constrained delegation claims SPNs not registered

Hi @all,

my ISA2006 gets me nuts: I want to publish the internal certificate authority web enrollment page for remote users outside the VPN corporate network to allow them renewing their smartcard certificates manually when they become due (autoenrollment won't reach them).

To ensure maximum protection, there's a seperate WebListener that requires SmartCard authentication and that's bound to a web publishing rule to the /certsrv/ and /certcontrol/ and /certcontrol/ directories for the designated web enrollment host. The web publishing rule is activated for constrained delegation and the listener is hardended to accept our own certificates only.

ISA server is a domain member and computer account is trusted for delegation. Certificate Services web enrollment page requires integration windows authentication (kerberos) and runs with the default network service identity. Forest level is W2K3 native.

When smartcard users login, they get prompted for their card/certificate/PIN and *delegation* then immediately fails with isa error 12202 ("denied URL"). Event log shows event ID 21315 "ISA Server failed to delegate the credentials using Kerberos constrained delegation to ... Check that the SPN ... matches SPN in Active Directory."

The http SPN is not explicitly registered for the web enrollment host computer object, but even doing this does not change the misbehavior. If I temporarily allow for user-individual prompting in delegation options, everything is fine but obviously I want to enforce user identity by kerberos delegation. Most of them even don't know their passwords any more... ;-)

What's going wrong with constrained delegation here?

--
CU
Thorsten
.

Relevant Pages

  • Re: unable to request certificate
    ... the second web enrollment issue is associated with kb article 323172. ... > To use the mmc certificate snapins you need to be using an Enterprise CA ... >> I try to request a new certificate in two ways, ... >> certificates from the available CAs ...
    (microsoft.public.win2000.security)
  • Re: Client Certificate -> IIS -> SQL - will it work?
    ... it was determined that it was not possible to use client ... > certificates in this manner because the user credentials could not be ... > certificate authentication did not result in delegatable credentials ... i also tried to move the certificate from a first delegation box ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Web Certificate Enrollment security problem
    ... CERTSVC_DCOM_ACCESS security group of the server with the CA (have added ... The only thing that doesn't work is Web enrollment. ... access auditing and logging "issue and manage certificate requests" on the ... Have seen that there is a component "Certsrv Request" when launching ...
    (microsoft.public.security)
  • Re: Web Enrollment Certificate Request Denied
    ... I'm just trying to figure out why certificate requests work using the ... both on the web enrollment server and its checked on the browser. ... Issuing CA. ...
    (microsoft.public.win2000.security)
  • Re: Requesting a certificate for another user
    ... we support this for smartcards in the web enrollment pages. ... customization of the web pages and some custom code. ... > I don't want to burden a user with certificate request. ...
    (microsoft.public.win2000.security)