1

So I am at the moment trying to setup kerberos authentication for the central administration of sharepoint. I did already get it to work for normal site collections where it works without any problem. However if I enable Kerberos for my central administration i can only access it from the server where Sharepoint is installed. Whenever I try to access it from a remote pc i get a prompt where i can enter username and password but even if i enter a username and password for a user that has access to the central administration it doesn't log in and just gives the same prompt again. After entering it 3 times the page just is blank (same behavior as if i entered it wrong 3 times).

What i did:

  • everything is configured to use https
  • add spn's for the Central Administration (with port)
  • edit settings for the server in active directory so that it trusts the server for user delegation
  • added the account mentioned in the spn's to the managed accounts of the farm

The setup:

  • Windows Server 2012 R2
  • Sharepoint 2013 Foundation
  • MS SQL Server 2012

I already lost 2 days trying to get it to work maybe someone here knows a fix for this problem?

Improve this question
1
  • add the Central Administration Web Site to the Local Intranet Sites Zone in Internet Explorer, then try it.
    – Waqas Sarwar MVP ♦
    Mar 1, 2016 at 12:53

2 Answers 2

Reset to default
1

Very often the SharePoint CentralAdministration does not run on the default Port. As you use SSL, it would be 443.

InternetExplorer has some known bugs regarding Kerberos. One of it is the use of non-standard ports. A lot of details to all known Kerberos issues can be found here: https://technet.microsoft.com/en-us/library/gg502606%28v=office.14%29.aspx. You might also be hit by the CNAME-Problem if you gave your CA a new URL.

In most cases the best solution is to make CA use 443 as TCP-Port.

If you need alternate solutions to your problem, i would need an overview of all WebApplications (including CA), their hostnames (can be anonymized), protocols (HTTP or HTTPS) and ports.

Improve this answer
2
  • Thank you very much the solution was that i had both web application on the same dns entry with different ports. It seems that kerberos does not like that so after switching the web application with site collections to another dns entry everything works like a charm
    – GerhardBe
    Mar 1, 2016 at 14:35
  • I'm very pleased i was able to help. Please remember to remove your delegation settings in ActiveDirectory, as you might have configured an "open" delegation which is not a security best-practice.
    – MHeld
    Mar 1, 2016 at 14:43
0

You might want to examine Windows Security log at the server first, but the fastest 100% way to diagnose Kerberos errors is to get Network Monitor or WireShark installed and sniff the traffic.

See Ask the Directory Services Team posts: 1 and 2

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.