Troubleshooting Kerberos SPN


Some ideas to help Troubleshooting for SPNs.

Kerberos authentication is not possible for services without properly set Service Principal Names. SPNs are unique identifiers for services running on servers.

Each service that uses Kerberos authentication needs to have an SPN set for it so that clients can identify the service on the network.

The SPNs are registered in Kerberos Database.

When using Active Directory, they are a user or computer account as an attribute called Service-Principal-Name. The SPN is assigned to the account under which the service the SPN identifies is running.

Any service can look up the SPN for another service. When a service wants to authenticate to another service, it uses that service’s SPN to differentiate it from other services running on that computer.

Often, you will find your service attempts to use Kerberos authentication which fails and then the service falls-back to NTLM. The typical reason is that there is a failure for obtaining a Client-To-Server Ticket due to not finding the correct Service form the provided SPN.

Improper SPN Registration#

KDC_ERR_PRINCIPAL_UNKNOWN: SPN not registered in AD, or service is being accessed under the wrong name You can check the SPNs using setspn.exe or you can also see the SPNs using LDAP.

More Information#

There might be more information for this subject on one of the following: