David
Sat Jul 26 04:37:44 CDT 2008
On Jul 26, 1:26=A0am, matthew-andr...@ntlworld.com wrote:
> Hi,
>
> I've stumbled onto an authentication under by configuration of IIS.
>
> I've a web service which calls out to another web service, which are
> sometimes located on the same box. If they are and Kerberos security
> is activated then the web services cannot authenticate - no
> credentials are begin passed - 401 errors. =A0Under NTLM everything
> works fine.
>
> If there anyway to set the authentication protocol in the URL?
>
> Cheers
The problem is not with IIS nor Kerberos.
You are assuming that all authentication protocols allow implicit
delegation by default, and that is an insecure and incorrect
assumption.
NTLM does not pass credentials like that (you can't double-hop off the
box), so something else is going on if you say it "works fine".
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//