Fredrik von Werder
Oct 1, 2008
(0 votes)

EPiServer Authentication using Kerberos and Custom App Pool Identity

This article describes how to get Kerberos handshake to work when the website is running with a pre configured account. It will only happen if you are browsing to the "computer's name", otherwise NTLM is used, which is the most common scenario.

I recently had a hard time to get Windows authentication working properly.

I installed a standard EPiServer CMS SP3, with Authentication mode "windows", and configured the site to use integrated security against the Sql Server.

This was going to be the intranet site, or at least the test site for the intranet.

The window dialog appeared and despite supplying all kinds of usernames and passwords, the site refused to accept my credentials.

What has happened? This is usually working fine out of the box with a minimum of necessary brain activity.

It took half a day before I found the solution, and I hope that anyone that encounter the same problem, will find some help here.


The problem was that the site (Application pool) was running under a custom identity, and that browsing was against the computer name, which means that Kerberos authentication is being used.

Browsing with the IP or the DNS alias, was no problem at all, since NTLM handshake works fine. Single sign on without any hesitation.


Log on the webserver using a domain admin account.

Download the SPN tool, and install it.

Start command prompt in the same directory as you installed setspn.

Use the setspn command to authenticate the account on the server/domain.
setspn -A HTTP/<servername> <domain>\<account>

"setspn -A HTTP/srv01 domain1\episervice"
"setspn -A HTTP/ domain1\episervice"

You must authenticate all hosts, otherwise it won't work.

You can list all hosts with "setspn -l <servername>"

Note that this is only necessary to do when you run the website under a pre configured account, in other more common scenarios, the Kerberos authentication will work just fine.
Oct 01, 2008


Svante Seleborg
Svante Seleborg Sep 21, 2010 10:32 AM

On a similar note. I recently had an issue where I kept getting prompted for credentials after enabling Integrated Windows authentication. The environment is typical development machine, a Windows Server 2003 with IIS, EPiServer, Visual Studio and Internet Explorer all running locally on the server. For whatever reason, it appears that IIS will insist on using Negotiate authentication, and thus try Kerberos and fail. It should fall back to NTML I think, but it doesn't. The solution in this case was to edit C:\Windows\system32\inetsrv\MetaBase.xml . Add/Change the NTAuthenticationProviders attribute to "NTML" under the IISWebServer element for the affected virtual servers. For convenience you might want to add the site to the Intranet zone, since you'll not get prompted at all then using the standard settings. Anyone know a better solution, or the exact reason why it fails to fallback to NTLM automatically?

Please login to comment.
Latest blogs
How to use CacheTagHelper with content areas in Optimizely CMS 12

I might be going out on a limb here - if you have a better solution, feel very free to share it!  Upgrading your Optimizely web application from .N...

Andreas J | Dec 2, 2022

The 1001st Piece in your 1000 Piece Puzzle: .NET Default Interface Functions

I was recently working with a client who wanted a reasonably large subsystem added to Optimizely that would add automated management to their...

Greg J | Nov 28, 2022 | Syndicated blog

Video Demonstration, creating a CMS12 Alloy Sample Site

Hey All Below you will find a quick video demonstration on how to install a local version of Alloy Sample based on CMS12 / .Net 6. As you will see ...

Minesh Shah (Netcel) | Nov 28, 2022

How to create an admin user I Optimizely CMS – with Episerver CLI

In this blog post I’ll show how to create an admin user for Optimizely CMS in a new environment where you don’t have access to the admin interface.

Ove Lartelius | Nov 28, 2022 | Syndicated blog