Underground Coding

K2.net and beyond....

DelegConfig (Delegation / Kerberos Configuration Tool) from iis.net

DelegConfig (Delegation / Kerberos Configuration Tool) from iis.net

A co-worker of mine (thanks Kevin) sent me information this morning on a tool for trouble-shooting Kerberos settings in IIS called DelegConfig.  This a 'must-have' tool for setting up Kerberos for your K2.net Web Server.

This utility is a little ASP.NET v1.1. app you drop in a folder on your site to reveal the current Kerberos configuration settings for the web server and will additionally will troubleshoot Kerberos settings on your back end servers/services that the web server will connect to with the Kerberos Protocol (i.e. Active Directory, SQL Server, etc).

This tool will checks the following:

Service Account
1. Checks if the service account is a domain account.
2. Checks if the service account has a valid Service Principal Name (SPN)
3. Checks for duplicate SPN's.
4. Checks to see if the account is trusted for delegation (full or constrained).

Authenticated User
1. Checks to see if the account you are connecting with to the web site is a domain account
2. Checks the authentication method (NTLM/Kerberos/Basic, etc).

Backend Servers
1. Allows you to add backend servers (the other hops) to test to make sure those service accounts are setup properly.
    a. sadly K2.net isn't an option for the backend server, I'm going to look into getting this added.

Based on all of the tests run above this utility gives a final pass/fail and for each test you will gain a lot of insight as to what settings are being checked and how to fix them if they are broken.

Even if you aren't having problems and want to educate yourself on how Kerberos works, this tool is an excellent resource.

You can download DelegConfig here.

Published Wednesday, June 06, 2007 4:28 PM by j.monty

Comments

No Comments
Anonymous comments are disabled

About j.monty

I have the privilege of working for an excellent Microsoft Partner and SouceCode Partner, ATGi for the past 13+ years. I have a real passion for software, computer security, and most things technical. For the past couple years I've been working with the DoD architecting K2 solutions. My interests are Computer and Internet/Computer Security, Workflow, and all that is .NET.