Web Application Proxy - Working, but not delegating a double hop properly.

hi,

i've implemented 'web application proxy' based on technet tutorials.  the proxy working externally can't exposed application perform double hop (wap --> backend iis app --> wcf call --> mssql db).

i'm confident backend server not being passed kerberos ticket able delegate wcf call wap.

what's odd if hit end server domain external application work limited amount of time.  i suspect end server has ticket work internal call.

the site works fine internally.  so i'm not sure why wap can't delegate.  i've set kcd wap can act on behalf of iis app pool identity (service user, not machine account).

adfs/wap event logs show no errors.  event logs indicate ticket being passed adfs wap successfully.

i believe i'm missing form of delegation permission on adfs service account, or wap proxy, i'm baffled.

any appreciated.

cheers,
chris

adfs preauthentication -that process users / devices gets preauthenticated before gain access application.

the high level authentication process follows

• the client device attempts access published web application on particular resource url; example https://app1.contoso.com/.
  
  resource url public address on web application proxy listens incoming https requests.
• web application proxy redirects https request ad fs server url encoded parameters, including resource url , apprealm (a relying party identifier).
  
  user authenticates using authentication method required ad fs server; example, user name , password, two-factor authentication one-time password, , on.
• after user authenticated, ad fs server issues security token, ‘edge token’, containing following information , redirects https request web application proxy server:
  
  
  • the resource identifier user attempted access.
  • the user’s identity user principal name (upn).
  • the expiry of access grant approval; is, user granted access limited period of time, after required authenticate again.
  • signature of information in edge token.
• web application proxy receives redirected https request ad fs server edge token , validates , uses token follows:
  
  
  • validates edge token signature federation service configured in web application proxy configuration.
  • validates token issued correct application.
  • validates token has not expired.
• uses user identity when required; example obtain kerberos ticket if backend server configured use integrated windows authentication.
1. if edge token valid, web application proxy forwards https request published web application using either http or https.
2. the client has access published web application; however, published application may configured require user perform additional authentication. if, example, published web application sharepoint site , not require additional authentication, user see sharepoint site in browser.
3. web application proxy saves cookie on client device. cookie used web application proxy identify session has been preauthenticated , no further preauthentication required.

Windows Server  >  Windows Server 2012 General