0

I'm trying to setup Kerberos constrained delegation to solve my double hop problem.


I'm using standard SQL Server configuration with Virtual Account (NT SERVICE\MSSQLSERVER) as a service account for all my instances.

When I'm trying to perform double hop query via Linked Server I get this typical error:

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

The setup looks like this:

User Computer > HOP > SQL Server A > HOP (Linked Server) > SQL Server B

And my query is just basic Select just for testing. Like this:

Select * From [Server B].[DB].[Scheme].[Table]

Using Kerberos Configuration Manager for SQL Server I verified SPNs and delegation settings for my servers.

SPNs are configured automatically: enter image description here

And delegation is set to None: enter image description here

I also checked what type of authentication does SQL Server uses. To check this I ran this query on Server A (from this article):

SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@spid ;

And got NTLM as a response.


According to this results it seems like I'm missing delegation settings. But my question is how should I go about it?

I've read countless articles and post and I still can not figure it out. It seems like it should be possible to just use default Virtual Account for this. But every tutorial I've found talks about either Domain Accounts or Managed Service Accounts. In such cases we have this accounts present inside Active Directory, but what about default virtual accounts? This accounts are local - how do I grant delegation permissions to them?

Should I grant delegation permission on the machine? But how?

I tried doing this. I went over to Active Directory, opened my Server A computer object and did this:

enter image description here

So it should allow Server A to delegate to Server B. But it still does not work. And Kerberos Configuration Manager still shows None as delegation type.

I'm using Windows Server 2019 and SQL Server 2019.


@EDIT

I tried using different setting. Instead of "Kerberos only" I selected "Use any authentication protocol" and after like 10 minutes it started working!.

It all makes sense now as SSMS connection still was done with NTLM the "Kerberos only" settings wouldn't work.

But the question is why it is still using NTLM? Is it bad and I should try to change it? If so - how?

2
  • Is there a reason you can't use a Managed Service Account?
    – AMtwo
    Sep 16, 2021 at 11:36
  • You need an account that has network access. Try a Domain Account, or preferrably and MSA or gMSA account... Jan 4, 2022 at 15:10

1 Answer 1

0

I know I'm a little late to the party, but I have using Kerberos authentication in my web applications for nearly 16 years, and the agency with which I work is converting their web applications to use Kerberos authentication. A few things to mention:

  1. Depending on your user base, I would use either a traditional Kerberos Constrained Delegation or Resource-Based Kerberos Constrained Delegation. The difference is a traditional delegation has a single domain limitation, regardless of whether it is a forest or single domain. Resource-Based Delegations do not have a domain limitation (rumor has it that they can even cross forest boundaries but I haven't had the opportunity to try that yet)

  2. Unconstrained delegation is NOT a good idea-there are vulnerabilities associated with unconstrained accounts that could lead to someone taking over your domain/forest

  3. If you are still seeing NTLM being used as the authentication package, then I would remove everything except Negotiate:Kerberos once you know all of the service principal names have been registered under the correct accounts. There are some additional configuration in Windows and IIS that you have to modify, depending on whether a domain account is used to run the application pool(s) or ApplicationPoolIdentity/NetworkService/LocalSystem

Hope this information helps someone!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.