installation - Setup kerberos delegation automatically -

i have web app uses backend servers (unc, http , sql). working need configure serviceprincipalnames account running iis apppool , allow kerberos delegation backend services.

i know how configure through "delegation" tab of ad users , computers tool.

however, application going deployed number of active directory environments. configuring delegation manually has proved error prone , debugging issues misconfiguration causes time consuming. i'd create installation script or program can me.

does know how script or programmatically set constrained delegation within ad?

failing how can script reading allowed services user validate has been setup correctly?

ok, after digging on internet , testing, i've got way forward.

the following code c#. setting spn user or computer can achieved via setspn utility.

alternatively, following c# code can same:

directoryentry de = new directoryentry("ldap://"+usersdn);  if (!de.properties["serviceprincipalname"].contains(spnstring)) {     de.properties["serviceprincipalname"].add(spnstring);     de.commitchanges(); } 

to set constrained delegation:

if (!de.properties["msds-allowedtodelegateto"].contains(backendspnstring)) {     de.properties["msds-allowedtodelegateto"].add(backendspnstring);     de.commitchanges(); } 

if user has had non-constrained delegation enabled, may need turn off before enabling constrained - didn't test scenario.