Claim Based authentication on SharePoint 2013 and "Integrated Security"

Question

I have a problem with a SharePoint 2010 application that now runs on SharePoint 2013.

The application has been converted and seems to have no problem "from a code" point of view. The problem comes out when the application tries to connect to an external database.

The connection string is stored with Integrated Security = SSPI, anonymous access is disabled.

I have tried many configuration like:

• Kerberos
• NTLM
• Impersonation
• All the possible disposition of the configuration

The Application Pool runs with a technical account that is trusted on the environment.

When I run my application I receive an exception like:

Login failed for user "NT AUTHORITY\ANONYMOUS LOGON" at System.Data.SqlClient.SqlInternal...

How can this be possible? I'm correcly signed in in SharePoint, I have the claim service enabled and all the users are part of the Active Directory domain.

Is there any other configuration I don't know?

Answer 1

Sounds like the old double-hop problem. In order to let the current user "impersonate" the technical account, you should configure a service that lets you manage the kerberos tokens, it is called C2WTS.

http://technet.microsoft.com/it-it/library/hh231678.aspx

But, if you using BCS you cannot use it; and anyway, it's better to leave it alone: it needs to run under a god-like account.

I hope you could try some of the workarounds listed here

http://blogs.technet.com/b/harmeetw/archive/2011/08/28/getting-login-failed-for-user-nt-authority-anonymous-logon-when-browsing-external-list-on-a-claims-kerberos-web-application.aspx

Also, check the "kerberos delegation" topic.

Probably the solution is to use C2WTS with a WCF proxy between it and SharePoint, like this example:

http://blogs.technet.com/b/speschka/archive/2011/08/07/using-saml-claims-sharepoint-wcf-claims-to-windows-token-service-and-constrained-delegation-to-access-sql-server.aspx