我编写了一个简单的 ASP.NET 应用程序，它用作简单 MSSQL 数据库的前端。该应用程序可通过互联网访问。
涉及两台物理服务器：一台也运行 MSQL Server 2008 R2 的 WS2008R2 Active Directory 域控制器，以及另一台服务器，即我的应用程序所在的 Web 服务器 (WS2008R2/IIS7.5)。
我的应用程序“FooPool”的应用程序池有自己的 AD 用户身份，它在“FooUser”下运行。 FooUser没有任何访问SQL Server数据库的权限，只有我自己的个人用户帐户“MyUser”有该权限。
这个想法是，尝试访问此 Web 应用程序首先使用 IIS 执行 Windows 身份验证，然后我的 Web 应用程序使用模拟来访问 SQL Server 数据库。
但是我的应用程序不起作用。
我在没有接触 SQL Server 的情况下测试了该应用程序，只是为了测试模拟，所以我执行了 Response.Write( WindowsIdentity.GetCurrent(false).Name );它正确地显示了应用程序模拟 MyUser 并且不充当 FooUser。这适用于所有现代浏览器和互联网。
但一旦接触到 MSSQL Server，我就会收到错误“用户‘NT AUTHORITY\ANONYMOUS LOGON’登录失败”。但这不应该发生，因为没有用户令牌用于匿名登录。
我已经完成了我的作业并阅读了有关 ASP.NET 中的委派和模拟的所有内容，并且我已经设置了委派： FooUser 帐户有一个服务主体名称设置（我将 SPN 设置为任意字符串，这样做是否正确） ?) 并在 ADUC 中标记为授权。
最后，我的连接字符串启用了 SSPI，禁用了连接池，并将网络库设置为“dbmssocn”。
我还忘记了什么？
I've written a simple ASP.NET application that works as a frontend for a simple MSSQL database. The application is accessible over the Internet.
There are two physical servers involved: a WS2008R2 Active Directory domain controller which is also running MSQL Server 2008 R2, and another server, the webserver (WS2008R2/IIS7.5) where my application resides.
The Application Pool for my application "FooPool" has its own AD User identity it runs under "FooUser". FooUser does not have any permission to access the SQL Server database, instead only my own personal user account "MyUser" has that permission.
The idea is that attempts to access this web application first perform Windows Authentication with IIS, my web application then uses Impersonation to access the SQL Server database.
However my application does not work.
I tested the application without it touching SQL Server, just to test impersonation, so I did Response.Write( WindowsIdentity.GetCurrent(false).Name ); which correctly shows the application impersonating MyUser and not acting as FooUser. This works from all modern browsers and across the Internet.
But as soon as it touches MSSQL Server I get the error "Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'." but that should not be happening because no user tokens are for Anonymous Logon.
I've done my homework and read all about Delegation and Impersonation in ASP.NET and I have set up delegation: The FooUser account has a Service Principal Name set-up (I set the SPN to an arbitrary string, is that doing it right?) and is marked for delegation in ADUC.
Finally, my connection string has SSPI enabled, Connection pooling disabled, and the network library set to "dbmssocn".
What else am I forgetting?
发布评论
评论（1）
完成委派工作的配置后，您必须启用约束委派：
仅服务。
与 MSSQLSvc 服务关联的 SPN
http://blogs.technet.com/b/askds/archive/2008/11/25/fun-with-the-kerberos-delegation-web-site.aspx
Finishing the Configuration for Delegation to Work you must enable constrained delegation:
services only.
SPN associated with the MSSQLSvc service
http://blogs.technet.com/b/askds/archive/2008/11/25/fun-with-the-kerberos-delegation-web-site.aspx