A couple of things to check for
First of all - you do not need delegation yet. Wait with that until you get the log on process to work
make sure that the DNS name sharepoint is registered with an A record in DNS (and not a CNAME)
register SPN's for both HTTP/sharepoint and HTTP/sharepoint.bkf.internal
make sure that the account you use when setting the SPN ...
I would start by creating a service principal name for the SQL Server instance. I assume you use a default instance on the default port here:
SQL Server Instance: servername\mssqlserver
SQL Server service account: domain\sql
setspn -S MSSQLSvc/servername:1433 domain\sql
setspn -S MSSQLSvc/servername.fully.qualified:1433 domain\sql
Notice how it is ...
As Kjetil says you need to fix up your SPN's. This is one of the most common errors when setting up Kerberos - not having control of where your SPN's ends up and not having it thorougly documented.
Do like this to proceed:
Remove the SPN using setspn -D from the account that is NOT the application pool of your web application
Restart IIS (or reboot) your ...
A computer in domain2 will not participate in Kerberos in domain1 if there is no trust relation configured between both domains. The fallback is NTLM. To see if kerberos is used you can check with KLIST from a command line (in windows 7 for all other OS user kerbtray from the Windows Resource Kits Tools).
Getting a Word document from SharePoint will never ...
OK, found it. The two parameters -AuthenticationProvider and -AuthenticationMethod are from different worlds, not to be used together. The first one works with claims based auth while the second one with Classic Windows auth.
To achieve my goal I need to use these commands:
$auth = New-SPAuthenticationProvider -DisableKerberos:$false
After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this.
Here's the idea (point by point):
1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN
2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...
Download Fiddler and Run it. Fire up your IE and open the SharePoint site in the browser. Now go back to Fiddler and see the traces. Click on the trace with a HTTP Response headers pane in the left. If Kerberos is working "Cookies / Login" will show Authorization:Negotiate.
A detailed walkthrough is here
This ofcourse goes with the assumption, that you do ...
@James Love got this on the head, you need to take a look at the cookies
Check out this project "Remote authentication with claims" I believe the answer is here in the code.
It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.
Check out the DelegConfig utility on the IIS site. Deploy this to its own IIS web site, and configure it similar to SharePoint. It will provide troubleshooting steps to verify your SPNs, etc., and see if you are getting a successful Kerberos ticket.
DelegConfig v2 beta (Delegation / Kerberos Configuration Tool)
You cannot use Kerberos for an Internet-facing system (as users cannot receive a ticket from the KDC), however you should use Kerberos for Intranet-facing systems when possible as it is faster as well as more secure.
To answer the first part, yes you will need to do it on every web front end.
For the second part, it seems to be common practice, I don't know if it's best practice. It's a workaround for a limitation of SP2010 on Windows Server 2008 but there seems to be no ill-effects (or perhaps even some performance increase with it).
Note: There seems to be a (very ...
Agree with Wictor here, with a "small" addition:
Getting an access denied does not necessarily mean sharepoint itself is denying you access.
It could also be a component running in sharepoint that can't access a resource and then throws the accessdenied exception. Seeing as SharePoint handles these exceptions differently, even though sharepoint itself is ...
A couple of things, it was a long post with a lot of different questions/issues.
Make sure that the "Managed Metadata Web Service" are started on the correct server under "Manage Services on Server"
Do you have a specific web app only for the syndication hub? What template does the site collection use?
Yes, you will see claims info in the ULS - SharePoint ...
A question probably better served by ServerFault.
You need an SPN for each type of connection that may be made. Because your configuration uses FQDN's you are not having issues connecting via SPN listening for that FQDN. if you tried to pass a kerberos token via the NetBIOS designation you would fail and receive an error stating the specified SPN could not ...
My draft post became over 2 pages, so I decided to cut some details, to get any replies at all.
I have tried AllowNtlm = false, but for some reason I get the error message "The remote server did not satisfy the mutual authentication requirement." when I run.
In IIS-Manager on the IIS-app I have only "Windows Authentication" and "...
Enable FireFox Kerberos Trust
In the Location bar, type about:config, and press enter. The about:config "This might void your warranty!" warning page may appear. Click I'll be careful, I promise!, to continue to the about:config page.
In the about:config page, search for the preference network.negotiate-auth.trusted-uris, and double-click ...
I have done the solution but it's done the client in the Visual Studio 2012 using Service references. The solution is to make sure that you send a NTLM authentication request.
Here is the complete source code for a console application being done in Visual Studio 2012:
You need to make sure that you have provisioned the Claims to Windows Token Service (C2WTS) using its own domain account. Then create a fake SPN for that account (this is only needed to get the Delegation tab to show up in the ADUC MMC):
setspn SP/C2WTS domain\user
Then configure constrained delegation for that service account to the SSAS service.
If users will never be connecting to backend system for intranet (using BCS) then NTLM suitable. Kerberos solves double hop issue, so Kerberos usually necessary if passing credentials if not using Secure Store Services.
There is no ONE solution here. Honestly, your environment and needs for data integration will hold your answer.
I haven't tried Hybrid Search with kerberos, but I've successfully connected my farm to my SharePoint Online environment. It took a while and I had to add all the online-URL:s as trusted sites in internet explorer to make it work properly. Later on I unintentionally destroyed the Cloud Search Service Applications connection by building a Local Search Service ...
At the end of you code it looks like your code is using the same method to impersonate as in a classic auth app with integrated auth. This is not working in a claims app because the used authenticated using kerberos in the initial handshake (url: _trust/...).
The claims to windows token service is not doing the magic automatically. You have to request a ...
I think you mix up two things: Authentication and SharePoint token-handling. Authentication is the first step and describes the process, how a user tells SharePoint who he is. Here you have NTLM, Kerberos and Basic. Token-handling is the 2nd step after successful authentication. This is distinguishes between windows classic (domain\user) and claims format (i:...
Make sure you have the claims to windows token service on it's own service account:
a) Add the service account to the local Administrators Groups.
b) In local security policy (secpol.msc) under user rights assignment give the service account the following permissions:
Act as part of the operating system
Impersonate a client after authentication
What about the SQL Server and SharePoint WFEs computer account settings / user account settings in Active Directory have they been setup to say which services they are able to use delegate user credentials for?
Have you created SPNs for the Claims To Windows Token Service?
Martin Hatch did an awesome presentation on configuring all of this a few years ago ...
Did you add the file location of the Excel workbook to the trusted file locations from within CA>Service Applications>excel service application>Trusted File Locations?
Did you add the trusted data connections and the configure the SASS data model location?
Can you provide a breakdown of the Global Settings that you have configured from with the Excel ...
I agree with Thomas to check the SPN.
I made a post recently on some common Kerberos resources: http://steve.thelineberrys.com/resources-for-setting-up-kerberos-authentication-in-sharepoint/
One of the resources I list there is called Delegconfig. You can setup this tool as a website on your farm and then change your iis settings so that your ...