Kerberos double-hop

• adb2303

  SSCertifiable

  Points: 7588

  More actions

  April 2, 2012 at 5:24 am

  #271265

  Hi,

  I've put together a stored procedure to check a few vital SQL Server functions. One thing we'd like to check is whether the kerberos double-hop is working.

  My set-up:

  I have 2 servers; server1 and server2

  On server1, there's a linked server called 'CAD' pointing to server2

  On server2, there's a linked server called 'REP' pointing to server1

  In code, to check whether kerberos double-hop works between these two servers, I run the following from server1

  EXEC('SELECT TOP 1 * FROM REP.mytestdb.sys.databases') AT [CAD]

  However, this always seems to generate a 'Login failed for user 'NT Authority\Anonymous Logon' message. However, if I log on to a 3rd server, i.e. server3, connect to server1 and run:

  SELECT TOP 1 * FROM CAD.mytestdb.sys.databases

  I get results back. However, in my solution, I can only use server1 and server2 to perform the check.

  What am I doing wrong here?

  Is there a better way to simulate/check a double hop.

  Thanks, Andrew

• K. Brian Kelley

  SSC Guru

  Points: 114562

  More actions

  April 3, 2012 at 9:41 am

  #1468313

  Can you detail the login security you set up for the linked server connections?

  K. Brian Kelley
  @kbriankelley