SMTP & Kerberos Delegation

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Our email and computer security teams want to tighten up emails being sent
externally. They want the users to authenticate to the SMTP server. I'm not
having much luck and was wondering if anyone else has figured this out.
Environment: IE6/XP client --> W2K3/IIS 6/ASPX page .Net 2.0 --> W2K3/IIS
6/SMTP The Authentication tab for the SMTP server is set to "Integrated
Windows Authentication". The web site on the IIS server is also set for
integrated authentication. The key issue being that we do not want to prompt
the user for their password. The MS Auth Diag tool and Brian Booth's
DelegConfig tool report that Kerberos is ok on the IIS server. I have a test
ASPX page that reads from a UNC on another server and that works fine. In the
security log on that server I see a Kerberos login for the client user. Here
is the ASPX code snippet.


Dim oMM As New MailMessage
Dim oMM As New MailMessage
Dim emailaddr As String = "dave@xxxxxxxxxxxxx"
Dim oAddress As New MailAddress(emailaddr)
Dim oSMTP As New SmtpClient("mailhost.mycompany.com", 25)

oMM.From = oAddress
oMM.To.Add(oAddress)
oMM.Subject = "Mail test"
oMM.Body = "Mail test"
oSMTP.UseDefaultCredentials = True
oSMTP.Send(oMM)
With "UseDefaultCredentials = True" I see an "AUTH gssapi" packet being sent
from the IIS server to the SMTP server in a network trace. The web.config for
the site contains <identity impersonate="true" /> so this should be passing
the credentials of the user. But in the security log on the SMTP server I see
an NTLM logon for NT AUTHORITY\ANONYMOUS LOGON. If I set the web site to use
basic authentication then everything works. But we don’t want to do that
because we want the integrated authentication to take care of that for us.
Within AD, the IIS server is set to "Trust this computer for delegation to
any service (Kerberos only)". And in the metabase on the SMTP server I have
"NTAuthenticationProviders="GSSAPI,NTLM". Does SMTP support Kerberos login's?
The email team also has an SMTP that is installed as part of Exchange. Does
that support Kerberos? My email guys tell me that it should not matter. Note:
SMTP on the IIS server will not require authentication and can only send
emails internally. All externally bound emails must go thru an SMTP server
that requires authentication. How do I pass integrated credentials from a
client to IIS to SMTP? Thanks for any help.
.

Relevant Pages

  • Re: Using forms authentication to control security access to msolap.asp. Is it possible using ASP.NE
    ... authentication problem is resolved. ... The "Pivot Table" component maps to the URL in our IIS server, ... between Analysis Services and the "Pivot Table" component present in some ...
    (microsoft.public.sqlserver.olap)
  • Re: [SLE] SMTP authentication was re:[SLE] mail sending and Postfix was OT: Posting from another un
    ... Would its request be answered by the second SMTP server or would SMTP-3 try and contact the original dialup server which may not be currently connected? ... Authentication, when it is required, will alway happen between the server that currently has the mail and the server that is contacted to receive the mail. ... gmail account through gmail smtp server (bypassing your ISP smtp server), this will also request some ID. ...
    (SuSE)
  • Re: [SLE] SMTP authentication
    ... Would its request be answered by the second SMTP server or would SMTP-3 try and contact the original dialup server which may not be currently connected? ... Authentication, when it is required, will alway happen between the server that currently has the mail and the server that is contacted to receive the mail. ... Now the company mailserver does not have the right to send the mail directly to the internet. ...
    (SuSE)
  • Re: IIS NT authentication , can not access HDD on other NT server
    ... since AFAIK the IIS server using Windows integrated ... > authentication as if they were sitting at the console of the IIS computer. ... > an identical ID and password set up on the target server. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Sending pop3/imap email
    ... Windows Small Business Server 2008 Unleashed ... If the client is set for smtp authentication then they just ... > server as their SMTP server. ... The difference is that I have a different firewall, ...
    (microsoft.public.windows.server.sbs)