Home / server / Questions / 208420
Accepted
Grhm
Asked: 2010-12-03 08:42:10 +0800 CST

Automate setup of constrained kerberos delegation in AD

  • 772

I have a web app that uses some backend servers (UNC, HTTP and SQL). To get this working I need to configure ServicePrincipalNames for the account running the IIS AppPool and then allow kerberos delegation to the backend services.

I know how to configure this through the "Delegation" tab of the AD Users and Computers tool.

However, the application is going to be deployed to a number of Active Directory environments. Configuring delegation manually has proved to be error prone and debugging the issues misconfiguration causes is time consuming. I'd like to create an installation script or program that can do this for me.

Does anyone know how to script or programmatically set constrained delegation within AD?

Failing that how can I script reading the allowed services for a user to validate that it has been setup correctly?

scripting windows-server-2003 active-directory kerberos delegation

2 Answers

  1. Best Answer

    OK, after much digging on the internet and some testing, I've worked it out.

    I didn't find a utility that could do this for me from a batch script. I did however find out which properties are required within the underlying LDAP. So I had to write my own utility to do it for me.

    The following C# code can set or check constrained delegation:

    DirectoryEntry de = new DirectoryEntry("LDAP://"+usersDN);

if (!de.Properties["msDS-AllowedToDelegateTo"].Contains(backendSpnString))
{
    de.Properties["msDS-AllowedToDelegateTo"].Add(backendSpnString);
    de.CommitChanges();
}

    If the user has had non-constrained delegation enabled, you may need to turn this off before enabling constrained - but I didn't fully test this scenario.

    The code above is C# as that is what the webapp is written in and was therefore to hand. I expect anyone following this could transcribe into another language if so desired.

    • 0

  2. The joeware "admod" utility does this nicely too.

    admod -b "full DN to user" "msDS-AllowedToDelegateTo:+:Service/server.x.y.com:port#"

    the :+: means "add", :-: would be delete, see the help pages for all of the details.

    • 0