I have a flask application on a IIS web server. The web server has been configured to use Kerberos delegation when the flask app access a SQL server in order to use the underlying user to login the SQL server database as opposed to the web server service account. The first hop is working fine as I can see the kerberos http ticket being generated when I access the website in the browser (using klist command). However, the second hop does not work so the user logged on SQL server is the web server service account. I could not find any solution to this problem. Has anyone ever had this issue and know how to resolve it without having to use ASP.NET API's or customizing the wfastcgi module? P.S. I tried Pywin32 tokens but they didn;t work. Continue reading...
