Problem with impersonation and using a different host name.

Discussion in 'ASP .Net Security' started by Patrick Meehan, Dec 8, 2005.

  1. I have developed a ASP.Net page with VS 2005 and SQL Server 2005. The server
    I am using is Windows 2003 and I have set up 2 websites, one production and
    one for test and development. This is our corporate intranet server and a
    DNS entry is setup to point 'intranet' to this machine, however, the computer
    name is different. Lets call it 'bob'. 'bob' has been trusted for
    delegation.

    If I go to http://bob.mydomain.net/mysite it works fine, both in test and
    production. But if I go to http://intranet.mydomain.net/mysite I get "Login
    failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

    It seems pretty clear to me that the issue is the different DNS hostname,
    but is there a work around for this?
     
    Patrick Meehan, Dec 8, 2005
    #1
    1. Advertising

  2. You need to give the machine account an additional service principal name
    (SPN) for http/bob.mydomain.com. There is a tool called setspn.exe that
    does this. Your domain admin must run it.

    That should allow the you to do Kerberos authentication with the different
    DNS name. That should in turn allow delegation (assuming both sites use
    Network Service as the app pool identity).

    Joe K.

    "Patrick Meehan" <> wrote in message
    news:...
    >I have developed a ASP.Net page with VS 2005 and SQL Server 2005. The
    >server
    > I am using is Windows 2003 and I have set up 2 websites, one production
    > and
    > one for test and development. This is our corporate intranet server and a
    > DNS entry is setup to point 'intranet' to this machine, however, the
    > computer
    > name is different. Lets call it 'bob'. 'bob' has been trusted for
    > delegation.
    >
    > If I go to http://bob.mydomain.net/mysite it works fine, both in test and
    > production. But if I go to http://intranet.mydomain.net/mysite I get
    > "Login
    > failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
    >
    > It seems pretty clear to me that the issue is the different DNS hostname,
    > but is there a work around for this?
     
    Joe Kaplan \(MVP - ADSI\), Dec 8, 2005
    #2
    1. Advertising

  3. Thanks, that worked perfectly. Any suggested reading to explain what it just
    did?

    "Joe Kaplan (MVP - ADSI)" wrote:

    > You need to give the machine account an additional service principal name
    > (SPN) for http/bob.mydomain.com. There is a tool called setspn.exe that
    > does this. Your domain admin must run it.
    >
    > That should allow the you to do Kerberos authentication with the different
    > DNS name. That should in turn allow delegation (assuming both sites use
    > Network Service as the app pool identity).
    >
    > Joe K.
    >
    > "Patrick Meehan" <> wrote in message
    > news:...
    > >I have developed a ASP.Net page with VS 2005 and SQL Server 2005. The
    > >server
    > > I am using is Windows 2003 and I have set up 2 websites, one production
    > > and
    > > one for test and development. This is our corporate intranet server and a
    > > DNS entry is setup to point 'intranet' to this machine, however, the
    > > computer
    > > name is different. Lets call it 'bob'. 'bob' has been trusted for
    > > delegation.
    > >
    > > If I go to http://bob.mydomain.net/mysite it works fine, both in test and
    > > production. But if I go to http://intranet.mydomain.net/mysite I get
    > > "Login
    > > failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
    > >
    > > It seems pretty clear to me that the issue is the different DNS hostname,
    > > but is there a work around for this?

    >
    >
    >
     
    Patrick Meehan, Dec 8, 2005
    #3
  4. You absolutely can't go wrong with Keith Brown's book.

    http://www.amazon.com/gp/product/0321228359/qid=1134078340/103-2957441-5804624

    Also, there are some good troubleshooting docs that MS publishes:

    http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx

    If you are going to be using delegation, it pays to learn as much as you can
    about it. My experience is that it is difficult to predict your results or
    understand failures until you do (from someone who is just now getting to be
    able to do both with moderate success).

    Joe K.

    "Patrick Meehan" <> wrote in message
    news:...
    > Thanks, that worked perfectly. Any suggested reading to explain what it
    > just
    > did?
    >
    > "Joe Kaplan (MVP - ADSI)" wrote:
    >
    >> You need to give the machine account an additional service principal name
    >> (SPN) for http/bob.mydomain.com. There is a tool called setspn.exe that
    >> does this. Your domain admin must run it.
    >>
    >> That should allow the you to do Kerberos authentication with the
    >> different
    >> DNS name. That should in turn allow delegation (assuming both sites use
    >> Network Service as the app pool identity).
    >>
    >> Joe K.
    >>
    >> "Patrick Meehan" <> wrote in
    >> message
    >> news:...
    >> >I have developed a ASP.Net page with VS 2005 and SQL Server 2005. The
    >> >server
    >> > I am using is Windows 2003 and I have set up 2 websites, one production
    >> > and
    >> > one for test and development. This is our corporate intranet server
    >> > and a
    >> > DNS entry is setup to point 'intranet' to this machine, however, the
    >> > computer
    >> > name is different. Lets call it 'bob'. 'bob' has been trusted for
    >> > delegation.
    >> >
    >> > If I go to http://bob.mydomain.net/mysite it works fine, both in test
    >> > and
    >> > production. But if I go to http://intranet.mydomain.net/mysite I get
    >> > "Login
    >> > failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
    >> >
    >> > It seems pretty clear to me that the issue is the different DNS
    >> > hostname,
    >> > but is there a work around for this?

    >>
    >>
    >>
     
    Joe Kaplan \(MVP - ADSI\), Dec 8, 2005
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Joey
    Replies:
    0
    Views:
    363
  2. Orpheus66
    Replies:
    0
    Views:
    4,503
    Orpheus66
    Jul 30, 2003
  3. Anil G
    Replies:
    4
    Views:
    23,212
    v_parthi
    Jan 31, 2008
  4. Jerry Qu
    Replies:
    1
    Views:
    523
    lee atkinson
    Feb 20, 2009
  5. Hiten
    Replies:
    0
    Views:
    485
    Hiten
    Mar 6, 2007
Loading...

Share This Page