SharePoint 2013 Kerberos Setup Issue - NT AUTHORITY\ANONYMOUS LOGON

Question

Facing issues while configuring the Kerberos . The process is as below

• ASP.Net full trust farm solution deployed on SharePoint 2013 App Server (IIS 8) connects to SQL Server 2008 R2 Database 1.
• SharePoint web app is installed with Claims based authentication
• ASP.Net farm solution is using windows authentication in connection string

We are running into some issues with Kerberos where delegation is not working and we get "Login failed for user NT AUTHORITY\ANONYMOUS LOGON" error on SQL Server 2008 R2 Database

We have gone through the Kerberos guide "SP2010 Kerberos Guide" and setup all SPN’s and delegation as specified.

SPN Setup is

• External SQL Server 1 (+FQDN and Port) on MSSQLSvc service under account running External SQL Server 1 service
• SharePoint 2013 web Server Host Name (with and without FQDN) on HTTP service under Application Pool
• SP/C2WTS for Claims to windows token service account

Delegation is setup on - From application Pool Account running web app to MSSQLSvc services on SQL Server 1 - From application Pool Account running web app to HTTP on SharePoint web front end - From SharePoint Web Server Computer to MSSQLSvc service on SQL Server 1 - From Claims to Windows Token Service account to MSSQLSvc on SQL Server 1

Does anyone have any tips or pointers to resolve the issue?

Some more information

• User is able to login into SharePoint app server and I see tokens getting generated using ULSViewer
• SQL Server "Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors." is coming from SharePoint App Server (WFE) and user is the web application's application pool.

Answer 1

With Claims based AuthN you need to leverage the Claims to Windows Token Service (C2WTS) to "convert" the Windows claim to a Windows Identity and pass to your system.