IIS website using .Net 4.5 runs on web server, application pool account = ApplicationPoolIdentity . I need to connect
from web server (WebServer.contoso.com) to SQLServer1.contoso.com machine using Kerberos, presently I get NTLM. Both servers are part of the same domain. SPNs are manually setup in AD for SQL Server AD service account and no duplicates, both
for FQDN and Netbios as well as for the port (1433) ( 4 in total). Checking the SQL log I get :
“The
SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/SQLHostname.contoso.com:1433] for the SQL Server service. Windows return code: 0x2098, state: 15. Failure to register a SPN might cause integrated authentication
to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.”
I do not consider this since AD service account does not have read/write permissions in AD, and instead SPNs have been created manually.
I configured Kerberos trust for delegation from web server to any service in AD
However, checkingsys.dm_exec_connections net_transport = TCP but auth_scheme = NTLM
In application Web.config connection string tag is
connectionString="Data Source=SQLHostname.contoso.com;Initial Catalog=DB_Name;Integrated Security=True" providerName="System.Data.SqlClient".
Do I need to add an element for Server SPN in the connection string? Is this the reason why I do not connect using Kerberos even if
SPNs have been added?
Thank you,