.NET Server Authentication

[Grant]

Forgive me if this is the wrong group, but this issue seems to span a couple
of different topics.

I’m having an odd problem with server authentication in relation to Active
Directory. Forgive the length, but I wanted to weed out the more generic
answers that are already published.

Environment:
SQL Server 2000 on Windows Server 2000.
.NET Web Server, IIS 6 on Windows Server 2003
Clients running Windows XP, IE 6.0
Authentication: Windows Active Directory

Problem:
I’m building a .NET Intranet where users are authenticated via Integrated
Windows Authentication. While the SQL Server is on a different physical
machine from the Web Server, delegation and impersonation has been setup
correctly. The problem is that I get an ‘occasional’ login failed for user
'NT AUTHORITY\ANONYMOUS LOGON' from the SQL Server. The following is one set
of steps that leads to this, but is not the only thing that causes it, this
is just what I can reproduce regularly:

1. I open an .aspx page with a search form that searches the database.
2. I let the page sit, without using the computer, for a period of time
(somewhere between 30 – 60 minutes, I can’t pin down the exact time).
3. I type something in the search box and submit.
4. Under any other circumstance, this would return a result from SQL Server,
but in this case I get a login failed.

NOTE: I have already ruled out a Session timeout on the web server as a
cause by doing this with a timeout setting of a couple of minutes and again
with the timeout set to a few hours. It’s still 30-60 minutes before this
will happen.

Now, here’s the really odd part.

5. The error page I get is a custom error page I built. Among the other
information on this page is a link back to the Homepage. The Homepage also
runs a database query at load time automatically.
6. If I click this link within a second or two, I get the “login failed for
user 'NT AUTHORITY\ANONYMOUS LOGON'” when it tries to run the query and I get
sent back to the error page. Continuing to click on the Homepage link every
second or two will generate this same result, until about the third click,
5-6 seconds, when all of a sudden, it will go to the Homepage and connect to
SQL Server without a problem.

And to make things a little bit stranger:

7. If I’m letting this page sit the 30-60 minutes to generate the error and
am logged into another computer with the same Active Directory account, the
error will not occur.

Now, it seems like there is some point where my credentials are forgotten or
timed out on the network, then it takes 5-6 seconds to reestablish
credentials across the network, but I’m not sure of this. This is why I
thought it might be an Active Directory problem rather than .NET or SQL Server

Please let me know if anything doesn't make sense. Any thoughts would be
greatly appreciated.

Grant

[Joe Kaplan (MVP - ADSI)]

It sounds like some sort of funny Kerberos problem, where Kerberos is not
being used consistently and a fail-over to NTLM is happening instead. That
is one of the dangerous things about building apps that rely on delegation
is that it requires Kerb, but Windows is generally happy to fall over to
NTLM silently if Kerb fails, leaving you randomly up a creek if only Kerb
would do.

The first thing I would try to do would be to figure out if this is what's
happening. Make sure you have full logon security auditing enabled on the
web server and see if you see any difference in the authentications that
succeed vs. fail.

I'm not sure if there is a "only allow Kerb" setting for the Negotiate
protocol (IWA in IIS) that disallows NTLM, but it seems like you could use
it if there is.

Another question: is your AD domain 2003 Native Mode? I would like to think
that the IIS 6 server could use protocol transition for you if it didn't get
a Kerb bind. I think that would fix your problem too. However, that
doesn't work unless your AD is fully 2003 native.

I wish I had a great list of diagnostics tools for this kind of thing, but I
don't.

Joe
"Grant" <Gr...@discussions.microsoft.com> wrote in message
news:2AA3F0DF-4789-47BD...@microsoft.com...

> Forgive me if this is the wrong group, but this issue seems to span a
> couple
> of different topics.
>
> I'm having an odd problem with server authentication in relation to Active
> Directory. Forgive the length, but I wanted to weed out the more generic
> answers that are already published.
>
> Environment:
> SQL Server 2000 on Windows Server 2000.
> .NET Web Server, IIS 6 on Windows Server 2003
> Clients running Windows XP, IE 6.0
> Authentication: Windows Active Directory
>
> Problem:
> I'm building a .NET Intranet where users are authenticated via Integrated
> Windows Authentication. While the SQL Server is on a different physical
> machine from the Web Server, delegation and impersonation has been setup
> correctly. The problem is that I get an 'occasional' login failed for
> user
> 'NT AUTHORITY\ANONYMOUS LOGON' from the SQL Server. The following is one
> set
> of steps that leads to this, but is not the only thing that causes it,
> this
> is just what I can reproduce regularly:
>
> 1. I open an .aspx page with a search form that searches the database.
> 2. I let the page sit, without using the computer, for a period of time

> (somewhere between 30 - 60 minutes, I can't pin down the exact time).