Kerberos Delegation

[Scott Elgram]

Hello,
I'm not sure if this is the right forum for this question but it is
security related so hopefully someone in here can help.
I have two servers,
Web01: Windows 2k Adv. Server running IIS 5.
Sql01: Windows 2k Adv Server Running SQL 7
I am trying to get user credentials to flow through Web01 to Sql01 so
that I can make use of the permissions that are already on the tables. For
the most part, about 70% of the time, everything is working just peachy and
there are no issues. However, that remaining 40% people are receiving the
following error:
------------------------------------------------------------
Message: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
Stack Trace: at
System.Data.SqlClient.ConnectionPool.GetConnection(Boolean& isInTransaction)
at
System.Data.SqlClient.SqlConnectionPoolManager.GetPooledConnection(SqlConnec
tionString options, Boolean& isInTransaction)
at System.Data.SqlClient.SqlConnection.Open()
at DataCollections.DirectEdit.AddPractice.Page_Load(Object sender,
EventArgs e)
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain()
------------------------------------------------------------
If I turn on auditing of successful logons for both Web01 and Sql01 I
can follow the flow down to Sql01 where I find the following entry in the
security log:
------------------------------------------------------------
Date: 12/06/2006 Source: Security
Time: 14:52 Category: Logon/Logoff
Type: Success Event ID: 538
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: Sql01
Description:
User Logoff:
User Name: ANONYMOUS LOGON
Domain: NT AUTHORITY
Logon ID: (0x0,0x6B5095F)
Logon Type: 3

------------------------------------------------------------
If anyone can offer any advice on why this is only happening some of the
time or how to fix/further trouble shoot this issue would be greatly
appreciated.

Thanks,

 

[Dominick Baier]

maybe these 40% don't do kerberos auth with the web server, have a look here:

http://msdn.microsoft.com/msdnmag/issues/05/09/SecurityBriefs/default.aspx

 

[Scott Elgram]

Mr. Baier,
Thank you for that, unfortunately I had seen that article and set it up
accordingly. For several months this had been working just fine but we
recently upgraded the hardware on the Web01 box and that is when the problem
started. One would think that if I missed one of these settings it would
not work 100% of the time instead of the 40% I see now. I am almost sure
that the solution is something simple but I just don't know what. For some
reason Web01 does not want to use Kerberos some of the time.

-Scott