Can authenticate through Negotiate with PowerShell but not with Java

Question

I need some help setting up Kerberos on SharePoint correctly for a test single farm server.

I am able to successfully use PowerShell to authenticate to this server as a given kerberos user:

Invoke-WebRequest -uri http://win-qbfsb933r5p -UseDefaultCredentials
Invoke-WebRequest -uri http://win-qbfsb933r5p -Credential "winlab\kerberos"

But when I try to authenticate to SharePoint with Java using using this approach I always get a 401 error no matter what I do.

However, I am able to connect java to other non-SharePoint IIS web sites fine. I can create a simple IIS application pool on port 81 on the same IIS host also protected by Negotiate, and I can use this same java program to authenticate. It is just SharePoint giving me problems.

I did the following:

• Set up a single Windows Server 2016 machine. We will call it http://win-qbfsb933r5p
• Configured Active Directory Domain Services on this machine and created a new AD forest win.lab.xxxxxxxxxx.com and netbios domain winlab.
• Create a "kerberos" user in active directory and create a keytab for this user.
• Installed SQL Server 2017.
• Ran SharePoint 2019 prereqs installer.
• Set up a SharePoint single farm server.
• Create a sharepoint web application on port 80.
• Created a single root site collection on this web application at http://win-qbfsb933r5p.
• Open the IIS manager and go to the SharePoint Port 80 web application and go to Authentication modes.
  • Remove NTLM.
  • Add Negotiate.
  • Disable all other authentication types.
• Run iisreset
• Set up FireFox with trusted negotiate auth for http://win-qbfsb933r5p.
• Verify you can access sharepoint with firefox on the server without having to log in.
• Run the powershell Invoke-WebRequest -uri http://win-qbfsb933r5p -UseDefaultCredentials and it works.
• Run the mentioned Java example and get a 401 error every time.

Based on these steps, is there some reason I always get HTTP status code 401 Unauthorized from SharePoint when doing requests from Java? Why can I use Java to authenticate fine with other IIS web sites protected by kerberos?

What am I missing here?

EDIT:

Here is my DNS Forward Lookup Zones for my server:

Answer 1

You are missing several pieces from what I'm reading. You finish setting up SharePoint to use Kerberos. I'll try to keep this short. The original white paper on SharePoint and Kerberos is a 180 pages long.

1. Get your DNS setting for your site and look at your A name. If your domain is one word, then it's that word. if it's multiple dots, it's probably just the first one. e.g. www.MyCoolSite.com, the DNS A record name is probably www.mycoolsite.com. Or, if you have something like my.awesome.site.com, then you need to have my. and my.awesome.site.com

2. Use SetSPN -S http/www.mycoolsite.com DOMAIN\ApplicationPoolAccount

3. add your server names SetSPN -S http/webservername
4. Delegate the App pool to itself via Active Directory (now that you have SPNs applied, the Delegate tab will be visible) A. Click Delegate, Select Any Authentication Protocol, Search for application pool account. Select everything. Click OK. Click Apply

SQL Same dealie, except instead of http, you use MSSQLSVC/FQDN-OF-SQL:1433 and MSSQLSVC/NETBIOS-OF-SQL (repeat for each server in a cluster, and repeat for the cluster name)

Central Admin Set Web Application to use Windows Authentication/Kerberos

IIS Make sure that both Negotiate and NTLM are present, and that Negotiate is first. You leave NTLM present as a fallback in case you have DC errors.

The key thing here is that it's not just the user Kerberos ticket you are looking for. It's the ability of SharePoint (IIS/Windows) to accept that ticket and tell the rest of its services that it's okay to use that ticket.

If your account is logging in okay, you can see it in the Security Event logs under ID 4624 (Detailed Authentication Information, Logon Process, Kerberos)

Edit: Get your application pool account by going to Central Administration, Security, Configure Service Accounts, Click the drop down and select "Web Application Pool - [IIS Site Name]". The account that is currently running your web application will be listed under 'Select an account for this component'.