IIS Managed Service Accounts
Автор: Mark Ryan Welshgeek1
Загружено: 2023-03-16
Просмотров: 2007
Описание:
IIS Running an apppool with a managed service account is unable to authenticate a user using Kerberos Authentication. KRB_ERR_AP_MODIFIED is returned, with the computer account (computer$) in the error, when using a loadbalancer, DNS round robin, or DNS alias for the FQDN the website is being accessed as.
This is because the kerberos ticket being sent is being passed to the app pool, and the app pool identity is unable to decode it. The solution is to disable kernel mode authentication on the server, which enables the apppool process to perform the decode of the kerberos ticket, rather than the IIS module (running as the computer account).
There may be an alternative solution - e.g. the permissions on the computer account - I've not been able to find an alternative solution though.
Повторяем попытку...
Доступные форматы для скачивания:
Скачать видео
-
Информация по загрузке:
