Kerberos Delegation in Windows 2000 Multi-Tier Apps

This article provides an overview of how Microsoft Windows 2000 implements Kerberos authentication delegation to solve the "double-hop" authentication issue in multi-tier web applications. In Windows 2000, this functionality was introduced as unconstrained delegation, allowing an intermediate web server—such as Internet Information Services (IIS)—to impersonate an authenticated client and request network resources on a back-end server, such as Microsoft SQL Server, on the client's behalf.

The Double-Hop Problem in Multi-Tier Architectures

In a standard multi-tier deployment, a client browser connects to a middle-tier IIS web server (hop one), which then queries a back-end database server (hop two). Prior to Windows 2000, Windows relied heavily on NTLM authentication, which inherently prevents credential forwarding. Under NTLM, once a client authenticates to the web server, the web server cannot reuse those credentials to authenticate downstream network requests. This forced administrators to rely on anonymous connections, hardcoded service accounts, or basic authentication over SSL.

How Windows 2000 Implements Kerberos Delegation

Windows 2000 resolved this limitation by integrating the Kerberos Version 5 protocol into Active Directory. The implementation in Windows 2000 operates via Unconstrained Delegation, relying on forwarded Ticket-Granting Tickets (TGTs). The process functions through the following steps:

  1. Authentication to the Middle Tier: The client requests a Kerberos Ticket-Granting Service (TGS) ticket from the Key Distribution Center (KDC)—which resides on an Active Directory domain controller—for the middle-tier web server.
  2. Forwarding the TGT: Because the middle-tier service account is configured for delegation, the KDC issues a forwardable TGT alongside the session ticket. The client packages its forwardable TGT inside the authenticator message sent to the IIS server.
  3. Caching in LSASS: Upon receiving the request, the web server decrypts the service ticket and extracts the client’s forwarded TGT. It stores this TGT in the memory cache of the Local Security Authority Subsystem Service (LSASS).
  4. Accessing the Back-End Tier: When the middle tier needs to query the back-end database, it uses the cached client TGT to contact the KDC. The web server requests a new service ticket for the back-end database's Service Principal Name (SPN) on behalf of the client.
  5. Back-End Authentication: The back-end server validates the service ticket, granting access based on the original user's domain identity and group memberships rather than the web server's service account.

Active Directory Configuration Requirements

For unconstrained delegation to function in a Windows 2000 domain, several specific directory conditions must be met:

  • Trust for Delegation: The computer account or domain user account running the middle-tier web service must have the TRUSTED_FOR_DELEGATION flag enabled in Active Directory. In the Active Directory Users and Computers console, this is configured via the "Trust this computer for delegation" or "Trust this user for delegation" checkbox.
  • SPN Registration: Accurate Service Principal Names must be registered for all services involved using tools like setspn.exe. IIS must have HTTP/hostname registered, and the back-end database must have its corresponding service name (e.g., MSSQLSvc/hostname) mapped to the respective running accounts.
  • Account Delegation Controls: The authenticating user's account must not have the "Account is sensitive and cannot be delegated" attribute (NOT_DELEGATED) enabled, which explicitly prevents the KDC from generating forwardable TGTs for high-privilege users.

Security Limitations of the Windows 2000 Model

While Windows 2000 solved the multi-tier authentication problem, its implementation is strictly "unconstrained." Once a middle-tier server receives a forwarded TGT from a client, it can use that ticket to request access to any network resource in the domain that accepts Kerberos authentication, not just the designated database server. If the middle-tier web server is compromised, an attacker can extract all cached client TGTs from LSASS memory to impersonate those users across the entire domain. This security risk led Microsoft to introduce Constrained Delegation in Windows Server 2003, which restricts middle-tier services to requesting tickets only for explicitly pre-approved downstream services.