Contents
What happens when the Kerberos ticket request fails?
When the Kerberos ticket request fails, Kerberos authentication isn’t used. NTLM fallback may occur, because the SPN requested is unknown to the DC. If the DC is unreachable, no NTLM fallback occurs. To declare an SPN, see the following article: How to use SPNs when you configure Web applications that are hosted on Internet Information Services.
Kerberos authentication to SharePoint 2013 site on default port 80 with a single SharePoint Web Server (Windows Server 2008 R2) from Windows 7/2008R2, IE 9. (using Basic delegation/Unconstrained delegation)
Do you need NTLM or Kerberos for SharePoint?
As I was installing SharePoint 2013 it asked me if I wanted NTLM or Kerberos authentication, and indicated that Kerberos was the way to go. Little caveat: You might need to do some additional configuration. After doing some research it seems their definition of “little” and mine is a “little” different.
How does Internet Explorer handle a Kerberos request?
Internet Explorer encapsulates the Kerberos ticket that’s provided by LSASS in the Authorization: Negotiate header, and then it sends the ticket to the IIS server. IIS handles the request, and routes it to the correct application pool by using the host header that’s specified.
What does GUID mean in a non working SSL certificate?
Notice, that the Guid is all zero in a non-working scenario. You may see the Hash either having some value or blank. Even if we remove the certificate from the web site, and then run “httpcfg query ssl”, the website will still list Guid as all 0’s.
How to troubleshoot Kerberos authentication failure in IIS?
When you troubleshoot Kerberos authentication failure, we recommend that you simplify the configuration to the minimum. That is, one client, one server, and one IIS site that’s running on the default port. Additionally, you can follow some basic troubleshooting steps. For example, use a test page to verify the authentication method that’s used.
Is there a troubleshooting document for client certificates?
Client Certificates troubleshooting will not be covered in this document. Server Certificates are meant for Server Authentication and we will be dealing only with Server Certificates in this document. If the Client certificates section is set to “Require” and then you run into issues, then please don’t refer this document.