Azure AD Azure Application Proxy with SharePoint Server 2013/2016 Blog Part 2

Objective: Configure SharePoint with Kerberos Constrained Delegation

Configure SharePoint Web Application

Go to Central Administration > Web Applications > Select your web application > Click on Authentication Providers > Click on Default Zone

Set the Integrated Windows authentication to Negotiate (Kerberos)

Azure AD Azure Application Proxy with SharePoint Server 2013-2016 Blog Part 2-1

Configure Alternate Access Mappings

Add an Internal URL in the Default Zone. This is optional whee the purpose is to map the Application Proxy to an internal URL which is not internet routable. In this case, the internal URL is http://spfarm-sp.contoso.com

Azure AD Azure Application Proxy with SharePoint Server 2013-2016 Blog Part 2-2

Kerberos Configuration

Kerberos Constrained Delegation

Kerberos constrained delegation restricts the services to which the specified server can act on the behalf of a user

https://technet.microsoft.com/en-us/library/jj553400%28v=ws.11%29.aspx?f=255&MSPPError=-2147217396

Service Principal Name

A service principal name (SPN) is the name by which a Kerberos client uniquely identifies an instance of a service for a given Kerberos target computer. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN

https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx#SPN_Purpose

Find the service account running the web application pool for your site.

Central Administration > Security

Azure AD Azure Application Proxy with SharePoint Server 2013-2016 Blog Part 2-3

contoso\sp_farm is the service account.

SetSPN command

setspn -l http/rksp.eastus.cloudapp.azure.com contoso\sp_farm

Azure AD Azure Application Proxy with SharePoint Server 2013-2016 Blog Part 2-4

setspn -l sp_farm

Azure AD Azure Application Proxy with SharePoint Server 2013-2016 Blog Part 2-5

Login as administrator to the Active Directory Domain Controller server.

Click Users or Computers…

Find the service account contoso\sp_farm

Azure AD Azure Application Proxy with SharePoint Server 2013-2016 Blog Part 2-6

Azure AD Azure Application Proxy with SharePoint Server 2013-2016 Blog Part 2-7

Select and click OK

Since my farm topology has SQL Server DB on another virtual machine, we need to repeat these steps

setspn -S http/SPFARM-SQL.contoso.com contoso\sqlservice
setspn -S http/SPFARM-SQL contoso\sqlservice
setspn -L contoso\sqlservice

Azure AD Azure Application Proxy with SharePoint Server 2013-2016 Blog Part 2-8

To verify go to a domain-joined computer that is a non-SharePoint server, in my case, I just logged into the AD server.

  • Go to SharePoint site URL and login
  • In command prompt, run klist command
  • Verify there is a cached ticket with HTTP/rksp.eastus.cloudapp.azure.com

Azure AD Azure Application Proxy with SharePoint Server 2013-2016 Blog Part 2-9

Next: Azure AD Azure Application Proxy with SharePoint Server 2013/2016 Blog Part 3

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s