Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have 3 servers. One running SQL and 2 running Sharepoint. Both Sharepoint servers are acting as WFE's using NLB.

We have 2 Web Applications people.domain.local for our mysites and intranet.domain.local for all the rest of our content. Right now both are running on different application pools but using the same account. I have created an SPNs for the account. HTTP/people, HTTP/people.domain.local, HTTP/intranet, and HTTP/intranet.domain.local

I have added delegation to both WFE's and the application pool account but from the logs it appears that the users are logging in with NTLM still. I have also set the web applications to use Kerberos.

Is there something I am missing?

The part I'm missing.... My users including myself are users on a different domain. When I try to authenticate as a user of the same domain that the servers are part of I don't have any issues. Could this be something wrong with the trust?

share|improve this question

4 Answers 4

Did you also configure the following IIS 7.x setting:

system.webServer/security/authentication/windowsAuthentication

useAppPoolCredentials=True

share|improve this answer
    
I did that in C:\Windows\System32\inetsrv\config\applicationHost.config and still get the same thing. I did an iis reset on both hosts. –  Mark Davis Nov 17 '11 at 19:25
1  
If this is SharePoint 2010 you cannot use Kernel mode AuthN - and useAppPoolCredentials is a kernel mode setting! –  Wictor Wilen MCA MCM MVP Jan 17 '12 at 17:20

Two things to check into:

  1. Make sure that you have a two-way trust between your domains
  2. If you're accessing the servers using FQDN - make sure that that FQDN is in the Intranet sites in IE
share|improve this answer
    
Two-way trust isn't exactly required unless you use BI applications. –  Jussi Palo Jan 24 '12 at 20:53

Kerberos is definitely tricky to get right. I would recommend following the instructions in the following document exactly and in detail. Any small detail can break it and troubleshooting is painful.

http://go.microsoft.com/fwlink/p/?LinkId=196600

Regarding multiple domains, here is what it has to say:

The scenarios in this set of articles about Kerberos authentication require that the SharePoint Server service and external data sources reside in the same Windows domain, which is required for Kerberos constrained delegation. The Kerberos protocol supports two kinds of delegation, basic (unconstrained) and constrained. Basic Kerberos delegation can cross domain boundaries in a single forest, but cannot cross a forest boundary regardless of trust relationship. Kerberos constrained delegation cannot cross domain or forest boundaries in any scenario.

share|improve this answer

In IIS, navigate to your site(s) which has the problem. Click the "Authentication" button. Click on "Windows Authentication" and in the Actions pane, click "Providers". Move Kerberos above NTLM. Now Kerberos will always be tried first and then it will try with NTLM if Kerbeos fails.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.