No SPNs have been configured on SQL Server account error

josephdewey

Web Services works on the middle tier, but doesn't work anywhere else. I've followed all of the instructions on http://msdn.microsoft.com/en-us/library/dd301254.aspx , so I need help on what I can look at next.

I have the Role Tailored Client connected, and it's working well. I'm now trying to get Web Services to work somewhere besides just the middle tier. I'm using a three-tiered environment.

I'm getting a "The request failed with HTTP status 401: Unauthorized" error when using some web services, or on my third tier, where the RTC works, then it asks me to log in, instead of passing my credentials through, and then errors no matter what credentials I enter. When it works on the middle tier, it doesn't ask me to enter credentials, so I think that's what it's supposed to do.

I'm running the Best Practices Analyzer, and it gives me the following error:

No SPNs have been configured 'MSSQLSvc/NAVTEST' on SQL Server account 'corp\rtcuser'.

However, I have the following SPNs set up already:

U:\>setspn -Q DynamicsNAV/*
Checking domain DC=corp,DC=company,DC=com
CN=RTCUSER,OU=Misc.,OU=USA,OU=Global,DC=corp,DC=company,DC=com
        MSSQLSvc/NAVTEST:1433
        MSSQLSvc/NAVTEST.corp.company.com:1433

I set these up by using the following commands to set up my SPNs:

setspn -A MSSQLSvc/NAVTEST.corp.company.com:1433 corp\rtcuser

setspn -A MSSQLSvc/NAVTEST:1433 corp\rtcuser

"navtest" is the machine with SQL Server on it. "corp\rtcuser" is the user I'm using for the services. And, the real company isn't really company.com due to clever editing on my part.

I'm really not sure what to test or try next. If anybody has any ideas, that would be awesome. Thanks!

josephdewey

I still have my big problem, but I found the solution to the error of: No SPNs have been configured 'MSSQLSvc/NAVTEST' on SQL Server account 'corp\rtcuser,' when they already existed.

It was to delete the existing SPNs and then recreate them in reverse order:

setspn -D MSSQLSvc/NAVTEST.corp.company.com:1433 corp\RTCUSER

setspn -D MSSQLSvc/NAVTEST:1433 corp\RTCUSER

setspn -A MSSQLSvc/NAVTEST:1433 corp\RTCUSER

setspn -A MSSQLSvc/NAVTEST.corp.company.com:1433 corp\RTCUSER

So, I think that's actually probably a bug in the Best Practices Analyzer, and it wasn't actually a real problem.

But, I still can't connect anywhere outside of the middle tier. Now the Best Practices Analyzer shows everything to be perfect, but I'm still getting the 401 errors when trying to connect from another machine besides the middle tier machine.

Thanks in advance for any help!