SOA, Kerberos, IIS, and Security Best Practices

With all these buzzwords no blog post is enough - it is about many heavy books...

I'd like to point out couple of things I was dealing recently.

Web Services hosted by IIS is the most common technology today to implement distributed systems [call it SOA].

When hosting web services on ISS 6.0 it is best practices to give it its own process isolation provided by Application Pool.

It is best practice to give each process [Application Pool] its own security context - configured in Identity tab of Application Pool. Here is how.If there is the need for the Web Service to access network resources the account needs to be Domain account [there are though workaround for workgroups too - creating two identical local accounts on requesting and target machines]

It is best practice to use strongest platform authentication mechanism available [do not count client certs this time] - which is Kerberos.

To flow windows identity along the physical tiers one must use Kerberos utilizing Win2000/Win2003 delegation feature.

And here is the catch - when defining custom Domain accounts for Application Pool in IIS Kerberos fails and one needs to force it for NTLM authN.

So here is the dilemma:

1. If I need to flow the identity along the tiers then I need Kerberos. I need to run my App Pool under account that I can give spn [only one spn can be given to HTTP Service]:

Note   You can only have a single SPN associated with any HTTP service (DNS) name, which means you cannot create SPNs for different service accounts mapped to the same HTTP server unless they are on different ports. The SPN can include a port number.

That means I cannot get process isolation.

2. If I need process isolation and give each App Pool its own Domain account I need to downgrade to NTLM. Which is OK but everyone seems to like Kerberos :-).

In this case I cannot get delegation - windows identity flow across tiers.

Cheers