Kerberos token in windows logon

[Guest lobezno]

Hello

I'm working with a custom ISA Server, inside my filter I've created a

kerberos ticket using LsaLogonUser windows function.

 

Is it viable that for an Explorer navigator to reuse a ticket kerberos that

has been negotiated (on behalf of another user) between an ISA Server and an

IIS Server, to call that IIS Server with that Authoritation?

 

It means: we have created a ticket kerberos inside ISA (custom webfilter),

this ticket delegates to an IIS, and a SQL Server after (simple kerberos

constrained delegation), but in the response, there is no ticket returns to

the client (internet explorer). This is possible??

 

Thanks for all.

[Guest Peter Foldes]

You are posting to the wrong newsgroup. Repost to the one below

 

On the web:

http://www.microsoft.com/communities/newsg...a.configuration

 

or

 

On the web also

http://www.microsoft.com/communities/newsg...soft.public.isa

 

--

Peter

 

Please Reply to Newsgroup for the benefit of others

Requests for assistance by email can not and will not be acknowledged.

 

"lobezno" <lobezno@discussions.microsoft.com> wrote in message

news:0E183EE4-AB94-4B60-9EAB-239418C5E0D2@microsoft.com...<span style="color:blue">

> Hello

> I'm working with a custom ISA Server, inside my filter I've created a

> kerberos ticket using LsaLogonUser windows function.

>

> Is it viable that for an Explorer navigator to reuse a ticket kerberos that

> has been negotiated (on behalf of another user) between an ISA Server and an

> IIS Server, to call that IIS Server with that Authoritation?

>

> It means: we have created a ticket kerberos inside ISA (custom webfilter),

> this ticket delegates to an IIS, and a SQL Server after (simple kerberos

> constrained delegation), but in the response, there is no ticket returns to

> the client (internet explorer). This is possible??

>

> Thanks for all. </span>