< service type >/< host name >:< port number > or < service type >/< host name >
< service type >/< host name >:< port number >/< distinguished name >
If you install multiple instances of a service on computers throughout a AD Forest, each instance must have its own unique SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication.
For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. For more information about SPN format and composing a unique SPN, see Name Formats for Unique SPNs.
The ServicePrincipalName is the Service-Principal's unique ID within the Kerberos Database.
The SPN is sent to the Key Distribution Center to obtain a security token for authenticating the connection.
The form of an SPN is as shown in the following form:
< service type >/<host>:<port>/<service name>
In this form, "<service type>" and "<host>" are required. "<port>" and "<service name>" optional.
Typically, the client recognizes the "<service type>" part of the name, and recognizes which of the optional components to include in the SPN. The client can retrieve components of the SPN from sources such as a ServiceConnectionPoint (SCP) or user input.
For example, the client can read the serviceDNSName attributeType of a service's serviceConnectionPoints to get the "<host>" component. The serviceDNSName attributeType contains either the DNS name of the server on which the service instance is running or the DNS name of SRV records containing the host data for service replicas. The "<service name>" component, used only for services capable of Replication, can be the Distinguished Name of the service's SCP, the DNS name of the domain served by the service, or the DNS name of SRV or MX records.