Sharepoint 2007 is configured to use kerberos auth. This works well by passing the ISA server.
ISA 2006 is installed without using a service account(domain user ) MS Firewall service is running on Network Service, all other services are running on local system.
Have configured the kerberos onstrained delegation on isa server computer account. Choosing delegation tab - trust this computer for delegation to specified service only-use any authentication protocol - and selecting http service for both frontend servers.
I get the following error when i try to access the published sites
Error Code: 403 Forbidden. The server denied the specified Uniform Resource Locator (URL). Contact the server administrator. (12202) on the bowser
or
12202 The ISA Server denied the specified Uniform Resource Locator (URL).
and on the isa alert i get the following
ISA Server failed to delegate credentials using Kerberos constrained delegation to the Web site published by the rule library.embc.uk.com. Check that the SPN: http/frontend-01.test.loca
l configured in ISA Server matches the SPN in Active Directory.
Had a look on Active directory using ADSIEDIT on SPN i can see
host /isasvr01
host /isasvr01.test.local
ldap /isasvr01.test.local
mssqlsvc/isasvr01.test.loc
al etc
The sharepoint server is configured using host headers - extranet.test.eu.com and a certificate generated using SAN certificate.
Publishing wizard -
From anywhere -
webfarm: extranet.test.eu.com , cookie based, forward the original header unchecked, request appears
to come from ISAServer
Auth Delegation - Kerberos constrained delegation SPN http/*
Listener -
Network - external and internal
Connection -http ad https redirect all traffic to https
Certificate - assinged to ip address
sso - disabled
Form- selected to use default
Authentication -HTML Form Auth
Method - Windows
When i change the auth delegation on the rule to NTLM it works . What am i doing wrong with kerberos config.
Confused on the SPN config , if i'm using webfarm , should i use http/*
Start Free Trial
