Active Directory service delegation

environment:
server 2003 sp1
domain/forest functional level:  2003
sql server 2005 sp1/2

issue:
an application being deployed in our environment needs utilize kerberos delegation between web/app server (app1) and database server (dbc3).  wanted set delegation constrained services - namely http , mssqlsvc.  however, when go aduc and computer account (app1) to set constrained delegation, mssqlsvc not listed database server (dbc3).  question 2 fold:

how services listed populated when select computer in add box?  seems though services listed same every server in our environment.

how add or register sql services chosen delegation?  process native sql or manual process active directory?

any appreciated.

---

trevor

 

hi,

 

to use security account delegation, sql server must have service principal name (spn) , use tcp/ip.

 

you can use following command create spn.

 

setspn -a mssqlsvc/hostname:portnumber serviceaccount

 

please replace hostname, portnumber, serviceaccount corresponding settings.

 

for more information, please refer following article:

 

how use kerberos authentication in sql server

http://support.microsoft.com/kb/319723

 

security account delegation

http://msdn.microsoft.com/en-us/library/aa905162(sql.80).aspx

 

thanks.

Windows Server  >  Directory Services