title: Kerberos authentication in IIS 7
body: <p>We have some web content that is setup in virtual directories using integrated windows authentication. The virtual directories are running under application pools that are using a custom identity (custom user account). The problem is that NTLM authentication works however Kerberos authentication does not. This is the same configuration that worked under IIS 6 but we need to migrate to IIS 7 and Kerberos authentication isn't working.</p>
  
  <p>Here's some more information about my environment:</p>
  
  <p>Virtual Directory Authentication Settings:</p>
  
  <ul>
  <li>Everything disabled except for Windows Authentication</li>
  <li>Enable kernel-mode authentication: enabled</li>
  </ul>
  
  <p>App Pool Settings:</p>
  
  <ul>
  <li>Managed Pipeline Mode: Classic</li>
  <li>Identity: Custom local user</li>
  </ul>
  
  <p>Web.config Settings:</p>
  
  <ul>
  <li>authentication mode = "Windows"</li>
  <li>system.serviceModel/bindings/basicHttpBinding/binding/security/mode = TransportCredentialOnly</li>
  <li>system.serviceModel/bindings/basicHttpBinding/binding/security/transport/clientCredentailType = Windows</li>
  <li>serviceHostingEnvironment/aspNetCompatibilityEnabled = true</li>
  </ul>
  
  <p>Virtual Directory Permissions:</p>
  
  <ul>
  <li>Custom local groups: We add domain users to the local groups for access to the service</li>
  </ul>
  
  <p>OS settings:</p>
  
  <ul>
  <li>IIS 7</li>
  <li>Windows Server 2008 x64 standard SP2</li>
  </ul>
  
  <hr>
  
  <p>Here is the analysis I get from fiddler comparing IIS 6 to IIS 7. Kerberos authentication is working fine in IIS 6 with a app pool running with a custom identity.</p>
  
  <h2>Reference (IIS 6) (Works):</h2>
  
  <p>Fiddler:</p>
  
  <p>(Using domain\user)</p>
  
  <p>Request 1 (no auth)</p>
  
  <pre><code>No Proxy-Authorization Header is present.
  No Authorization Header is present.
  </code></pre>
  
  <p>Response 1 (401) (challenge)</p>
  
  <pre><code>No Proxy-Authenticate Header is present.
  WWW-Authenticate Header is present: Negotiate
  WWW-Authenticate Header is present: NTLM
  </code></pre>
  
  <p>Request 2 (Kerberos ticket)</p>
  
  <pre><code>Authorization Header (Negotiate) appears to contain a Kerberos ticket:
  &lt;data&gt;
  </code></pre>
  
  <p>Response 2 (401) (Kerberos reply)</p>
  
  <pre><code>WWW-Authenticate Header (Negotiate) appears to be a Kerberos reply:
  &lt;data&gt;
  </code></pre>
  
  <p>Request 3 (Kerberos ticket)</p>
  
  <pre><code>Authorization Header (Negotiate) appears to contain a Kerberos ticket:
  &lt;data&gt;
  </code></pre>
  
  <p>Response 3  (401) (Kerberos reply)</p>
  
  <pre><code>WWW-Authenticate Header (Negotiate) appears to be a Kerberos reply:
  &lt;data&gt;
  </code></pre>
  
  <p>Request 4 (Kerberos ticket)</p>
  
  <pre><code>Authorization Header (Negotiate) appears to contain a Kerberos ticket:
  &lt;data&gt;
  </code></pre>
  
  <p>Response 4 (200) (Kerberos Reply)</p>
  
  <pre><code>WWW-Authenticate Header (Negotiate) appears to be a Kerberos reply:
  &lt;data&gt;
  </code></pre>
  
  <p>And the transaction completes and the browser displays the page.</p>
  
  <hr>
  
  <h2>(IIS 7) (Doesn't Work):</h2>
  
  <p>Fiddler:</p>
  
  <p>(Using domain\user)</p>
  
  <p>Request 1 (no auth)</p>
  
  <pre><code>No Proxy-Authorization Header is present.
  No Authorization Header is present.
  </code></pre>
  
  <p>Response 1 (401) ( Negotiate)</p>
  
  <pre><code>No Proxy-Authenticate Header is present.
  WWW-Authenticate Header is present: Negotiate
  WWW-Authenticate Header is present: NTLM
  </code></pre>
  
  <p>Request 2 (Kerberos ticket)</p>
  
  <pre><code>Authorization Header (Negotiate) appears to contain a Kerberos ticket:
  &lt;data&gt;
  </code></pre>
  
  <p>Response 2 (401) (Negotiate)</p>
  
  <pre><code>No Proxy-Authenticate Header is present.
  WWW-Authenticate Header is present: Negotiate
  WWW-Authenticate Header is present: NTLM
  </code></pre>
  
  <p>Notice that IIS 7 isn't accepting my Kerberos ticket in <em>Response 2</em>. Any idea why not? Do I need to reconfigure some stuff in IIS 7 to get Kerberos authentication to work?</p>