I need some help setting up Kerberos on SharePoint correctly for a test single farm server.
I am able to successfully use PowerShell to authenticate to this server as a given kerberos user:
Invoke-WebRequest -uri http://win-qbfsb933r5p -UseDefaultCredentials Invoke-WebRequest -uri http://win-qbfsb933r5p -Credential "winlab\kerberos"
But when I try to authenticate to SharePoint with Java using using this approach I always get a 401 error no matter what I do.
However, I am able to connect java to other non-SharePoint IIS web sites fine. I can create a simple IIS application pool on port 81 on the same IIS host also protected by Negotiate, and I can use this same java program to authenticate. It is just SharePoint giving me problems.
I did the following:
- Set up a single Windows Server 2016 machine. We will call it http://win-qbfsb933r5p
- Configured Active Directory Domain Services on this machine and created a new AD forest
win.lab.xxxxxxxxxx.comand netbios domain
- Create a "kerberos" user in active directory and create a keytab for this user.
- Installed SQL Server 2017.
- Ran SharePoint 2019 prereqs installer.
- Set up a SharePoint single farm server.
- Create a sharepoint web application on port 80.
- Created a single root site collection on this web application at http://win-qbfsb933r5p.
- Open the IIS manager and go to the SharePoint Port 80 web application and go to Authentication modes.
- Disable all other authentication types.
- Set up FireFox with trusted negotiate auth for http://win-qbfsb933r5p.
- Verify you can access sharepoint with firefox on the server without having to log in.
- Run the powershell
Invoke-WebRequest -uri http://win-qbfsb933r5p -UseDefaultCredentialsand it works.
- Run the mentioned Java example and get a 401 error every time.
Based on these steps, is there some reason I always get HTTP status code 401 Unauthorized from SharePoint when doing requests from Java? Why can I use Java to authenticate fine with other IIS web sites protected by kerberos?
What am I missing here?
Here is my DNS Forward Lookup Zones for my server: