Checking configuration of constrained delegation

asg

unread,

Oct 18, 2009, 11:25:01 AM10/18/09

to

Our application requires the use of constrained delegation.

As part of a health check, we'd like to check the configuration of the
constrained delegation programatically. Is there any of doing this via ADSI?

Joe Kaplan

unread,

Oct 18, 2009, 10:12:46 PM10/18/09

to

All the settings related to constrained delegation are stored in AD, so you
can definitely do some LDAP queries to verify the settings. The primary
attributes to examine are userAccountControl (which has the "allowed to
authenticate for delegation" flag), servicePrincipalName on your target
services and msds-allowedToDelegateTo for the list of SPNs your delegating
service is allowed to delegate to.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
"asg" <asgi...@nospam.nospam> wrote in message
news:8B7B103E-9F2D-40B2...@microsoft.com...

asg

unread,

Oct 20, 2009, 9:10:02 AM10/20/09

to

Thanks Joe, that's very useful

Joe Kaplan

unread,

Oct 20, 2009, 9:35:04 PM10/20/09

to

Ok, if that helps you then great! It was a pretty high level answer but I
didn't want to provide too much in the way of specifics because I wasn't
clear on what specifics might help you more. If you have additional more
specific questions, I can probably help there as well.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
"asg" <asgi...@nospam.nospam> wrote in message

news:ECFCD7DD-C42F-4113...@microsoft.com...