"CESAR DE LA TORRE [MVP]" wrote:

> I've tried the steps that article says, and it does not work neither...
> 1.- Using a Domain Account
> 2.- Grant "Log on as a service" and "Impersonate a client after
> authentication" to that domain account
> 3.- Full Control to
> "C:\%WINDOWS%\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files"
> 4.- Create an arbitrary SPN for the domain account, with setspn.exe, at my DC.
> 5.- Re-boot of my WebService machine
>
> BTW, it does not say anything about how can we use ASPNET account, like WSE
> 3.0 readme file says (Granting just "Act as part of Operating System" to
> ASPNET account).
> Except using SYSTEM account, all the other possibilities seem very obscure
> and contradictory all around MSFT documentation even in News Groups, etc...
> But my problem is, in my case, I cannot use SYSTEM account...
> Down below you can read those steps taken from the article you said:
>
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/WSS_Ch7_KerbTechSupp.asp
> Using a Domain Account with IIS 5.x (Windows 2000 and Windows XP)
> Instead of using the default account that is defined in the <ProcessModel/>
> element of the Machine.config file, a service can use a domain user account
> as the process identity. The domain account needs additional privileges and
> if it is used for message layer security, an arbitrary SPN should be created.
>
> To configure a domain account for the Kerberos protocol on a computer
> running IIS 5.x:
>
> Create a new user account in the domain (KDC realm) and add that account to
> the user group. This account does not need additional privileges on the
> domain computer. This means that you are using an account with the fewest
> privileges.
> On the computer running IIS 5.x, the new domain account requires the
> following rights, which can be assigned with the Local Security Settings
> configuration tool:
> Log on as a service
> Impersonate a client after authentication
> Assign Full Control permissions to the new domain account for the following
> folder on the IIS 5.x host:
> C:\%WINDOWS%\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files
> Update the <ProcessModel/> element in the Machine.config file on the
> computer that is running IIS 5.x. Both the user name and password need to be
> updated to values associated with the new domain account. Restart IIS.
> Note The following step is required when you are using message layer
> security with the Kerberos protocol. When you use standard Windows
> authentication, it is not necessary to create an SPN for the account unless
> the account will be used for Delegation.
> Use the setspn.exe tool to create an arbitrary SPN for the domain account.
> This action is performed on the Active Directory domain controller, not on
> the computer that is running IIS 5.x. To perform this action, you must be an
> administrator or have SetPrincipalName permissions on the domain controller.
> The following example creates an arbitrary SPN named AcmeService/GlobalBank
> that maps to a Windows account named WS_Account:
> setspn –a AcmeService/GlobalBank WS_Account
> When you create a domain account that will be used for delegation with
> Windows Integrated Security, it should map to the HTTP host-based SPN. If you
> use message layer security with WSE 3.0, use an arbitrary SPN as previously
> described. Finally, the process model used by IIS 6.0 in Windows Server 2003
> is very different from IIS 5.x. As a result, the steps previously described
> will not work in Windows Server 2003.
>
> Any other idea would be greatly apreciated. Thanks in advanced.
> --
> CESAR DE LA TORRE
> Software Architect
> [Microsoft MVP - XML Web Services]
> [MCSE] [MCT]
>
> Renacimiento
> [Microsoft GOLD Certified Partner]
>
>
> "Pablo Cibraro" wrote:
>
> > Hi Cesar,
> > You can find good documentation regarding this topic in the following link
> >
> > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/WSS_Ch7_KerbTechSupp.aspRegards,Pablo Cibrarohttp://weblogs.asp.net/cibraxhttp://www.lagash.com"CESAR DE LA TORRE [MVP]" <cdltll@hotmail.com> wrote in messagenews:55BFA492-4DEA-4015-B2FA-32899068B02B@microsoft.com...>I am using WSE 3.0 with Visual Studio 2005, specifically I'm using Kerberos> authentication and passing Kerberos ticket from Presentation Tier(VSTO.2005> client) to Server Tier through our Web Services (based on WSE 3.0).>> Having our WSE 3.0-WebService over Windows Server 2003, everything works> great, but, over Windows XP, I have a problem (which is documented in WSE> 3.0 help) but its workaround does not work properly (at least with my> current testing).>> The problem is that ASP.NET default user in Windows XP (ASPNET useraccount)> does not have privileges enough for running Kerberos authentication overWSE> 3.0 Web Services, so, by default, using ASPNET account, it does not work(we> get
> WSE910 exception).>> There is a MSFT sample where you can test it (WSSecurityKerberos) provided> with WSE 3.0 Setup.>> Also, WSE samples Help documentation says the same, and gives aworkaround:>=====================================================================================================================================================================> Running the Kerberos Sample - WSSecurityKerberos> On Microsoft® Windows® XP and Microsoft® Windows® 2000 Server, theKerberos> Security sample (WSSecurityKerberos) requires additional higher privilege> settings for the ASPNET account. There are several ways to enable this.One> is to give ASPNET account "Act as part of Operating System" privilegeusing> Local Security Setting, and then reboot the system. Another alternative is> to modify machine.config by setting the username attribute equal to"system"> in the ProcessModel element, and then reset IIS.>> NOTE: By default the policy version of the WSSecurityKerberos does notwork>