Kerberos headache

[Tapio Kulmala]

Hi!

I've found an interesting problem that might have something to do with
Kerberos.

I have a www application running in a Windows Server 2003 box. The
server did not have SP1 or SP2 installed. Everything was working
smoothly. Couple days ago we installed SP2 and weird authentication
errors started to occur occasionally.

The webapp is configured to use intergrated authentication ( and
impersonation). It makes calls to a webservice (on the same server) that
allows integrated and basic authentication.

I thought that the whole chain uses NTLM-authentication and Kerberos is
not used at all. Now it seems that sometimes the call from the webapp to
the webservice fails and the security-eventlog shows an failed logon.

Logon Failure:
Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: MYSERVER
Status code: 0xC000040A
Substatus code: 0x0
Caller User Name: MYSERVER
Caller Domain: MYDOMAIN
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 828
Transited Services: -
Source Network Address: -
Source Port: -

What is going on? Why only some calls fail and not all? Why did't this
occur with the RTM version?
Tapio

--
************************************************** **************
Tapio Kulmala

"Those are my principles. If you don't like them I have others."

- Groucho Marx
************************************************** **************

[Tapio Kulmala]

Typical admins can't figure these things out. I'll have to write them
instructions. :(

This customer is a quite small company and they propably don't have many
DC's. Like I said, I'll have to ask them for more details. I'll post
more info here when I get some.

Tapio

[Tapio Kulmala]

Got more information.

The AD is 2000 AD in native mode. All server accounts and user accounts
(in AD) have "Trust computer for delegation" / "Account is trusted for
delegation" set to OFF.
The next question is, why the front end server tries to use the protocol
transition/S4U from Ntlm to Kerberos?

DCs don't support it and accounts are not marked for unconstrained
delegation. The webservice is on the same server so why does it even try
S4USelf? I haven't noticed this kind of behavior with 2003 RTM.

I even checked the C# code. It doesn't do anything too "clever". Just
the usual :

ws.Credentials = System.Net.CredentialCache.DefaultCredentials;


Tapio