Kerberos 3 Tier Install Nightmare

pfancy79

Hi,

I am currently having an issue with installing NAV 2009 R2 on a 3 Tier environment.
I have followed the MSDN walk-through and spent many many hours searching and reading through various blogs e.t.c, but without finding a successful result.

The problem that I am experiencing is when running the RTC from a client machine I am getting "The Login failed when connecting to SQL Server XXXXX".
Obviously this error has been reported many times and nearly always is an issue with delegation and SPN's. I am fairly sure that I have set this all up correctly.

Environment:

SQLServer
Server 2003
SQL 2005
The service is running under LocalSystem.

NAV Server
Server 2008
The service is running under XXXXX\NAVRTCService which for the purpose of testing has been set as DOMAIN ADMIN.

Config file has been setup correctly to point to the database. This works as an RTC client on NAV Server connects correctly.

SPN's
setspn -A DynamicsNAVSpikes/W2008-TS.XXXXX.local:7046 XXXXX\NAVRTCService
setspn -A DynamicsNAVSpikes/W2008-TS:7046 XXXXX\NAVRTCService
setspn -A MSSQLSvc/SQLSRV1.XXXXX.local:1433 XXXXX\NAVRTCService

Delegation then set against User Active Directory object for both services. Have tried just the SQL one but made no difference.
Have tried allowing delegation for any service option but this made no difference.

No duplicate SPN's found

When connecting I get a Security event on NAV Server saying that user XXXXX\Paul authenticated by Kerberos.
On SQL Server get a Security event saying that NT AUTHORITY\ANONYMOUS USER logged on using NTLM.

Have tried both AllowNTLM = true and false on the UserSettings.config on client machine.

Have run out of ideas now and feel that going around in circles.

Also have made sure that before each connection attempt that KLIST PURGE has been called on all 3 machines.

Any one have any suggestions, or even words of encouragement would be grateful.

Thanks

Paul

kine

The problem is:

1) SQL is under localsystem - it have no access to network. Use the Network service account instead
2) If you are using system service, the account for the SPN must be the server domain account, it means

setspn -A MSSQLSvc/SQLSRV1.XXXXX.local:1433 XXXXX\SQLSRV1$

kine

And I recommend to use this tool> http://www.iis.net/community/default.as ... g=6&i=1887

You can easily use it to check what is needed for connecting your "frontend" (NST) to the "backend" (SQL).