Thursday, August 17, 2023

IIS Windows SSO with Multiple Hostnames

We had an issue were an old server (cobalt1.contoso.com) using IIS SSO was depcreated and a new server (cobalt2.contoso.com) took its place. The DNS record for the older server was updated with the new server's IP address, but while SSO worked when accessing cobalt2.contoso.com, it would prompt for credentials when accessing server1.contoso.com. Both hostnames were properly added to the intranet zone under the security tab in internet options. To resolve the issue: - Delete "cobalt1.contoso.com" computer object in Active Directory. - From elevated CLI on cobalt2 run “netdom computername cobalt2 /ADD:cobalt1.constos.com”. - From elevated CLI on cobalt2 run “ipconfig /registerdns”. This adds "HOST/cobalt1.contoso.com" to the "servicePrincipleName" attribute and "cobalt1.contoso.com" to the "msDS-AdditionalDnsHostName" attribute for the cobalt2 computer object. The hostname used for SSO needs needs to be in those attributes in addition to being in the intranet zone under the security tab in internet options.

No comments:

Post a Comment