spn 3 tier webservices nav2009R2

Comments

• Options

  SandeepPoonia Member Posts: 5

  2015-04-06

  Did you configure SPN for Application & Database for same account or diffrent account?

  0
• Options

  soetie Member Posts: 61

  2015-04-06

  Thanks for reply
  
  Sa-sql is database service account.
  Sa-web service is for webservice
  
  The spn's are set as Descriped in first Post
  do i miss some Spn
  
  (App 01 is webservice server sql 01 sql server)

  0
• Options

  SandeepPoonia Member Posts: 5

  2015-04-07

  Please use the below link Installing the Three Tiers on Three Computers.
  
  https://msdn.microsoft.com/en-us/library/dd301254.aspx
  
  It will clear the concept of Three Tier.

  0
• Options

  soetie Member Posts: 61

  2015-04-07

  already followed the instruction but still no luck.
  
  already have some spn:
  On the Delegation tab, click Trust this user for delegation to specified services only, and then click Use Kerberos only. also set
  
  'but still the error:
  Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Could not find a login matching the name provided.

  0
• Options

  SandeepPoonia Member Posts: 5

  2015-04-08

  You need to add the service to which this account can be present delegated credentials for Nav Server account.

  0
• Options

  soetie Member Posts: 61

  2015-04-08

  Please specify,
  
  You need to add the service to which this account can be present delegated credentials for Nav Server account.
  
  This account, which account do you mean? and which service do you mean? sql service, or nav web service?
  Could you please describe what to do?
  
  otherwise i dont get it/
  
  thanks

  0
• Options

  SandeepPoonia Member Posts: 5

  2015-04-08

  Yes. this is part of delegation. When you open property of Application server account, on delegation tab you have to add SQL service with Port Number as you have already created for Database server.

  0
• Options

  soetie Member Posts: 61

  2015-04-08

  to bad, setting was already set, and still same error

  0
• Options

  ErictP Member Posts: 164

  2015-04-08

  I think the delegation is missing on the service-account.
  
  Try this one:
  
  setspn -A instancename/Servername.Domain.local:port Domain\serviceaccount
  
  In your case:
  setspn -A DAW/APP-01.domain.local:7046 domain\sa-webservice

  0
• Options

  soetie Member Posts: 61

  2015-04-08

  hi
  
  so from active directory i have removed all spn's which where added,
  ran: klist purge, and rebooted everything.
  
  my 2 servers and service account are set to delegate to al services kerberos only, and the accounts are set to accounts are trusted.
  
  `this is what i have right now:
  C:\Windows\system32>setspn -l domain\-SQL-01 SQL SERVER
  Geregistreerde ServicePrincipalNames voor CN=-SQL-01,OU=Servers,OU=BKF,DC
  =domain,DC=local:
  WSMAN/-SQL-01
  WSMAN/-SQL-01.domain.local
  TERMSRV/-SQL-01
  TERMSRV/-SQL-01.domain.local
  RestrictedKrbHost/-SQL-01
  HOST/-SQL-01
  RestrictedKrbHost/-SQL-01.domain.local
  HOST/-SQL-01.domain.local
  
  C:\Windows\system32>setspn -l [b]domain\-APP-01 NAV SERVER[/b]
  Geregistreerde ServicePrincipalNames voor CN=-APP-01,OU=Servers,OU=BKF,DC
  =domain,DC=local:
  WSMAN/-APP-01.domain.local
  WSMAN/-APP-01
  TERMSRV/-APP-01
  TERMSRV/-APP-01.domain.local
  HOST/-APP-01
  HOST/-APP-01.domain.local
  
  C:\Windows\system32>setspn -l domain\sa-sql SA SERVICE ACCOUNT
  Geregistreerde ServicePrincipalNames voor CN=sa-sql,OU=Service,OU=Accounts,OU=BK
  F,DC=domain,DC=local:
  MSSQLSvc/-SQL-01.domain.local:1433
  MSSQLSvc/-SQL-01.domain.local
  
  C:\Windows\system32>setspn -l domain\sa-webservice nav webservice account
  Geregistreerde ServicePrincipalNames voor CN=sa-webservice,OU=Service,OU=Account
  s,OU=BKF,DC=domain,DC=local:
  
  C:\Windows\system32>

  0
• Options

  SandeepPoonia Member Posts: 5

  2015-04-08

  Revert whatever you have done for Three Tier Configuration and follow the step as given in below link. It will resolve your problem.
  
  https://msdn.microsoft.com/en-us/library/dd301254.aspx

  0
• Options

  soetie Member Posts: 61

  2015-04-08

  added
  
  setspn -A DAW/-APP-01:7046 domain\sa-webservice
  setspn -A DAW/-APP-01.domain.local:7046 domain\sa-webservice
  
  setspn -A MSSQLSvc/-SQL-01.domain.local:1433 domain\sa-sql
  setspn -A MSSQLSvc/-SQL-01:1433 domain\sa-sql
  
  setspn -A DAW/-APP-01.domain.local:7047 domain\sa-webservice
  setspn -A DAW/-APP-01:7047 domain\sa-webservice
  
  restarted sql and nav server:
  logged in from daw portal:
  Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Could not find a login matching the name provided. [CLIENT: 192.168.6.4]
  -
  The login failed when connecting to SQL Server

  0