Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase «««23456

A brief explanation and solution for the Double Hop problem Expand / Collapse
Author
Message
Posted Thursday, December 29, 2011 6:17 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Tuesday, March 25, 2014 2:23 PM
Points: 8, Visits: 83
My problem as a consultant is finding an AD admin that even knows what an SPN is, much less understanding how they work with applications like MSCRM, Share Point and Business Portal.

Sometimes I do not see an SPN for the default instance but there are SPNs for subsequent instances. It's the result of using accounts for the services that do not have the right to create the attributes in the LDAP database.

Post #1227738
Posted Thursday, December 29, 2011 8:03 AM


Hall of Fame

Hall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of Fame

Group: General Forum Members
Last Login: Yesterday @ 11:53 AM
Points: 3,436, Visits: 1,683
ALZDBA (12/13/2011)
Just today I've seen a tweet pointing to a delegation troubleshooting blog:

http://blogs.msdn.com/b/sqlserverfaq/archive/2011/12/12/troubleshooting-kerberos-delegation-using-delegconfig.aspx


Unless I'm missing something it looks more like an advertisement for something called DelegConfig. I don't now anything about the tool or its usefulness though.


Kenneth Fisher
I strive to live in a world where a chicken can cross the road without being questioned about its motives.
--------------------------------------------------------------------------------
For better, quicker answers on T-SQL questions, click on the following...
http://www.sqlservercentral.com/articles/Best+Practices/61537/
For better answers on performance questions, click on the following...
http://www.sqlservercentral.com/articles/SQLServerCentral/66909/

Link to my Blog Post --> www.SQLStudies.com
Post #1227799
Posted Thursday, December 29, 2011 9:20 AM


Ten Centuries

Ten CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen Centuries

Group: General Forum Members
Last Login: Today @ 6:05 AM
Points: 1,146, Visits: 6,245
osgcurt (12/29/2011)
My problem as a consultant is finding an AD admin that even knows what an SPN is, much less understanding how they work with applications like MSCRM, Share Point and Business Portal.

Sometimes I do not see an SPN for the default instance but there are SPNs for subsequent instances. It's the result of using accounts for the services that do not have the right to create the attributes in the LDAP database.



I would expect, as a consultant, you would be able to 'guide' any domain administrator with setting this up.
That 'problem' might be part of why someone might use a consultant.
Don't complain too loudly about this.

Very few accounts have the ability to write information to AD.
And running a service under an account that can do this might open up some security holes.
Not a best practice.
NT Authority System comes to mind, along with SQL Injection.
Post #1227863
Posted Thursday, December 29, 2011 9:22 AM


Ten Centuries

Ten CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen Centuries

Group: General Forum Members
Last Login: Today @ 6:05 AM
Points: 1,146, Visits: 6,245
Kenneth.Fisher (12/29/2011)
ALZDBA (12/13/2011)
Just today I've seen a tweet pointing to a delegation troubleshooting blog:

http://blogs.msdn.com/b/sqlserverfaq/archive/2011/12/12/troubleshooting-kerberos-delegation-using-delegconfig.aspx


Unless I'm missing something it looks more like an advertisement for something called DelegConfig. I don't now anything about the tool or its usefulness though.


Maybe you should take a closer look. I think you are missng something.
Post #1227868
Posted Thursday, December 29, 2011 10:17 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Tuesday, March 25, 2014 2:23 PM
Points: 8, Visits: 83
Yes,I've seen that enough as well. I see both sides of the security mirror. Often I've been in an IT department with very experienced folks and DBAs and they tell me they have never heard of delegation issues. I blame the "VENDOR" for not educating the professionals.

Some of the deployment guides are very general and scanty. A friend of mine, Mark gives a great talk on Windows Logins which is way past the "logging into the machine" stage.

He is way into the packet area of the subject.
A few years back, we had many double hop Kerberos issues on SQL based application servers.
His talks really helped me understand the issues.

Seems I learn something new everyday from some one here or some place else.
Post #1227923
Posted Thursday, December 29, 2011 6:00 PM


Hall of Fame

Hall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of Fame

Group: General Forum Members
Last Login: Yesterday @ 11:53 AM
Points: 3,436, Visits: 1,683
In my opinion one of the largest problems DBAs have with server level security (Kerberos, Service Account permissions etc) is that it is "Server Level", meaning it's outside of SQL Server. Most DBAs I've met over the years have no interest in learning anything that isn't directly part of SQL. If it can't be updated using the SQL Server toolset then they don't want to mess with it. That is something for the "server guy/team".

Then on the other side, the server support people generally have no interest in learning (and probably with better justification) what the SQL Servers/Service Accounts need by way of security.

Because of that you only have the rare DBA who started as a server admin, or who becomes a server admin that will actually understand both sides of the puzzle. This of course means that what documentation there is, is directed to the server admins, and is much harder to understand for us poor DBAs.

When I went to the Pass Summit there was a session I had looked forward to seeing called "Windows Operating Systems Internals for Database Pros" by Brian Kelly. Unfortunately it was canceled. One of these days when I have some free time I'll have to see if he has it on line somewhere.


Kenneth Fisher
I strive to live in a world where a chicken can cross the road without being questioned about its motives.
--------------------------------------------------------------------------------
For better, quicker answers on T-SQL questions, click on the following...
http://www.sqlservercentral.com/articles/Best+Practices/61537/
For better answers on performance questions, click on the following...
http://www.sqlservercentral.com/articles/SQLServerCentral/66909/

Link to my Blog Post --> www.SQLStudies.com
Post #1228127
Posted Thursday, December 29, 2011 8:05 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Tuesday, March 25, 2014 2:23 PM
Points: 8, Visits: 83
I have a very intelligent friend who is a Server/systems/directory MVP.
At the MVP summit he makes a comment to me that MSSQL is just like a spread sheet, to me and one of the SQL MVPs.
We looked at him with disbelief. No WAY. My happenstance came from doing system and database work starting in the DBASE III Plus days and JCL/IBM QUERY on AS/400s. Getting the data processed and delivered seems like a logical pair like cooking the meal and serving it.

So I have often wondered why it was separated? We have better tools then ever to do it. But I guess I'm just an odd one out.
Post #1228146
« Prev Topic | Next Topic »

Add to briefcase «««23456

Permissions Expand / Collapse