NOTE in Visual C#.NET

Creation USS Code 128 in Visual C#.NET NOTE

If you don t deselect the Automatically Detect Settings option, you may be faced with some 502 Bad Gateway error messages, as shown in figure 8.

If you have a proxy server, ensure that you configure it in the Local Area Network (LAN) Settings dialog box discussed previously, but ensure that you ve also selected Bypass Proxy Server for Local Addresses. Figure 7 doesn t show entries for a proxy, as no proxy is present in my environment, but you can see the options available to be enabled if required.

Within the Advanced tab of the Internet Options dialog box, ensure that Enable Integrated Windows Authentication* is set, as shown in figure 9. To get to the Internet Options dialog box, go into the Windows Control Panel and choose Internet Options.

Security settings for the local intranet zone should have this option set as shown in figure 10. This is the default setting for this option.

To get to the Security Settings - Local Intranet Zone dialog box from the Security tab of the Internet Options dialog box, first select the Local Intranet zone at the top of the box, and then click the Custom Level... button as shown in figure 11. The client requirements can be loosened to allow for other browsers and other operating systems on the client side if constrained delegation is used in conjunction with the Use Any Authentication Protocol option shown in figure 2. If this is selected, Kerberos isn t required between the client and the server involved in the first hop. Kerberos is required, though, to make the second hop involving delegation. This configuration is also known as protocol transition and is discussed further in the resources provided in the section Resources to assist in more complex infrastructures.

Now that the SPNs have been set, and the Active Directory and client tier requirements have been met, we must now configure the web tier. At this point, you ll need to configure IIS to host the application. You might want to ask for some assistance from your system administrator or an IIS guru if this isn t your area of expertise. This section steps you though making the necessary configuration changes in IIS to support Kerberos delegation. In this section, we ll configure the IIS web tier by calling the IIS Manager from the Administrative Tools group found in the Windows Control Panel.

To create a new application pool, right-click Application Pool and choose New Pool from within the IIS Manager management console. Give the pool a name and choose to use the default settings for the new application pool.

After creating the new application pool, right-click the entry and choose Properties. Click on the Identity tab, select the radio button next to Configurable, and enter the domain user account and password for which you earlier created an SPN. Figure 12 shows the new application pool Delegation, with the identity of SSTB\Service_SSRS.

Now that we have an application pool, we need to set up a virtual directory within a website. To create a virtual directory, right-click the website in which you want the application to reside. Choose New > Virtual Directory to open the Virtual Directory Creation Wizard. Now enter the alias name for your virtual directory. In my example I ve used the Default Web Site and used an alias of Delegation for the name of the virtual directory. Continue by specifying the path to the website s ASP.NET code. Next ensure that you choose the permission Run Scripts (such as ASP), then choose Next and Finish.

Now that we ve created the virtual directory, we ll need to make sure it uses the newly create application pool. Right-click the virtual directory, navigate to the Virtual Directory tab, and ensure that the drop-down selection box for Application Pool has the