IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

Kerberos przyjacielem mym

.neting in the free world — Fri, 11 Jul 2008 12:49:54 GMT

Coraz częściej w pracy stykam się z koniecznością ustawienia autentykacji poprzez protokół Kerberos ,

Kerberos przyjacielem twym

.neting in the free world — Fri, 11 Jul 2008 13:21:38 GMT

Coraz częściej w pracy stykam się z koniecznością ustawienia autentykacji poprzez protokół Kerberos ,

re: IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

Paul — Mon, 25 Aug 2008 16:42:44 GMT

Thank you Ken for "IIS and Kerberos" series - really helpful. Is there any way to disable NTLM completely and authenticate using Kerberos only? Thanks, paul

re: IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

Ken — Sat, 20 Sep 2008 12:17:53 GMT

Hi Paul,

No - that's not possible.

Cheers

Ken

re: IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

Saurabh — Tue, 28 Oct 2008 12:59:37 GMT

One word to express my gratitude would be fabulous. I recently came to know about your article series on Kerberos and seeing the exhaustive coverage I really admire the great work you have done. I myself belong to IIS support group within MS which deals with troubleshooting on kerberos issues for our customers, and your articles look very valuable indeed. Great work!

re: IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

Steve Hall — Tue, 28 Oct 2008 17:32:34 GMT

Ken, we have a MOSS environment and are planning out an integrated SQL reporting solution. The SQL reporting database is kept on a seperate clustered SQL instance. This configuration will exceed the double hop limit of NTLM. We currently have a cross-forest setup but only a one way trust. A two way trust will never be allowed. If kerberos requires a two way trust for delegation, and we can't have a two way trust, are we hosed? Are there any other solutions that will meet our needs?

re: IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

rob — Mon, 01 Dec 2008 04:02:45 GMT

This is an A+ series of posts. Having the captures downloadable to read along with kicks ass. Thanks for putting in the effort to do this.

re: IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

chris — Tue, 30 Dec 2008 01:14:14 GMT

if i have users in forest A, and Resources (servers, and applications) in forest b. and I run one of my applications as an user that resides in forest A. There is a one way trust where Forest B trusts Forest B. Will i be able to use delegation in this scenario since both the service account that will be delegated to is in the same forest as the accounts being impersonated? Or is it a hard rule that to use delegation where 2 forests are involved you HAVE to have a 2 way trust

re: IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

Ken — Thu, 12 Feb 2009 04:50:06 GMT

Hi Chris,

Sorry to take so long to get back to you. I'm not 100% sure about your situation. Will have to investigate and get back to you!

IIS and Kerberos Part 9 - Cross Forest Delegation scenario with UPN suffix routing

Ken Schaefer — Thu, 26 Feb 2009 12:24:33 GMT

As an extension of the previous article on Cross Forest (or Cross Domain) Kerberos Authentication this

re: IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

Malcolm Gin — Mon, 02 Mar 2009 16:39:49 GMT

Ken, In our environment, we are working in a single forest but multiple domains. Is a two-way trust required in this model? We seem to have indications that Kerberos constrained delegation is working properly for us even though we are using a one-way trust. If/when we have conclusive proof, I'll try to come back and follow up. Thanks, M

Vidar's Musings ?? The mother lode for IIS, Kerberos and IWA information

Vidar's Musings ?? The mother lode for IIS, Kerberos and IWA information — Fri, 06 Mar 2009 09:55:13 GMT

PingBack from http://www.kongsli.net/nblog/2009/03/06/the-mother-lode-for-iis-kerberos-and-iwa-information/

re: IIS and Kerberos Part 8 - a simple cross Forest/Domain delegation scenario

Ken — Mon, 09 Mar 2009 09:21:12 GMT

Hi Malcom,

You have configured one-way trust between two domains in the same Forest? (I know that this is insufficient across Forests - because I tried for several days to get that working :-))

Can you tell us which domains your users and resources are in?