This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Troubleshooting Kerberos SPN
Troubleshooting Kerberos SPN

Version management

Difference between version and

At line 1 added 21 lines
!!! Overview
Some ideas to help [Troubleshooting] for [SPNs].
[Kerberos] authentication is not possible for services without properly set [Service Principal Names|SPN]. [SPNs] are unique identifiers for services running on servers. Each service that uses [Kerberos] authentication needs to have an SPN set for it so that clients can identify the service on the network.
The [SPNs] are [registered|SPN Registration] in [Kerberos Database].
When using Active Directory, they are a user or computer account as an attribute called Service-Principal-Name. The [SPN] is assigned to the account under which the service the SPN identifies is running.
Any service can look up the [SPN] for another service. When a service wants to authenticate to another service, it uses that service’s SPN to differentiate it from other services running on that computer.
Often, you will find your service attempts to use [Kerberos] authentication which fails and then the service falls-back to [NTLM]. The typical reason is that there is a failure for obtaining a [Client-To-Server Ticket] due to not finding the correct Service form the provided [SPN].
!! Improper [SPN Registration]
KDC_ERR_PRINCIPAL_UNKNOWN: SPN not registered in AD, or service is being accessed under the wrong name
You can check the SPNs using setspn.exe or you can also see the SPNs using LDAP.
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop