Hello.
I've configured a Web Application Proxy with ADFS 3.0, to replace the TMG reverse proxy function.
Everything is working fine without pre-authentication. I can publish the external url's to internal etc etc.
There is only a problem with the pre-authentication.
I've set all needed SPN's:
HOST/WAPserver
HOST/WAPserver.domain.local
HOST/WAPserver
HOST/WAPserver.domain.local
RestrictedKrbHost/WAPserver
RestrictedKrbHost/WAPserver.domain.local
Termsrv/WAPserver
Termsrv/WAPserver.domain.local
Wsman/WAPserver
Wsman/WAPserver.domain.local
And for the delegation:
msDS-AllowedToDelegateTo ==> HTTP/Sharepoint2013
msDS-AllowedToDelegateTo ==> HTTP/Sharepoint2013.domain.local
When I browse to the Sharepoint URL, it's shows up the logon form.
After entering the credentials, it authenticated me against Sharepoint and redirects me to the Sharepoint URL.
That's all good...
This a enterprise environment.
We want to automate a new infra without TMG as reverse proxy and load balancer (for the server farms).
We're going to use ARR with Web Application Proxy as alternative.
The problem is that I cannot add the already existing servers and new servers, as msDS-AllowedToDelegateTo HTTP/ value. Even if I could, I'm not allowed to reboot the Web Application Proxy cluster, because connections will be lost.
I'm also not allowed to use same single ServiceAccount for CRM, Sharepoint, AX, NAV etc etc.
I want to delegate to each server in our whole domain.
Something like this:
msDS-AllowedToDelegateTo ==>
HTTP/*
msDS-AllowedToDelegateTo ==>
HTTP/*.domain.local
Unfortunatelly
HTTP/* and
HTTP/*.domain.local are not working. I'm still getting a internal server error.
Web Application Proxy encountered an unexpected error while processing the request. Error: No credentials are available in the security package (0x8009030e).
Switching back to msDS-AllowedToDelegateTo ==>
HTTP/Sharepoint2013 and
HTTP/Sharepoint2013.domain.local, a reboot of the Web Application Proxy and it works like a charm.
Once again:
I want to delegate to each server in our whole domain.
Something like this:
msDS-AllowedToDelegateTo ==>
HTTP/*
msDS-AllowedToDelegateTo ==>
HTTP/*.domain.local
Can anyone help me with this blocking issue?