CODEWITHSUNDEEP
asp.net-mvcauthenticationiisdelegation
Olivier FAIVRE
Olivier FAIVRE

Reputation: 1

IIS can't validate some of my windows tokens coming from approved AD Domains

my ASPNet application on IIS Server is using Windows Authentication, anonymous authentication is disabled, Negotiate is in first position for authentication Providers. The users members of the A.D. domain in which the IIS server is joined can login transparently. The users from another approved domain are asked to enter their credentials without success, the credentials popup continuously appears. It seems ISS pool account is not able to validate user's token when they are from an approved domain. Any idea, thanks

Is there a link with delegation authorizations?

Upvotes: 0

Views: 29

Answers (1)

Jalpa Panchal
Jalpa Panchal

Reputation: 12789

  1. First make sure you have created trust in the active directory. you can do it by going to the Active Directory Domains and Trusts properties setting. that will make sure that the there is trust between two AD domains.

  2. After that in iis enable windows authentication. set the Negotiate first and NTLM second in the provider list.

  3. Try to set the app pool identity to the domain user who has the enogh permission

  4. In the authorization set allow users to *

  5. set the SPN: setspn -A HTTP/<your_server_name> <domain\service_account>

https://techcommunity.microsoft.com/blog/iis-support-blog/service-principal-name-spn-checklist-for-kerberos-authentication-with-iis-7-07-5/347639

Upvotes: 0

Related Questions