I'm getting an error when trying to write data to a SmO from an InfoPath form.  The error is "Server was unable to process request. ---> Message: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'..."  I can't seem to figure out why it is trying to use Anonymous instead of my user credentials.  Any help would be appreciated.

---

Thanks,
Jason Thrasher

Sounds like a potential Kerberos issue.

 

---

Colin
K2 Insider
K2 Blog: K2 Thought

I was under the impression this would not be a Kerberos issue because all the services run on one machine (MOSS 2007, K2, SQL). 

 Actually now that I think about it...I'm using the Dynamic SQL Service to connect to an external SQL Server (not the same as the one K2 uses), do I need Kerberos setup to connect from my K2 server to the external SQL server when using a SmO?  All this Kerberos stuff isn't very clear.

---

Thanks,
Jason Thrasher

jthrasher:

I was under the impression this would not be a Kerberos issue because all the services run on one machine (MOSS 2007, K2, SQL). 

 Actually now that I think about it...I'm using the Dynamic SQL Service to connect to an external SQL Server (not the same as the one K2 uses), do I need Kerberos setup to connect from my K2 server to the external SQL server when using a SmO?  All this Kerberos stuff isn't very clear.

 Any time you have more than two machines involved in the loop and you are using integrated authentication you need Kerberos. In this instance, you probably have:

InfoPath (client machine) -> K2 Server -> SQL Server

As a quick means of validating this, you could attempt to run the InfoPath form on the K2 Server. Then you'd just have two machines in the mix (since the InfoPath form is running on the same machine as the K2 Server).

So, either do the work to enable Kerberos or specify credentials for the Dynamic SQL Service rather than use integrated (last time I checked there was a bug with specifying your own credentials and the Dynamic SQL Service, but it might have been fixed).

---

Colin
K2 Insider
K2 Blog: K2 Thought

Ok, I think I understand.  So my next question is...I already have Kerberos setup for my production environment, can I use the same SPNs and just add more entries for the development server?  Or would it be better to setup different accounts for the Development server?  Thanks for all your help.

 Jason

---

Thanks,
Jason Thrasher

jthrasher:

Ok, I think I understand.  So my next question is...I already have Kerberos setup for my production environment, can I use the same SPNs and just add more entries for the development server?  Or would it be better to setup different accounts for the Development server?  Thanks for all your help.

 Jason

Do you use the same accounts for Dev & Prod? Generally, I recommend different accounts for every environment, and therefore, different SPNs for every environment.

---

Colin
K2 Insider
K2 Blog: K2 Thought