KB487084: Enabling Kerberos (Integrated) authentication for MicroStrategy Web on IIS with constrained delegation

Introduction

_{This document describes how to enable Kerberos (Integrated) authentication for Strategy Web on IIS with constrained delegation.}

Steps

Please follow steps as described in KB article KB319307, which outlines how to enable Integrated authentication for IIS (however with unconstrained delegation)
When using constrained delegation, there are a few additional things to consider:

• ASP impersonation needs to be disabled
• Kerberos mode in sys_default.xml needs to be set to DELEGATION or set within sys_defaults.properties file:

 
and on Active Directory side - 'Use any authentication protocol' needs to be set:

Note: If set to ‘Use Kerberos only’, the following error appears in the Strategy Web logs:

<message>Login failure - unable to obtain Kerberos ticket for MSTRSVRSvc/xxx:34952 - Operation unavailable (Mechanism level: Require Oracle JRE 1.8 for kerberos constrained delegation)</message>  <exception>GSSException: Operation unavailable (Mechanism level: Require Oracle JRE 1.8 for kerberos constrained delegation)
	...KrbException: S4U2self ticket must be FORWARDABLE
	at java.security.jgss/sun.security.krb5.internal.CredentialsUtil.acquireS4U2selfCreds(CredentialsUtil.java:105)
	…