Back to the top

Configure SharePoint Server 2007 for Kerberos authentication

Step 1: Set up the SPN for the user accounts

1. Set the SPN for the server farm account. At a command prompt, type the following to set the SPN for the server farm account, and then press ENTER:
   setspn.exe -S HTTP/SharePoint_server.domain.com domain\SharePoint_Server_farm_acct
   For example, type the following command at the command prompt, and then press ENTER:
   setspn.exe -S HTTP/mossserver.contoso.com contoso\SharePoint_Server_farm_acct
2. Set the SPN for the SharePoint WebApplication by using the application pool accounts. To do this, type the following commands, and then press ENTER after each one:
   setspn.exe -S HTTP/SharePoint_WebApplication:port domain\application_pool_account
   
   setspn.exe -S HTTP/FQDN_of_the_WebApplication:port domain\application_pool_account
   For example, type the following commands, and press ENTER after each one:
   setspn.exe -S HTTP/mossserver:80 contoso\application_pool_account
   
   setspn.exe -S HTTP/mossserver.contoso.com:80 contoso\application_pool_account
3. Set the SPN for the SharePoint Shared Services WebApplication by using the application pool accounts. To do this, type the following commands, and then press ENTER after each one:
   setspn.exe -S HTTP/SharedServices_WebApplication:port domain\SharedServices_application_pool_account
   
   setspn.exe -S HTTP/FQDN_of_the_SharedServices_WebApplication:port domain\SharedServices_application_pool_account
   For example, assume that My Shared Services Web Application is hosted on port 8001. In this case, type the following commands, and press ENTER after each one:
   setspn.exe -S HTTP/mossserver:8001 contoso\application_pool_account
   
   setspn.exe -S HTTP/mossserver.contoso.com:8001 contoso\application_pool_account
4. After you set the SPN, verify that the SPN is set correctly on the server. To do this, type the following commands at a command prompt, and press ENTER after each one:
   setspn –L Domain\User_account_UsedtosetSPN
   For example, type one of the following commands, and then press ENTER:
   setspn -L contoso\SharePoint_Server_farm_acct
   
   setspn -L contoso\application_pool_account
   
   setspn -L contoso\SharedServices_application_pool_account
   If the SPN is configured correctly, the account URL address and the port number will be displayed. At the command prompt, you would see the SPN set for the user account:
   HTTP/mossserver.contoso.com
   HTTP/mossserver:80
   HTTP/mossserver.contoso.com:80
   HTTP/mossserver:8001
   HTTP/mossserver.contoso.com:8001

Step 2: Trust for delegation on the user accounts and on the computer accounts

• Microsoft Office SharePoint Server 2007 Servers, computer account
• Microsoft SQL Server/Analysis server, computer account
• Microsoft Office SharePoint Server 2007 farm, user account
• Web Application Pool, user account

1. Click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.
2. In the navigation pane, click Computers.
3. Right-click the computer that you want to configure, and then click Properties.
4. Click the Delegation tab, click Trust this computer for delegation to any service (Kerberos only), and then click OK.

1. Click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.
2. In the navigation pane, click Users.
3. Right-click the user who you want to configure, and then click Properties.
4. Click the Delegation tab, click Trust this user for delegation to any service (Kerberos only), and then click OK.

Step 3: Configure the SharePoint Server 2007 Web site for Kerberos authentication

1. Click Start, click Control Panel, double-click Administrative Tools, and then double-click SharePoint Central Administration.
2. Click the Application Management tab, and then click Authentication Providers.
3. In the Web Application list, select the Web application that you have to update.
4. Click the zone that you want.
5. On the Edit Authentication page for IIS Authentication Settings, click Negotiate (Kerberos). When you are prompted for confirmation, click OK.
6. Click Integrated Windows authentication, click Negotiate (Kerberos), and then click OK.
7. To apply the change, click Save.

<system.webServer>

<security>

         <authentication>

                     <windowsAuthentication enabled="true" useKernelMode="true" useAppPoolCredentials="true" />

         </authentication>

</security>

</system.webServer>

Step 4: Configure Component Services on Windows Server 2003 or Windows Server 2008

1. On the server that is running SharePoint Server 2007, click Start, click Run, type dcomcnfg in the Open box, and then click OK.
2. Expand Component Services, expand Computers, right-click My Computer, and then click Properties.
3. Do one of the following:
   • For Windows Server 2003, click the Default Properties tab, click Delegate in the Default Impersonation Level box, and then click OK.
   • For Windows Server 2008, click the Default Properties tab, click Identify in the Default Impersonation Level box, and then click OK.
   For more information about how to set an impersonation level, visit the following Microsoft Web site:
   http://msdn2.microsoft.com/en-us/library/ms681722.aspx (http://msdn2.microsoft.com/en-us/library/ms681722.aspx)
4. Expand Component Services, expand Computers, and then double-click My Computer.
5. Double-click the DCOM Config folder, and then right-click IIS WAMREG admin Service.
6. Click Properties, click the Security tab, and then under Launch and Activate Permissions, click Edit.
7. In the Launch Permission dialog box, click Add.
8. In the Select Users, Computers, or Groups dialog box, type the user account that you specified as the SharePoint Server 2007 application pool account, click Check Names, and then click OK.
9. In the Permissions for UserName list, click to select the Allow check box that is next to Local Activation, and then click OK.
10. If you have more than one application pool account, repeat steps 7 to 9 for each one.
11. Click OK.

Step 5: Enable the Kerberos protocol on the SSP

Back to the top

Configure Excel Services for Kerberos authentication

Step 1: Configure user permissions in SQL Server 2005 Analysis Services

1. Start SQL Server Management Studio, and then connect to the instance of SQL Server 2005 Analysis Services.
2. Right-click the Analysis Services folder, and then click Properties.
3. Click Security in the navigation pane.
4. Under NT Users and Groups, click Add, and then add each user who you want to grant access to Excel services. If you want to grant access to all users, add Authenticated users.
5. Close Analysis Services Properties.

Step 2: Configure SQL Server 2005 Analysis Services to use Kerberos authentication

Step 3: Configure Excel Services for delegation

1. At a command prompt, type the following, and then press ENTER:
   STSADM -o set-ecssecurity -ssp Shared Services Provider Name -accessmodel delegation
2. Type the following, and then press ENTER:
   STSADM -o execadmsvcjobs

Back to the top