I am having trouble getting SQL 2005 to authenticate using Kerberos.
Regardless of what I try the authentication always goes through NTLM.
Following is the situation:
We have a test domain setup with a substantial amount of servers. I know
that Kerberos is properly setup in that domain because many different test
SharePoint deployments under different configurations has been successfully
setup and it all cases it has been verified that Kerberos is being used as
the authentication mechanism between servers.
However, all the connections from these SharePoint servers to the SQL Server
2005 servers are authenticating using NTLM. The way I am checking the
authentication mechanism is running the following query and checking the
value displayed in the auth_scheme column:
Use Master
select * from sys.dm_exec_connections
I tried removing IIS from the equation and tested connecting from one SQL
box in the same domain to another one using SQL Server Management Studio. The
results are the same, the server is authenticating using NTLM.
All the SQL instances I am working with are 1+1 Clusters with two active
instances. They are all installed over Windows 2003 Server and with SQL 2005
SP2 applied. I checked in the cluster administrator tool and Kerberos seems
to be enabled (the check box is selected in the cluster name resource and
everything is online).
Could someone give me some guidance on how to troubleshoot this problem?
Thanks!
Camilo
Camilo,
One possibility is that you are the victim of a duplicate SPN. Here are a
couple of links discussing that.
http://www.planetmagpie.com/itconsulting/technotes-060205.aspx
http://support.microsoft.com/kb/832109
I am not an expert on this, but I have experienced this problem a couple of
times and had to get a domain admin to fix it.
RLF
>I am having trouble getting SQL 2005 to authenticate using Kerberos.
> Regardless of what I try the authentication always goes through NTLM.
[quoted text clipped - 34 lines]
>
> Camilo
Camilo - 21 Feb 2008 19:57 GMT
Thank you Rusell!
At the en it was an SPN issue. They were not duplicate but htey were setup
wrong.
The first issue was that they were using the wrong FQDN, pointing to a DNS
alias that was not the physucal host and the second issue was that the they
were including the instance name in the FQDN.
Once again,
Thanks!
Camilo
Russell Fields - 21 Feb 2008 22:12 GMT
Camilo,
Very glad to hear that you were able to get it worked out.
RLF
> Thank you Rusell!
>
[quoted text clipped - 10 lines]
>
> Camilo