SharePoint File Share access via Kerberos and ISA

[cutty]

We are using the Salamander MyDocuments web part with SharePoint in order to provide access to students' personal folders on a file share. The file share is on a separate server to the SharePoint Web Front End. We have configured Kerberos authentication and MyDocuments works fine internally.

 

We use ISA 2006. Externally we can browse to the SharePoint site and turning on Kerberos Logging and using Wireshark I can see that Kerberos is being used. The MyDocuments web part however does not work externally. Presumably this is something to do with ISA and (triple?) hopping from ISA -> SharePoint Web Server -> File Share server.

 

I am wondering if anyone else out there is using MyDocuments in this configuration and if you successfully have it working using Kerberos?

 

[i have contacted Richard from Salamander and he has been very helpful, but, as he admits, his experience with ISA is limited. So I'm looking to find out if anyone has this working and might be able to share their experience with me].

[ajbritton]

Hi. I'm no SharePoint, Kerberos, or ISA expert, but your question intrigues me so I did a little Googling. I'm sure you've done the same, but for the record, here are links to what I found. The phrase 'Constrained Delegation' came up in many posts/articles.

 

Kerberos Constrained Delegation in ISA Server 2006

 

Kerberos Protocol Transition and Constrained Delegation

 

Configuring ISA Firewalls (ISA 2006 RC) to Support User Certificate Authentication using Kerberos Constrained Delegation (Part 1) – Front-end/Back-end Exchange Server Publishing Scenario

 

If these links are wildly off track then please let me know and I'll remove this post.

[cutty]

Hi. I'm no SharePoint, Kerberos, or ISA expert, but your question intrigues me so I did a little Googling. I'm sure you've done the same, but for the record, here are links to what I found. The phrase 'Constrained Delegation' came up in many posts/articles.

 

Kerberos Constrained Delegation in ISA Server 2006

 

Kerberos Protocol Transition and Constrained Delegation

 

Configuring ISA Firewalls (ISA 2006 RC) to Support User Certificate Authentication using Kerberos Constrained Delegation (Part 1) – Front-end/Back-end Exchange Server Publishing Scenario

 

If these links are wildly off track then please let me know and I'll remove this post.

 

Hi Andy,

 

Thanks for the info. I have read the links you posted along with many others :-)

 

What I'm really after is someone to say, "Yes, we have the Salamander MyDocuments web part and it's working in the same scenario as yours". I've already spent the best part of 4 full days on it over 2 months and we have paid external consultants to look at it for us.

 

Before I commit any more time I want to be certain that it is going to work and that I'm not wasting my time (an hopefully someone can give me the small nugget of information that will complete the puzzle for me :0)

 

Cheers,

 

Iain

Edited August 9, 2010 by cutty

[TheScarfedOne]

Hi

 

I am pleased to say I am one of those people who has the config you are wanting to use. My Docs Server, Sharepoint, and ISA/TMG all on separate machines and working internally and externally.

 

PM me - but Im slightly confused by the problems you report, as I dont recall doing any specific config.

 

Stuart

[cutty]

Thanks Stuart, just what I wanted to hear.

 

Unfortunately I'm a newbie here and only have 3 posts so far (4 counting this one) so I can't PM you. Any chance you can email me on icarlin at westminster dot sa dot edu dot au so we can PM about your setup.

 

Cheers,

 

Iain

[TheScarfedOne]

ahhh. no problem, email sent...

[cutty]

Hi Stuart,

 

Sorry to bug you, I’ve sent you a couple of emails now with no reply – not sure whether you are on leave or the emails are getting lost or what? Have you received my previous emails?

 

Iain Carlin