Tag Info

Hot answers tagged

21

NTLM is only allow 1-hop solutions because it is transferring user credentials to the first server - in most cases it is IIS on your SharePoint Front End Server. If you want to get some data from a SharePoint server code (WebPart etc) and ask another server for data (it could be external back-end system you want to integrate to), you can't pass user context ...


13

One thing is missing in this discussion that is asked in the question; the difference between NTLM and Kerberos. NTLM is a properitary AuthN protocol invented by Microsoft whereas Kerberos is a standard protocol. The big difference is how the two protocols handle the authentication: NTLM uses a three-way handshake between the client and server and ...


11

For you, the big reason is that it solves the "double hop" (delegation) problem, as mentioned in another answer. In addition, the Kerberos authentication mechanism starts to become more efficient as user session time increases, and reduces the load on the domain controller. This is because Kerberos is using an authentication ticket and not having to go back ...


6

A couple of things to check for First of all - you do not need delegation yet. Wait with that until you get the log on process to work make sure that the DNS name sharepoint is registered with an A record in DNS (and not a CNAME) register SPN's for both HTTP/sharepoint and HTTP/sharepoint.bkf.internal make sure that the account you use when setting the SPN ...


5

A computer in domain2 will not participate in Kerberos in domain1 if there is no trust relation configured between both domains. The fallback is NTLM. To see if kerberos is used you can check with KLIST from a command line (in windows 7 for all other OS user kerbtray from the Windows Resource Kits Tools). Getting a Word document from SharePoint will never ...


5

As Kjetil says you need to fix up your SPN's. This is one of the most common errors when setting up Kerberos - not having control of where your SPN's ends up and not having it thorougly documented. Do like this to proceed: Remove the SPN using setspn -D from the account that is NOT the application pool of your web application Restart IIS (or reboot) your ...


4

Here's an example of when you need it and when you don't User >> SharePoint web page with SSRS report viewer via iFrame. NTLM lets user onto the page. User goes direct to SSRS via the iFrame and uses NTLM to authenticate there. Kerberos not required. User >> SharePoint web page with SSRS report viewer in Integrated Mode. User goes to SharePoint and ...


4

After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this. Here's the idea (point by point): 1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN 2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...


3

@James Love got this on the head, you need to take a look at the cookies Check out this project "Remote authentication with claims" I believe the answer is here in the code. It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.


3

Check out the DelegConfig utility on the IIS site. Deploy this to its own IIS web site, and configure it similar to SharePoint. It will provide troubleshooting steps to verify your SPNs, etc., and see if you are getting a successful Kerberos ticket. DelegConfig v2 beta (Delegation / Kerberos Configuration Tool) ...


3

You cannot use Kerberos for an Internet-facing system (as users cannot receive a ticket from the KDC), however you should use Kerberos for Intranet-facing systems when possible as it is faster as well as more secure.


2

Everything here is correct thus far, but generally which one to use? When I'm setting up SharePoint, Single-Server setups are typically NTLM, Multi-Server setups are typically Kerberos. Usually Multi-Server setups one day will involve third party tools, etc. that wish to setup authentication integrated somewhat with SharePoint and being cognizant of that, ...


2

This is due to the double-hop issue. You cannot inherit the user credentials all the way to your database by using NTLM. You have several options though: User Kerberos and delegation Impersonation Use specific db-credentials (optionally using the SSO service) Use SQL login instead of Windows login and specify the credentials in the connection string and ...


2

You are probably having problems with the new "feature" in IIS 7 - Kernel Mode Authentication Kernel Mode Authentication uses the SPNs on the computer account, even if the application pool runs on a different service account. This is a problem when you are running a Sharepoint farm with more than one frontend webserver ...


2

A couple of things, it was a long post with a lot of different questions/issues. Make sure that the "Managed Metadata Web Service" are started on the correct server under "Manage Services on Server" Do you have a specific web app only for the syndication hub? What template does the site collection use? Yes, you will see claims info in the ULS - SharePoint ...


2

Yes, technically the NetBIOS name (really, hostname) would be "intranet" and "servername" as you've pointed out. You don't have to have a NetBIOS name, if you only use FQDNs.


2

Enable FireFox Kerberos Trust Open FireFox In the Location bar, type about:config, and press enter. The about:config "This might void your warranty!" warning page may appear. Click I'll be careful, I promise!, to continue to the about:config page. In the about:config page, search for the preference network.negotiate-auth.trusted-uris, and double-click ...


2

Agree with Wictor here, with a "small" addition: Getting an access denied does not necessarily mean sharepoint itself is denying you access. It could also be a component running in sharepoint that can't access a resource and then throws the accessdenied exception. Seeing as SharePoint handles these exceptions differently, even though sharepoint itself is ...


2

Kai I have done the solution but it's done the client in the Visual Studio 2012 using Service references. The solution is to make sure that you send a NTLM authentication request. Here is the complete source code for a console application being done in Visual Studio 2012: using System; using System.Collections.Generic; using System.Linq; using ...


2

I would start by creating a service principal name for the SQL Server instance. I assume you use a default instance on the default port here: SQL Server Instance: servername\mssqlserver SQL Server service account: domain\sql setspn -S MSSQLSvc/servername:1433 domain\sql setspn -S MSSQLSvc/servername.fully.qualified:1433 domain\sql Notice how it is ...


2

You need to make sure that you have provisioned the Claims to Windows Token Service (C2WTS) using its own domain account. Then create a fake SPN for that account (this is only needed to get the Delegation tab to show up in the ADUC MMC): setspn SP/C2WTS domain\user Then configure constrained delegation for that service account to the SSAS service.


2

If users will never be connecting to backend system for intranet (using BCS) then NTLM suitable. Kerberos solves double hop issue, so Kerberos usually necessary if passing credentials if not using Secure Store Services. There is no ONE solution here. Honestly, your environment and needs for data integration will hold your answer.


2

At the end of you code it looks like your code is using the same method to impersonate as in a classic auth app with integrated auth. This is not working in a claims app because the used authenticated using kerberos in the initial handshake (url: _trust/...). The claims to windows token service is not doing the magic automatically. You have to request a ...


1

In your Web application's web.config add following tag within <system.web>, <authentication mode="Windows" />


1

have a loook at your web.config: change the following: ClientCredentialType=Ntlm to clientCredentialType = windows http://stackoverflow.com/questions/762239/difference-between-clientcredentialtype-windows-and-ntlm http://stackoverflow.com/questions/2608887/sharepoint-web-services-the-http-request-is-unauthorized-with-client-authenti EDIT someone ...


1

I have a SharePoint 2010 site that has Kerberos auth properly configured and is added to my "Trusted Sites" in Internet Options. Using KerbTray I get a Kerberos ticket on both Chrome and FireFox. I purged tickets before each attempt. I then opened SQL Server Management Studio and connected to the SharePoint DB server. I opened a new query window and used ...


1

_ Hi Bernd My draft post became over 2 pages, so I decided to cut some details, to get any replies at all. I have tried AllowNtlm = false, but for some reason I get the error message "The remote server did not satisfy the mutual authentication requirement." when I run. In IIS-Manager on the IIS-app I have only "Windows Authentication" and ...


1

A question probably better served by ServerFault. You need an SPN for each type of connection that may be made. Because your configuration uses FQDN's you are not having issues connecting via SPN listening for that FQDN. if you tried to pass a kerberos token via the NetBIOS designation you would fail and receive an error stating the specified SPN could not ...


1

I answered a similar question recently. SharePoint 2010 you should use the Secure Store Service (SSS) for these kind of settings (credentials, connectionstrings etc). That provides a user interface for selected users, you can then in your Web Part Property point to the SSS application ID that you want it to use (you could also get fancy and make the ...


1

To answer the first part, yes you will need to do it on every web front end. For the second part, it seems to be common practice, I don't know if it's best practice. It's a workaround for a limitation of SP2010 on Windows Server 2008 but there seems to be no ill-effects (or perhaps even some performance increase with it). Note: There seems to be a (very ...



Only top voted, non community-wiki answers of a minimum length are eligible