asked
Kerberos Authentication issue
Hi, We have an issue where kerberos authentication was enabled on a server which is on Domain A. Now, since then, users have complained that from their App servers on Domain B, they haven't been able to connect to SQL Server if they set Integrated Security to True. They get the error message: ( System.Data.SqlClient.SqlException : Cannot generate SSPI context.) They are able to connect using a SQL UID and Pwd in the connection string. Can anyone suggest what seems to be the issue and how to correct it ?
This is the Double-Hop problem. There's any amount of information about it if you [Google appropriately][1]; I would suggest having a read of the [MSDN Blog][2] on the subject first, and working from there. [1]:
https://www.google.co.uk/search?q=double+hop+authentication+sql+server+kerberos [2]:
http://blogs.technet.com/b/askds/archive/2008/06/13/understanding-kerberos-double-hop.aspx
Can I clarify a few things. Are you saying that SQL Server authentication works but Windows Authentication does not? Do you have an active directory with at least two domains, are the domains trusted?. How are uses in one domain granted rights in the second? Also when you say have enabled kerberos do you mean you have created Windows authentication logins in SQL Server in domain A or have you specifically switched on kerberos in the domain?
14 People are following this question.
