Tell me more ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
up vote 2 down vote favorite

I am trying to get a better understanding of Kerberos/NTLM in my setup. We have 2 WFE,1 backend and separate SQL cluster in domain1. The site has anonymous access enabled. We have another domain (domain2) that has a DNS entry for our site, and uses NAT to get back to the WFE on domain1.

Im logged into domain1 and when I access the site I can see Kerberos as the auth method in the event log.

When im on a pc on domain2 and I access the site (unauthenticated at first), then when I login using my domain1 account it recognises me ok. However, if I look at the event log there is no mention of kerberos, only NTLM. I would now expect a double hop issue when I try to open a word doc, in that it will ask me for my credentials again. It is not and the doc opens. Can someone clear up this last point for me please?

share|improve this question
Probably depends on a few things, is the web application actually configured for Kerberos or NTLM as its authentication method? I would guess that the site is using NTLM and that there is a trust relationship between these domains and users in domain 2 are in fact accessing the site with NTLM as are the users in domain 1. – pigeon Sep 30 '12 at 6:38
The site is configured for kerberos (Negotiate). – dmce Sep 30 '12 at 10:12

2 Answers

up vote 5 down vote

A computer in domain2 will not participate in Kerberos in domain1 if there is no trust relation configured between both domains. The fallback is NTLM. To see if kerberos is used you can check with KLIST from a command line (in windows 7 for all other OS user kerbtray from the Windows Resource Kits Tools).

Getting a Word document from SharePoint will never cause a double hop as you only need to authenticate as yourselves to the WFE. The WFE don't have the need to authenticate to another server as you (that would be the double hop).

The double hop issue comes when you want the WFE to send a request to another server (could be SQL) where that request is using delegated authentication, so the other server knows that request is performed on behalf of the user requesting information from the WFE.

share|improve this answer
Thanks for the feedback Per. If its not a double hop, what is the prompt for username/password when opening a document? Can it be avoided? – dmce Oct 1 '12 at 15:11
Also, are you saying a user in domain2 can never participate in kerberos authentication to domain1? – dmce Oct 1 '12 at 15:15
The prompt for username/password is word requesting assess to SharePoint to get additional information to display workflows, folder information and things like that. If you cancel out of this (it's probably going to ask you several times) you still get the document, but not the extra functionality. If you allow the user from domain2 access then they should not get the extra prompt. – Per Jakobsen Oct 1 '12 at 16:23
Regarding configuration of Kerberos across domains you may want to post the question on ServerFault as the IT-PROs there know a lot more about configuring windows/networking – Per Jakobsen Oct 1 '12 at 16:25
This will be the same for users on domain1 connecting over the Internet -- they cannot contact a KDC (your Domain Controller) for a Kerberos ticket, so they'll always leverage NTLM to authenticate to resources such as SharePoint. – Trevor Seward Oct 3 '12 at 5:58
show 3 more comments
up vote 0 down vote

I faced Double-hop when user gets authenticated on SharePoint server and while trying to view there emails in web-part we got 401 Access denied from Exchange server.

Double-hop is an issue with NTLM, as NTLM ticket is only valid for the first hop. Kerberos Delegation fixes that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.