In an unconstrained Kerberos delegation configuration, the application pool identity runs on Web-Server and is configured in Active Directory to be trusted for delegation to any service. In the scenario above, both configurations allow users to delegate credentials from their user session on machine Workstation-Client1 to the back-end API server while connecting through the front-end Web-Server. To use Kerberos credential delegation, refer to Troubleshoot Kerberos failures in Internet Explorer first.

The steps below will help you troubleshoot this scenario: The setup works with Internet Explorer, but when users adopt Microsoft Edge, they can no longer use the credential delegation feature. The website located on Web-Server will make HTTP calls using authenticated user's credentials to API-Server (which is the alias for Backend-Web-SRV) to retrieve application data on behalf of users, using Kerberos credential delegation.Then they will launch a browser (Microsoft Edge), navigate to a website located on Web-Server, which is the alias name used for Primary-IIS-SRV, and authenticate via integrated Windows authentication using Kerberos.Users of the computer Workstation-Client1 will log on to the machine using the Windows Active Directory account.The Workstation-Client1 computer is part of the same active directory as primary Web-Server, called Primary-IIS-SRV and the backend web server, called Backend-Web-SRV.This article assumes that you are setting up an architecture similar to the one represented in the diagram below: Follow this article's steps to set up the delegation of authentication tickets and use services with a modern browser such as Microsoft Edge version 87 or above.

Setting up Windows Authentication based on the Kerberos authentication protocol can be a complex endeavor, especially when dealing with scenarios such as delegation of identity from a front-end site to a back-end service in the context of IIS and ASP.NET.

Applies to: Internet Information Services Introduction

Microsoft edge chromium on linux