SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have recently implemented Kerberos in my farm on a very basic level, the need for it was to resolve issues with MAC OS clients so that they would not have to log in each time they hit one of the three web applications we host on our intranet. I setup the SPN's for the web apps service account and also the SQL account that runs the instance of SQL on our cluster. I did not setup delegation on any of the accounts, thats another part of Kerberos i'm still trying to wrap my head around to better if anyone has any good reasons for delegation i'd like to hear them.

Aside from all of that, things are working good after i switched over the web apps from NTLM to Kerberos, i am able to see in the logs that the clients are using Kerberos to login...and they are not promopted to provide a password when they go from Intranet to mysites to search center...

However...when they access content that opens in a client side application like excel for example...they are required to if a user is looking at an excel sheet in the office web app and chooses to open in excel, they are prompted to enter a login and password to access the content in the application. This only happens on my MAC clients...i assume that on the PC side of things they are using NTLM in some way.

When i setup the SPNs i did not create an SPN for the service application pool, could this be the reason? Or is it because i dont delegate the accounts i have created spn's for?

If anyone could shed some light on this i could use a better direction to head in as i try to figure this out.


share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.