1

I'm setting up a new SharePoint 2013 farm using Kerberos authentication. I've read a ton of resources about it and it seems I've got my solution 99% right - Kerberos is working like a charm when I check it with C2WTSTest.exe, a tool for testing Kerberos on different identities.

The problem I have is actually getting SharePoint 2013 to use Kerberos - everything I see is NTLM, no Kerberos in sight for miles away.

Here's what I checked:

  • Kerberos is definitely selected for the web app in question
  • The App Pool runs on the correct account
  • C2WTS is fully configured, working fine in C2WTSTest.exe
  • Authentication Providers in IIS are okay: negotiate over NTLM and Kernel Mode auth is disabled
  • Nothing Kerberos-related in Fiddler
  • Only my TGT in klist

I've done a ton of reboots (literally restarting the server, not just iisreset) to no avail.

What else can I check, what might be a cause for this?

Improve this question
6
  • 2
    If you don't see a Kerberos ticket with klist for the resource (URL) you're accessing double check your SPN / URL / app pool account combination. If that's ok, double check if SharePoint is configured for Kerberos in web app authentication settings. Start with the basics. The c2wts will only be used when doing delegation, not for authentication to the site.
    – Thomas Vochten
    Commented Mar 20, 2013 at 19:06
  • Thanks for the helpful answer. I have the following SPNs: http/wfehostname domain\appoolaccount & mssqlsvc/sqlhostname (without service account, as apparently the previous admin got it to work for SP2010 Kerberos that way) I also have an application server in between, but my sources tell me I should only create SPNs for web app pools, is that correct? The WebApp is configured correctly.
    – Michael Davids
    Commented Mar 20, 2013 at 21:30
  • Is the "wfehostname" you mention the exact URL users are using? Otherwise, don't forget the http/fully.qualified.url too. Only SPNs for web applications is indeed correct.
    – Thomas Vochten
    Commented Mar 21, 2013 at 8:03
  • for just authenticating to SharePoint you don't need an SPN for the SQL server, only when delegating
    – Thomas Vochten
    Commented Mar 21, 2013 at 8:04
  • Did you ever figure out the issue?
    – Steve Lineberry
    Commented Apr 30, 2013 at 15:24

1 Answer 1

Reset to default
1

I agree with Thomas to check the SPN.

I made a post recently on some common Kerberos resources: http://steve.thelineberrys.com/resources-for-setting-up-kerberos-authentication-in-sharepoint/

One of the resources I list there is called Delegconfig. You can setup this tool as a website on your farm and then change your iis settings so that your sharepoint site points to the delegconfig website instead. Then go to your url and the delegconfig site will test your kerberos configuration and tell you what is wrong.

I was banging my head against the wall for days trying to get kerberos working one time and this website tool was what lead me to the issue. It turns out that my infrastructure guy misspelled our company name on the spn...

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.