Kerberos for multihop remoting powershell

Question

I am trying to set up a remote powershell session to a sharepoint server in order to do remote management. I am running as a user with full mgmt rights at the sharepoint server

If I use Credssp and enter credentials, I can connect and run sharepoint cmds

Enter-PSSession -ComputerName spserver -ConfigurationName PSv2 -Credential domain\adminuser -Authentcation Credssp

But I don't want the admin user(s) to have to enter their credentials once more when they are already authenticated at the admin server.

So I am trying to use the following connection cmd

Enter-PSSession -ComputerName spserver -Authentication Kerberos -ConfigurationName PSv2

When attempting to run powershell cmds I get the error "cannot access the local farm"

An error is logged on the sharepoint server,

SQL database login for 'SP_Config' on instance 'spserver' failed. Additional error information from SQL Server is included below.

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

So I am assuming that the credentials did not pass further that the first hop to the server.

Most of the tutorials on remoting seem to focus on Credssp, I can't find much on how to troubleshoot Kerberos for this purpose. Any pointers to good information on this?

UPDATE

I have found some information that seem to indicate that Powershell remoting does not support multiple hops using Kerberos! I'd be happy if anyone could confirm this

"Windows PowerShell remoting does not support Kerberos delegation. You have to use CredSSP to delegate the user account (...)"

http://blogs.technet.com/b/askds/archive/2012/08/02/windows-powershell-remoting-and-delegating-user-credentials.aspx

and

http://blogs.technet.com/b/heyscriptingguy/archive/2013/04/04/enabling-multihop-remoting.aspx

Answer 1

In the end, I set up the session using CredSSP, asking the admin user for credentials.

The main objective was to avoid having to enter credentials every time, so I set up a script to read the password once and save it encrypted to file (using admin's credentials) for subsequent sessions. Not an ideal solution but good enough

$adminuser = Read-Host "connect as username? ( default $($env:username))"
if ($adminuser -eq "") {
    $adminuser = $env:username
}
$server = "spserver"
Write-Host "connecting ..."

$passpath = "$env:USERPROFILE\cred_$($adminuser).dat"

Write-Host ("Load Credentials from $passpath")
if (Test-Path -Path $passpath) {
    $securepass = Get-Content $passpath | ConvertTo-SecureString
    Write-Host ("Loaded Credentials")
} else {
    $securepass = Read-Host "Password missing, please enter for user $adminuser :" -AsSecureString
    $securepass | ConvertFrom-SecureString | Out-File $passpath
    Write-Host ("Saving securely...")
}  
Write-Host "Connecting to remote sharepoint server..."
$cred=New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "DOMAIN\$adminuser", $securepass

New-SPSession etc

Answer 2

Please have patience with me as this is my first 'answer' on stackexchange, but:

I would like to share my solution using Constrained Powershell Endpoints as described on Technet.
Basically it sets up a new remote session configuration in which you can define a runas-user (I suppose a sharepoint farm admin will do) and a startup script.

All statements executed in this custom endpoint will be executed as the runas-account. This solution also gives you the flexibility to only present pre-created "proxy" functions, limiting what is allowed on your sharepoint.

The setup is the following.

On the sharepoint server(s):

Create a script as proposed in the link above in the 'C:\Scripts\Constrained' folder

Register-pssessionConfiguration -name 'company.sharepoint.endpoint' -StartupScript "C:\Scripts\Constrained\Sharepoint.ps1" -ShowSecurityDescriptorUI -RunAsCredential (Get-Credential -Credential "domain\farmadmin") -Force -Confirm:$False

Grant the appropriate users access to the endpoint, make sure you grant them 'Invoke' permissions:

On the client:
New-PsSession -ComputerName 'sharepointserver' -ConfigurationName 'company.sharepoint.endpoint'

Once this is set up, you can add proxy functions and all will be executed as the farm admin account.

Since a new session is created on the sharepoint server, the double-hop issue is securely bypassed and you do not have to pass credentials.

Sincerely,