Kerberos setup for SharePoint 2013

If using Kerberos then the following needs configuring (this is similar to how it is done for SP2010).

Note: The authentication method for Web Applications must be Claims (the default) if you want to support all SharePoint App scenarios. Classic Windows authentication is not supported (in SharePoint 2013 the only way to create this type of Web Application is using PowerShell).

1. Create SPNs
   

   In a PowerShell window create the SPN’s for each web application for both the short name and FQDN, e.g.
   setSPN –S HTTP/PORTAL DOMAIN\PortalAppPool
   setSPN –S HTTP/PORTAL.DOMAIN.COM DOMAIN\PortalAppPool
   



2. Allow ‘Trust for delegation’
   
   
   
   1. Open Active Directory Users and Computers applet
   
   
   2. View the Properties for your SharePoint server
   
   
   3. On the Delegation tab select Trust this computer for delegation to any service
   
   
   4. Click Ok
   
   
   5. Repeat steps a-d for any other servers that will need to delegate authentication, e.g. all WFE’s, CA, App server, etc.
   
   
3. Configure SharePoint Web Application to use Kerberos authentication
   
   
   
   1. Creating a new Web Application
      
      
      
      1. In Central Administration navigate to Manage Web Applications
      
      
      2. From the ribbon, click New
      
      
      3. In the Claims Authentication Types section ensure Integrated Windows authentication is selected with Kerberos selected from the drop down
      
      
   
   
   2. Configuring an existing Web Application
      
      
      
      1. In Central Administration navigate to Manage Web Applications
      
      
      2. Select the Web Application to configure
      
      
      3. From the ribbon click Authentication Providers
      
      
      4. Click Default
      
      
      5. In the Claims Authentication Types section ensure Integrated Windows authentication is selected with Kerberos selected from the drop down
      
      
4. Ensure IIS settings are correct
   
   
   
   1. Open IIS Manager
   
   
   2. Select the Web Site that relates to the Web Application in SharePoint
   
   
   3. In the Features View double-click Authentication
   
   
   4. Ensure Forms Authentication and Windows Authentication are both enabled (ignore the warning that they cannot be used simultaneously)
   
   
   5. Select Windows Authentication and click Providers in the right-hand Actions pane
   
   
   6. Ensure Negotiate and NTLM are enabled, with Negotiate being at the top
   
   
5. KRB_AP_ERR_MODIFIED error
   

   We also need to enable IIS to participate in Kerberos exchanges using the app pool identity (a domain account) rather than the local system account otherwise Kerberos authentication will fail with a KRB_AP_ERR_MODIFIED error. There are 2 ways of doing this:

   1. Machine wide for all IIS Web Sites. (Ideal for a dev machine)
      
      
      
      1. Edit c:\windows\system32\inetsrv\config\applicationHost.config
      
      
      2. Find the system.webserver/security/authentication/windowsAuthentication element
      
      
      3. Ensure the attribute useAppPoolCredentials=”true” is present
      
      
      4. Save the file and restart IIS
      
      
   2. Individually per web site in IIS. This option is better for targeting implementation at specific web sites. Also SP2010 required this approach as it did not support this value switched on, however SP2013 does seems to support this now.
      
      
      
      1. In IIS Manager
      
      
      2. Select the Web Site that relates to the Web Application in SharePoint
      
      
      3. In the Features View double-click Authentication
      
      
      4. Select Windows Authentication and click Advanced Settings in the right-hand Actions pane
      
      
      5. Ensure Enable Kernel-mode authentication is unchecked
      
      

Credit to David Gent who gathered most of the information above and by trial and error