Running SharePoint 2010. I need to set up Kerberos authentication, since the double-hop problem with NTLM is causing trouble with a web part I am developing.
Long story short, Kerberos authentication fails after setting it up. I followed this guide to the letter - my environment is slightly different (DC is on a separate server, not on the SharePoint server itself...WFE and Application Server are on the same box, SQL is not). The guide describes setting up two SPNs, whereas I only set up one. When attempting to open my site in the domain, I get a password dialog which does not accept my credentials. Sniffing with Wireshark, it seems the web server returns the error message KRB_APP_ERR_MODIFIED.
Different support forums have suggested a number of fixes. Some obscure ones: I have verified that IIS does not use kernel mode authentication. There do not appear to be any duplicate DNS entries. The SharePoint server's DNS cache has been flushed. The clock on my SharePoint server is synchronized with the domain.
My SharePoint server has the DNS name "sharepoint" and the domain name is "bkf.internal". My SharePoint Application Pool uses the account SP_Service. Hence I set up the SPN thusly:
C:\Windows\system32>setspn -s HTTP/sharepoint BKF\SP_Service
Checking domain DC=bkf,DC=internal
Registering ServicePrincipalNames for CN=SharePoint Servicekonto,CN=Users,DC=bkf
,DC=internal
HTTP/sharepoint
Updated object
Looking for duplicate SPN entries, I ran the command 'ldifde -d "dc=bkf,dc=internal" -r "servicePrincipalName=http*" -p subtree -l "dn,servicePrincipalName" -f output.txt' on the DC. Output.txt contains
dn: CN=SharePoint Servicekonto,CN=Users,DC=bkf,DC=internal
changetype: add
servicePrincipalName: HTTP/sharepoint
...so at least there aren't any duplicate SPNs.
Does anyone have any suggestions, or pointers for further troubleshooting?
[Edit: In response to webdes03, I forgot to mention it but I also activated delegation for the SharePoint server in AD...and the SQL server and the DC itself, although I got the impression it wasn't necessary].