0

I need some help setting up Kerberos on SharePoint correctly for a test single farm server.

I am able to successfully use PowerShell to authenticate to this server as a given kerberos user:

Invoke-WebRequest -uri http://win-qbfsb933r5p -UseDefaultCredentials
Invoke-WebRequest -uri http://win-qbfsb933r5p -Credential "winlab\kerberos"

But when I try to authenticate to SharePoint with Java using using this approach I always get a 401 error no matter what I do.

However, I am able to connect java to other non-SharePoint IIS web sites fine. I can create a simple IIS application pool on port 81 on the same IIS host also protected by Negotiate, and I can use this same java program to authenticate. It is just SharePoint giving me problems.

I did the following:

  • Set up a single Windows Server 2016 machine. We will call it http://win-qbfsb933r5p
  • Configured Active Directory Domain Services on this machine and created a new AD forest win.lab.xxxxxxxxxx.com and netbios domain winlab.
  • Create a "kerberos" user in active directory and create a keytab for this user.
  • Installed SQL Server 2017.
  • Ran SharePoint 2019 prereqs installer.
  • Set up a SharePoint single farm server.
  • Create a sharepoint web application on port 80.
  • Created a single root site collection on this web application at http://win-qbfsb933r5p.
  • Open the IIS manager and go to the SharePoint Port 80 web application and go to Authentication modes.
    • Remove NTLM.
    • Add Negotiate.
    • Disable all other authentication types.
  • Run iisreset
  • Set up FireFox with trusted negotiate auth for http://win-qbfsb933r5p.
  • Verify you can access sharepoint with firefox on the server without having to log in.
  • Run the powershell Invoke-WebRequest -uri http://win-qbfsb933r5p -UseDefaultCredentials and it works.
  • Run the mentioned Java example and get a 401 error every time.

Based on these steps, is there some reason I always get HTTP status code 401 Unauthorized from SharePoint when doing requests from Java? Why can I use Java to authenticate fine with other IIS web sites protected by kerberos?

What am I missing here?

EDIT:

Here is my DNS Forward Lookup Zones for my server:

DNS forward lookup zones

1

You are missing several pieces from what I'm reading. You finish setting up SharePoint to use Kerberos. I'll try to keep this short. The original white paper on SharePoint and Kerberos is a 180 pages long.

  1. Get your DNS setting for your site and look at your A name. If your domain is one word, then it's that word. if it's multiple dots, it's probably just the first one. e.g. www.MyCoolSite.com, the DNS A record name is probably www.mycoolsite.com. Or, if you have something like my.awesome.site.com, then you need to have my. and my.awesome.site.com

  2. Use SetSPN -S http/www.mycoolsite.com DOMAIN\ApplicationPoolAccount

  3. add your server names SetSPN -S http/webservername
  4. Delegate the App pool to itself via Active Directory (now that you have SPNs applied, the Delegate tab will be visible) A. Click Delegate, Select Any Authentication Protocol, Search for application pool account. Select everything. Click OK. Click Apply

SQL Same dealie, except instead of http, you use MSSQLSVC/FQDN-OF-SQL:1433 and MSSQLSVC/NETBIOS-OF-SQL (repeat for each server in a cluster, and repeat for the cluster name)

Central Admin Set Web Application to use Windows Authentication/Kerberos

IIS Make sure that both Negotiate and NTLM are present, and that Negotiate is first. You leave NTLM present as a fallback in case you have DC errors.

The key thing here is that it's not just the user Kerberos ticket you are looking for. It's the ability of SharePoint (IIS/Windows) to accept that ticket and tell the rest of its services that it's okay to use that ticket.

If your account is logging in okay, you can see it in the Security Event logs under ID 4624 (Detailed Authentication Information, Logon Process, Kerberos)

Edit: Get your application pool account by going to Central Administration, Security, Configure Service Accounts, Click the drop down and select "Web Application Pool - [IIS Site Name]". The account that is currently running your web application will be listed under 'Select an account for this component'.

  • excellent. I'll give it a try now. – Nicholas DiPiazza Aug 22 '18 at 15:05
  • Hi @jack. I updated some info to make the ticket more readable. I'm confused about that first step related to the DNS. I pasted a picture of my DNS forward lookup zones. Does this mean I should run SetSPN -S http/win-qbfsb933r5p winlab\kerberos? – Nicholas DiPiazza Aug 22 '18 at 15:40
  • Yep, that should be it, assuming that winlab is your domain name and Kerberos is the name of the service account running the SharePoint application pool. (IIS, to name of SharePoint site, basic settings, application pool name, then IIS, Application Pool, and it should have the service account name shown) – Jack Aug 22 '18 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.