EPiServer Authentication using Kerberos and Custom App Pool Identity
I recently had a hard time to get Windows authentication working properly.
I installed a standard EPiServer CMS SP3, with Authentication mode "windows", and configured the site to use integrated security against the Sql Server.
This was going to be the intranet site, or at least the test site for the intranet.
The window dialog appeared and despite supplying all kinds of usernames and passwords, the site refused to accept my credentials.
What has happened? This is usually working fine out of the box with a minimum of necessary brain activity.
It took half a day before I found the solution, and I hope that anyone that encounter the same problem, will find some help here.
Problem
The problem was that the site (Application pool) was running under a custom identity, and that browsing was against the computer name, which means that Kerberos authentication is being used.
Browsing with the IP or the DNS alias, was no problem at all, since NTLM handshake works fine. Single sign on without any hesitation.
Solution
Log on the webserver using a domain admin account.
Download the SPN tool, and install it.
Start command prompt in the same directory as you installed setspn.
Use the setspn command to authenticate the account on the server/domain.
Syntax:
setspn -A HTTP/<servername> <domain>\<account>
example:
"setspn -A HTTP/srv01 domain1\episervice"
"setspn -A HTTP/srv01.mycomppany.com domain1\episervice"
etc
You must authenticate all hosts, otherwise it won't work.
You can list all hosts with "setspn -l <servername>"
Note that this is only necessary to do when you run the website under a pre configured account, in other more common scenarios, the Kerberos authentication will work just fine.
Oct 01, 2008
On a similar note. I recently had an issue where I kept getting prompted for credentials after enabling Integrated Windows authentication. The environment is typical development machine, a Windows Server 2003 with IIS, EPiServer, Visual Studio and Internet Explorer all running locally on the server. For whatever reason, it appears that IIS will insist on using Negotiate authentication, and thus try Kerberos and fail. It should fall back to NTML I think, but it doesn't. The solution in this case was to edit C:\Windows\system32\inetsrv\MetaBase.xml . Add/Change the NTAuthenticationProviders attribute to "NTML" under the IISWebServer element for the affected virtual servers. For convenience you might want to add the site to the Intranet zone, since you'll not get prompted at all then using the standard settings. Anyone know a better solution, or the exact reason why it fails to fallback to NTLM automatically?