Michael Stephenson

Kerberos Adventures - Useful Information Links

This post will list some of the sources of information I have found useful during my "Kerberos Adventures"

 

Recommended Reading

To help you get up to speed quickly I would recommend checking out the following resources.  There are additional resources below.

 

Kerberos Delegation Troubleshooting Guide Pretty much walks you through all of setting up a delegation scenario and will tell you how to do each step and what is going on in relation to a good sample.	http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerbdel.mspx
Keith Browns Security WIKI (Contains most of the excellent book .Net Developers Guide to Windows Security).  Contains most of the background information you might want.	http://pluralsight.com/wiki/default.aspx/Keith.GuideBook.HomePage

 

 

 

Background Information

The following links provide background information on some of the concepts in this area.

 

Description	Link
Keith Brown Q & A Keith brown provides useful background information on this type of security in the form of an interview in MSDN Magazine.	http://msdn.microsoft.com/msdnmag/issues/05/09/securitybriefs/
Discussion on Delegation	http://searchwindowssecurity.techtarget.com/originalContent/0,289142,sid45_gci1013484,00.html
KB Article on Delegation Issues in Load Balanced Scenarios	http://support.microsoft.com/kb/325608/
PnP guide on Implementing Kerberos on win2k	http://msdn2.microsoft.com/en-us/library/aa302400.aspx
WSE Documentation (How to sign a message with a Kerberos Token)	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse3.0/html/b03d6cfb-e65e-4d19-bf7b-137338b663d1.asp
SetSpn Examples	http://technet2.microsoft.com/WindowsServer/en/library/2bbd23c5-a01d-49bc-8b1c-6d309767c5e71033.mspx?mfr=true
Setting up SPN/Kerberos against the cluster name	http://technet2.microsoft.com/WindowsServer/en/library/024e21dd-c864-43de-908a-a3c2a9fcf9431033.mspx?mfr=true
PnP Kerberos Technical Supplement for Windows More detail on Kerberos	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/WSS_Ch7_KerbTechSupp.asp
Differences between KerberosToken and KerberosToken2	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse/html/4dd8d00a-19b7-4c94-b515-778b11a62c0b.asp
BizTalk WSE Adapter Walk through Does not use Kerberos but still covers the use of the WSE adapter.  Uses X509 Certificates instead.	http://www.microsoft.com/technet/prodtechnol/biztalk/biztalk2004/planning/walkwse.mspx

 

How To Guides

These links will provide useful information on how to do some of the common tasks you might come across in this area.

 

Description	Link
How to troubleshoot Kerberos related issues in IIS	http://support.microsoft.com/kb/326985
How to enable Kerberos Event Logging	http://support.microsoft.com/kb/262177
How to force Kerberos to use TCP instead of UDP in Windows 2003 etc...	http://support.microsoft.com/kb/244474

 

Troubleshooting

The following links provide useful troubleshooting resources.

 

Description	Link
You receive an "HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials" error message when you try to access a Web site that is part of an IIS 6.0 application pool   Contains information on how to resolve HTTP 401 response code	http://support.microsoft.com/kb/871179
WSE Common Configuration Errors	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse3.0/html/67e4e65b-ffc8-4d2b-9359-7f05758a419d.asp
WSE Common Error Messages	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wse3.0/html/97451b4c-d25b-480d-b304-3bde7834eaf5.asp
Enabling Kerberos Logging	http://www.support.microsoft.com/kb/262177/
Troubleshooting Kerberos Issues in IIS	http://www.support.microsoft.com/kb/326985
Troubleshooting Kerberos	http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx
Kerberos Delegation Troubleshooting Guide	http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerbdel.mspx

• Share This Post:
• 
• 
• 

Print | posted on Friday, February 02, 2007 12:40 PM | Filed Under [ BizTalk .net 2 Kerberos Adventures ]