Kerberos only works with certain DNS entries (IIS Website)

-

have odd , frustrating issue using kerberos authentication iis site.
works form hostnames, not others (and it's not obvious!)
i've tried provide info can.
i've detailed environment first, , detail issue.

environment configuration:
secure development environment intranet.
windows server 2012r2 iis 8
2 ad controllers
dedicated domain - devdomain.co.uk
there no proxy servers or firewalls between of servers or client pc - it's virtual dev platform.

webserver - devcms1 - running single website
windows authentication enabled - else disabled
providers configured negotiate ntlm
kernel mode authentication enabled
website app pool running under domain account - cmsapppool
website has following bindings - 
hostname=any ip=all unassigned port=80
hostname=cms.devdomain.co.uk ip=all unassigned port=80

there dns (a record) entry cms.devdomain.co.uk resolves ip of webserver

client pc win 7, member of domain
internet explorer configured url's in local intranet zone
enable integrated windows authentication enabled.

following spn commands have been run
setspn -s http/devcms1 devdomain\cmsapppool
setspn -s http/devcms1.devdomain.co.uk devdomain\cmsapppool
setspn -s http/cms.devdomain.co.uk devdomain\cmsapppool

there no duplicate spn's - confirmed using spnhelper script

scenarios , problem:
if browse http://devcms1 automatically logged in , kerberos being used  - confirmed fiddler , wireshark
if browse http://devcms1.devdomain.co.uk automatically logged in , kerberos being used - confirmed fiddler , wireshark
if browse http://cms.devdomain.co.uk receive log in prompt despite entering correct credentials results in an access denied after 3 attempts. fiddler , wireshark show kerberos being used.
above url's resolve same webserver , website. url's in local intranet zone in ie.

cannot understand why last scenario fails - why not work specific dns entry (one isn't automatically derived machine name).

have followed steps given in article - http://support2.microsoft.com/kb/929650

advice gratefully received @ wits end.

thanks

jason

hi jason,

looks there wrong web site configuration, suggest refer experts iis forum more efficient support:

http://forums.iis.net/

best regards,

amy



Windows Server  >  Directory Services



Comments

Post a Comment

Popular posts from this blog

Edit Group Policy

-
i have pc has power settings pushed out default domain policy in ad environment. of course on local machine "some settings managed system adminstrator". the machine temporarily no longer in contact domain controller (it's been physically moved , not on same network now) can't updated gpo settings. i believe if edit local group policy won't make difference because of group policy processing , precedence. since it's temporary away ad network, still want use settings of ad user. is there somewhere in registry stored can edit power plan manually until can sync domain? (i need prevent sleeping while plugged in - it's set 1 hour) thanks! allen crist i found site: http://gpsearch.azurewebsites.net/#7916 i able add policy to hkey_local_machine\software\policies\microsoft\power using specs found on site. looks solved issue. i'll report if didn't. thanks! allen crist ...
Read more

Hyper-V VM not reaching OS 'Logon' screen

-
i trying migrate vm vmware hyper-v. so far have done following (seemingly successfully): prepare vmware vm conversion hyper-v format (vhd) within vmware workstation 8.0 environment following steps guide: http://social.technet.microsoft.com/forums/en/winserverhyperv/thread/ef8c12f7-c45d-442e-9a30-c43cd87df3b3   (i.e. remove vm tools, add new ide hard disk…) use vmdk2vhd application convert individual vmdk files vhd ones create new vm in hyper-v exporting in 3 newly converted vhd files at point have checked settings , powered on vm in hyper-v find although windows begins load expected manages reach screen prior login screen saying either of following messages: “windows starting up…” “the active directory rebuilding indices… please wait” to knowledge, albeit limited in area, vm should present me login screen since appears in vmware. if start vm in safe mode can login not desired affect. below details of vm: operating system: windows server 2003 (enterprise edit...
Read more

DNS question...

-
i new setting dns server....my domain name expl. "domain.com"....i set "a" record in forward lookup for  www.domain.com itself...."server's local ip"....i've added no other zones , i seem able resolve names except own....www.domain.com.....also, do i put my isp's dns ip's....for external dns's server can't resolve?....forwarding or in nic setup?......i want setup in my dns server don't have include them on client side..... thanks mark     not put isp dsn server address in settings on nic dc or clients. should point local dns server on dc. set dns forward public dns, such isp. bill Windows Server  >  Network Infrastructure Servers
Read more