Windows 2008 R2 double hop settings

Question

I have developed one application using ASP.NET MVC 5 which uses windows authentication(Kerberos) in hosted server. The server has below configurations: Windows Server 2008 R2, IIS 7.5 with .Net framework 4.5 installed on it.

I have used SharePoint 2010 and SharePoint 2013 as backend for our mainly created application. I use to connect to these servers from ASP.NET MVC application using windows authentication in place for now.

Now the scenario is as below: Machine A configured with SharePoint 2013 with Windows authentication(Kerberos) is kept on. And also Machine A hosts ASP.NET MVC application in other website of same IIS. Machine B configured with SharePoint 2010 with Windows authentication(Kerberos) is kept on. Whenever I hit ASP.NET MVC application from client machines which are on the same domain opens up the home screen which calls the list from Machine A of SharePoint 2013 works fine with this scenario because it is local for my application. But when I select List which was of Machine B SharePoint 2010 the application throws "You do not have permission to access this section".

Please help us on how we can configure Kerberos windows authentication to work with above(double hop) issue.

Thanks, Vijay

Answer 1

Have you configured the computer account (if your app pool on Machine A is running as Network Service) or the service account of the app pool on Machine A to do delegation to the back-end service? This needs to be configured in AD for this to work.

If Machine B is accessed via the URL foo-b.contoso.com, you'd need to configure the computer account or service account on the Machine A side to delegate to http/foo-b.contoso.com.