Windows Service, SSPI, Kerberos, SQL Server on another machine.

Question

Hi,
I have a TCPIP service running on SERVER which connects to a SQL Server that is located on another machine. (SQLSERVER).
The client authenticates with the SERVER using the Kerberos security package successfully.
the 3 machines are in the same domain.
When the service is running under the System account, the connection to the SQL Server machine succeeds (I have enabled the "Trust computer for delegation" option for the SERVER machine).
But When the service is running under a specific user profile (eg: USER1), the connection to the SQL Server machine fails with this error:
Login failed for user 'AUTORITE NT\ANONYMOUS LOGON'
I have tried toadd the "Impersonate a client after authentication" user right for USER1 in the Local Security Policy, but it does not solve the problem.
Does someone know what is wrong here please?
Thank you,
Olivier gg.
(Note: the "Forest Functional Level" of the domain is Win2000).

Answer 1

Retried in a test domain with
Forest Functional Level set to 2008, and figured out what to do.
This page (How To: Use Impersonation and Delegation in ASP.NET 2.0, (http://msdn.microsoft.com/en-us/library/ms998351.aspx#paght000023_delegation) especially the
Use Kerberos authentication and delegation part) helped me.
However something remains unclear: I had first selected the "Trust this user for delegation to any service (Kerberos only)" option for the domain user,
but it did not work (Does someone know why?).
I had to select the "Trust this user for delegation to specified services only" option and specify explicitely the appropriate SPN in order to have the delegation working.