Problem with impersonation and using a different host name. -- asp.net security

Patrick Meehan
12/8/2005 1:22:02 PM

Thanks, that worked perfectly. Any suggested reading to explain what it just
did?

[quoted text, click to view]

Joe Kaplan (MVP - ADSI)
12/8/2005 2:53:45 PM

You need to give the machine account an additional service principal name
(SPN) for http/bob.mydomain.com. There is a tool called setspn.exe that
does this. Your domain admin must run it.

That should allow the you to do Kerberos authentication with the different
DNS name. That should in turn allow delegation (assuming both sites use
Network Service as the app pool identity).

Joe K.

[quoted text, click to view]

Joe Kaplan (MVP - ADSI)
12/8/2005 3:50:51 PM

You absolutely can't go wrong with Keith Brown's book.

http://www.amazon.com/gp/product/0321228359/qid=1134078340/103-2957441-5804624

Also, there are some good troubleshooting docs that MS publishes:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx

If you are going to be using delegation, it pays to learn as much as you can
about it. My experience is that it is difficult to predict your results or
understand failures until you do (from someone who is just now getting to be
able to do both with moderate success).

Joe K.

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about asp.net security

asp.net security : Problem with impersonation and using a different host name.