title: Set up Kerberos Authentication with Delegation on IIS 7 w/ Windows Server 2008
body: <p><strong>Situation:</strong></p>
  
  <p>I have a .NET asmx web service deployed on my web server. This service calls a service on another server (our SharePoint server, if that's relevant). I want to impersonate/delegate the call to the SharePoint service from my web service by using the credentials of the client.</p>
  
  <p><strong>Problem:</strong></p>
  
  <p>I'm getting a 401 response back from the SharePoint service when I call MY Web Service and it calls SharePoint.</p>
  
  <p><strong>Setup:</strong></p>
  
  <ul>
  <li>My web server is running IIS 7. The app pool is running under "Network Service"</li>
  <li>On my Windows Server 2003 domain controller the web server has "Trusted for Delegation (Kerberos Only)" enabled.</li>
  <li>In ISS my app has Anonymous Authentication Disabled, Impersonation Enabled, and Windows Authentication Enabled with all three providers enabled (Negotiate:Kerberos, Negotiate, and NTLM)</li>
  <li>The SharePoint server is set up with Anonymous Enabled, Impersonation enabled and Windows Authentication Enabled with ONLY provider NTLM enabled.</li>
  </ul>
  
  <p>I can see on the SharePoint logs that when I run locally in Visual Studio a username is getting passed through (and the service works correctly) but when I run it on the web server NO username is on the log file and I get a 401 error</p>
  
  <p>What an I setting up wrong to make the Kerberos delegation work?</p>
  
  <p>Ideas? Thanks!</p>