InstantForum.NET v2.9.0SQLServerCentralhttp://www.sqlservercentral.com/Forums/notifications@sqlservercentral.comMon, 20 May 2013 14:24:46 GMT20http://www.sqlservercentral.com/Forums/Topic1374005-20-1.aspxProgress!Authentication Type: NegotiateProtocol: KerberosAuthenticated identity: Domain\MeThread identity: Domain\MeWindows identity: Domain\SQL-ServiceEnvironment identity: SQL-ServiceWe're now using Kerberos at least as far as the IIS Server!So now we just need to get to the SQL Server...Thu, 18 Oct 2012 07:02:24 GMTschleephttp://www.sqlservercentral.com/Forums/Topic1374005-20-1.aspxHey gang,We're trying very hard to connect an internal webapp to an SQL Server 2008 R2.I really want to know which authenticated user is connecting to SQL Server.The IIS and SQL servers are on the same physical box. I believe we are in the classic "double-hop" scenario.The best info I've found so far is at:http://www.adshotgyan.com/2011/01/kerberos-double-hop-troubleshooting_4351.htmlWe've worked through everything in that post, except we're using a single AD account, rather than the 2 in that example. It does not appear to be implied that 2 accounts must be used.Questions:When the Application Pool Defaults are set to use the AD domain account we've set up to connect, the connection is made to SQL Server via TCP, but it always uses NTLM, not Kerberos. If I remove NTLM as a provider in IIS - Authentication, I get a 401 - invalid credentials.Can anyone point me to where to look next?Thanks!Wed, 17 Oct 2012 12:47:05 GMTschleep