Hi Folks,

This blog is targeting to essential troubleshooting of Kerberos, I have come across to many situation where finding out the exact error message becomes very challenging and that leads to clueless situations, So here I am not going to cover any specific error but this blog will help to get the error details regarding Kerberos.

Using Fiddler and Network Monitor Tools one can find out the error details very easily. Certainly reading and understanding Fiddler & Network monitor trace is not easy. I have tried to illustrate the traces using actual screen shots, so I do hope it will help to conclude the issue using the data collected through tools without hands on experience. I am sure after getting the exact error message you can able to find out the solution :)

Kerberos Failure Behavior : 3 Times Prompt Although Entering Valid Username and Password, It fails with 401 (401.1)

Download Fiddler Tool and install it on the Client Machine

1. Clear the Browser Cache and start the fiddler and browse the URL from the Internet Explorer e.g. https://rajkumar/time.asp

Now Observe the Request and Response Cycle :

If it is NTLM, then you would see 2 consecutive 401 and then 200 (Status Code or Result) + Authorization Ticket will not start with YII… but could be any thing other than YII… (Generally it starts with TIRM..)

If it is KERBEROS, then you would see only 401 and then 200 (Status Code or Result) + Authorization Ticket will always start with YII…

2. IF Kerberos is failing Get the Error Details: Download the Network Monitor Trace and capture the trace (Always open Network Monitor Tool as an administrator)

     Step 1: Close all the IE windows and Clear all the Browser Cache.

     Step 2: Purge the Ticket

                    On IIS 7 

                                Open Command Prompt and type Klist purge

                    C:\>KLIST purge

                           Current LogonId is 0:0x70a16
                            Deleting all tickets:
                            Ticket(s) purged!

        On IIS 6

                                Download KerbTray, Go to task manager, choose the icon right click and hit “Purge Ticket”

      Step 3: Capture the Network Monitor Trace(NetMon Trace).

            Start NetMon – Browse to the URL e.g. https://rajkumar/time.asp –  Enter username/Password 3 times, Let it fail with 401.

            Apply the filter as highlighted + add the extra column e.g. Krb Principal Name String & Kerberos Summary

If KERBEROS is failing it will list the reason and error code. In my case it is pointing to SPN(Service Principle Name with error code: KRB_ERROR – KDC_ERR_S_PRINCIPAL_UNKNOWN(7)), so I am sure now that, there is something wrong with SPN Names and I can continue troubleshooting from SPN perspective.

For any client request, IIS uniquely identifies the website based upon the unique combination of IP+PORT+HOSTNAME, here I would be discussing about the confusion which roam around while binding the certificate.

Note: IIS 7.x UI does not allow you to provide Hostname, but in IIS 6.0 you can specify the Host Header while trying to bind the SSL Certificate.

SCENARIO 1: Ports are different but IP and certificate is similar.Negotiate Client Certificate : Disabled

Below are the SSLBindings from the IIS server

I can access website using https://<HostName>:<PortNumber>, as shown below

https://www.confusion.com:443 or https://www.confusion.com:445

SCENARIO 2: Ports and IP’s are same but Certificate is different.

Starting the website will throw a error pop-up as shown below:

Explanation:

https://blogs.iis.net/thomad/archive/2008/01/25/ssl-certificates-on-sites-with-host-headers.aspx

Snippet from the above blog:

Conclusion:

IIS uniquely identifies the HTTPS website based on IP+Port as the hostname is not available to it. So what do we do about it? There is definitely a solution. We can use Wildcard/SAN certificates to go around this problem.

Solution: Wild Card Certificate/SAN Certificate

We can bind Wildcard/SAN Certificate to multiple website with same IP and Port as the certificate hash remains the same across all the bindings.

We need to change the SSL Bindings for that specific website in order to get it working. Again as the following condition must be true IP+PORT+HOSTNAME.

Please refer the following blog on how to edit the Secure bindings for the website:

https://blogs.msdn.com/b/saurabh_singh/archive/2007/11/17/wildcard-ssl-certificate-in-iis-6-0-windows-2003-sp1-and-above.aspx

The above is applicable to SAN certificates too.