IIS Kerberos authentication issues

[#1]

Hello,

I'm having the dreaded problem of Java InfoView SSO working properly, but not the IIS InfoView. I get the windows logon prompt on my workstations (works fine from the BOE server itself). I know others have had similar problems and in looking around, I seem to have everything configured properly, but still no luck getting the IIS InfoView to SSO. My service account has the following SPNs:

HTTP/BOEServerIP

HTTP/Servername.Domain.com

BOSSO/Servername.Domain.com

HTTP/Servername

HTTP/Servername.Domain2.com

Domain and Domain2 are in the same forest and a trust is there. Something that may be an issue is that the server is in Domain2 while the service account is in Domain. Default domain for the krb5.ini and in the CMC is Domain.com. As I said, Java InfoView SSO works perfectly.

Additionally, service account has admin rights (and all other rights that are needed) on the BOE box and is added to the IIS_WPG group. I checked to make sure that IIS was configured to support both the Kerberos protocol and the NTLM protocol. App pool is logging in with the service account.

Not sure what I'm still missing or what are the next steps I can take to troubleshoot. Any help is appreciated.

Thanks,

Eric

[BasicTek · Accepted solution]

Not many have had this issue as the Admin guide states that running IIS and tomcat SSO on the same server is not supported. I have tested the configuration in house and found that it does in fact work rather well.

If the service account is being used for both java and .net then the delegation portion should be considered ok (anything that breaks IIS in this respect would also break java SSO).

A prompt would occur if the web site does not qualify as a local intraanet site (any periods or are you using the hostname)?

Have you set the identity impersonate ="true" in the infoviewapp and platformservices web.configs?

If you switch to NTLM does IIS work (I know that will break java but just for a test).

Regards,

Tim

[Former Member · Accepted solution]

Hi Tim,

Thanks for the reply. Yes, identity impersonate had been set, but I will double check when I'm back on site. I assumed it was ok if it's working on the server. We're using the hostname and it's been added to the local intranet sites. I did try NTLM, but it didn't work. Same behavior from the workstation, but I got 'An error has occurred' from InfoView on the server side.

Thanks,

Eric

[BasicTek · Accepted solution]

that's our issue if NTLM won't work which requires very little configuration. If you check the IIS logs is the username being received by IIS? check the latest log search from the bottom up for infoviewapp. There should be a 401 followed by a 200 with the domain\username

regards,

Tim