Kerberos Double Hop

Question

We have the infamous Kerberos double hop issue.

This is a brand new domain, being migrated from another provider where impersonation and delegation was previously working. We have upgraded OS's and to the latest SQL server (2017).

WPF app (using domain creds) -> Web Service (WCF app on IIS 10) -> SQL 2017 (named instance)

The web service is running under a domain account. The web service has an spn registered, Anonymous Auth is disabled as is forms auth, ASP.NET Impersonation and Windows Auth is enabled. Providers are "Negotiate and NTLM," "Kernal Mode" is disabled, "Use App Pool credentials" is enabled. SPN created:

HTTP/<url of web service> <AppPool Creds> 

We are able to login to the web service via a browser on a remote computer, enter domain credentials and have the expected response (web page displayed). IIS Log shows domain user creds as expected.

The SQL server is a named instance, running under domain creds. SPNs created:

MSSQLSvc/<fqdn>:<Instance> <SQL Domain Creds>

MSSQLSvc/<sql server netbios>:<Instance> <SQL Domain Creds>

MSSQLSvc/<fqdn>:<port> <SQL Domain Creds>

MSSQLSvc/<sql server netbios>:<port> <SQL Domain Creds>

The IIS App Pool user account in AD is setup for constrained delegation to the SQL server for both the port and the named instance.

When logging in through software to web service (WPF calling WCF Service with no database call), a normal response is seen.

When logging in through software to web service with a database call, sql profiler shows Anonymous Logon. With Kerberos Logging enabled on IIS box, the following error is received:

Error Code: 0xd KDC_ERR_BADOPTION

Extended Error: 0xc0000225 KLIN(0)

Server Name: MSSQLSvc/<sql server fqdn>:49942

Target Name: MSSQLSvc/<sql server fqdn>:49942@<domain.com>

We also tried unconstrained delegation, but received same result.

SETSPN -X shows no duplicates.

Thank you in advance for your help!

Answer 1

When all else fails, and you've literally spent days and days working on the problem and reading every article on the Internet:

REBOOT

Yup. That was the fix. Rebooting the IIS server which was the server delegating the permissions, fixed the issue.

For those looking to quickly and easily setup constrained delegation between IIS and an instance of SQL, both running under custom domain creds, set your settings exactly as above and reboot.

Best wishes.