Problem with impersonation and using a different host name.

[Patrick Meehan]

I have developed a ASP.Net page with VS 2005 and SQL Server 2005. The server
I am using is Windows 2003 and I have set up 2 websites, one production and
one for test and development. This is our corporate intranet server and a
DNS entry is setup to point 'intranet' to this machine, however, the computer
name is different. Lets call it 'bob'. 'bob' has been trusted for
delegation.

If I go to http://bob.mydomain.net/mysite it works fine, both in test and
production. But if I go to http://intranet.mydomain.net/mysite I get "Login
failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

It seems pretty clear to me that the issue is the different DNS hostname,
but is there a work around for this?

 

[Joe Kaplan \(MVP - ADSI\)]

You need to give the machine account an additional service principal name
(SPN) for http/bob.mydomain.com. There is a tool called setspn.exe that
does this. Your domain admin must run it.

That should allow the you to do Kerberos authentication with the different
DNS name. That should in turn allow delegation (assuming both sites use
Network Service as the app pool identity).

Joe K.

 

[Patrick Meehan]

Thanks, that worked perfectly. Any suggested reading to explain what it just
did?

 

[Joe Kaplan \(MVP - ADSI\)]

You absolutely can't go wrong with Keith Brown's book.

http://www.amazon.com/gp/product/0321228359/qid=1134078340/103-2957441-5804624

Also, there are some good troubleshooting docs that MS publishes:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx

If you are going to be using delegation, it pays to learn as much as you can
about it. My experience is that it is difficult to predict your results or
understand failures until you do (from someone who is just now getting to be
able to do both with moderate success).

Joe K.