Search This Blog

Wednesday, June 29, 2016

Login failed for User ‘NT AUTHORITY\ANONYMOUS LOGON’

There are three different ways to solve this issue.

  • Register SPN 
  • Delegation
  • If this error occur in visual studio or after hosted in IIS, IIS setting


Register SPN 

A Service Principal Name (SPN) must be registered for the SQL Server service account (when the local system account will not be used) to allow clients to identify and authenticate the service using Kerberos authentication.

setspn -A MSSQLSvc/<SQL Server FQDN>:1433 <Domain\Account>

Verify Domain user account 

setspn -l <Domain\Account>

Example:

setspn -A MSSQLSvc/computerName.cloud.s1au.org:1433 cloud\admin


https://technet.microsoft.com/en-in/library/bb735885.aspx

Delegation


  1. Click Start, click Administrative Tools, and then click Active Directory Users and Computers.
  2. Expand domain, and then expand the Computers folder.
  3. In the right pane, right-click the computer name for the Web server, select Properties, and then click the Delegation tab.
  4. Click to select Trust this computer for delegation to specified services only.
  5. Ensure that Use Kerberos only is selected, and then click OK.
  6. Click the Add button. In the Add Services dialog box, click Users or Computers, and then browse to or type the name of the Microsoft SQL server that has the App-V data store and is to receive the users credentials from IIS. Click OK.
  7. In the Available Services list, select the MSSQLSvc service that lists port number on which the Microsoft SQL Server is accepting connections for the App-V database (the default port is 1433). Click OK.
  8. And In the Users folder, right-click the user account, and then click Properties.
  9. In the user account properties dialog box, click the Account tab.
  10. Under Account Options, click to select the Account is Trusted for Delegation check box. Make sure that the Account is sensitive and cannot be delegated check box is cleared for this account. 

    Note The 'Account is trusted for delegation' right is required for the SQL Server service account only when you are delegating credentials from the target SQL server to a remote SQL server such as in a double hop scenario like distributed queries (linked server queries) that use Windows authentication.
If this error occur in visual studio or after hosted in IIS, IIS setting

  1. Check your application pool identity user account has rights to database. If not, create it.


No comments:

Post a Comment

Note: Only a member of this blog may post a comment.