Re: SPN problems?

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Joe Kaplan wrote:
Can you show what the SPNs you are setting actually are and what accounts you are setting them on?

A common cause of Kerb auth errors is when you create an SPN like HTTP/someapp and try to put that on two different service accounts. The rule with SPNs is that they can only be on a single account. HTTP does not use the port for forming the SPN, so you cannot differentiate the SPN by port.

hello, yes, I use two separate accounts for two HTTP SPNs :/ thank you for this suggestion, I didin't know about it, will try to use only one account.

Another thing to understand is whether the SPN your are setting is the plain host name of the server and if there is another SPN like HOST/server with the same host name on a different account.

It would also be helpful to know if you get any useful error messages in the system event log from Kerberos or failure audits in the security event log related to this.

HTH,

Joe K.

thanks for this post, I'll experiment a bit and let you know.

cheers,
gonzo
.

Relevant Pages

  • Re: Integrated Windows Authentication Timeout?
    ... "Joe Kaplan" wrote: ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... long as they are all on the same account. ... SPN exists on the account that is running the service. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Integrated Windows Authentication Timeout?
    ... I think you can probably fix that problem by adding the SPN that is being ... queried for to the account running the service. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Delegation problems
    ... This sounds like an SPN problem. ... as a service account, did you add an SPN to that service account in AD that ... delegate from my web server to the SQL service on the DB server when I ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Ldap Binding + Kerbros error
    ... I was suggesting to perform an LDAP query using the exact filter a specified ... A servicePrincipalName (SPN) is the Kerberos name of a service on the ... server authenticates with the client. ... account that is used to execute the Windows process that "is" the service. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Multiple Apache websites using Kerberos authentication (through the mod_auth_kerb module)
    ... Kerberos mechanism on one website. ... Is it possible to have only one Service Principal account and "attach" ... if the URL is http://www.example.com/ the SPN will ... that keytab entry to decrypt the ticket and in doing so authenticate ...
    (comp.protocols.kerberos)