and another with SQL
> Server 2000. I would like to run SSRS from the SQL Server and then store
all
> my pages on the IIS server. Is there a way of doing this. Only installing
> SSRS on the SQL Server and then everything else on the IIS server. I have
> installed SSRS on a server that has both SQL Server and IIS on it and no
> problems. The thing is I need the Virtual Directories on the IIS server
and
> not the SQL Server box. I am not allowed to install SSRS on the IIS box as
> this would mean another license which my company is not prepared to do.
> Please any help on how this could be done would be greatly appreciated.
> Thanks