One SPN (Main Name Service) is an identifier used by Kerberos to associate a network service with the Active Directory account that executes it. It allows customers to request a ticket for the correct service identity and must remain consistent and unique in order to avoid errors authentication Kerberos.
Simple definition
An identifier that links a network service to an Active Directory account.
Technical definition
Service Main Name allows to Kerberos identify the account under which a service is performed.
What is it used for ?
Allow authentication Kerberos to SQL, HTTP, CIFS or other services.
Practical example
A SQL service may have a SPN MSSQLS vv/server:1433 associated with its service account.
How to check a SPN Active Directory?
In Active Directory, a Main Service Name associate a service authority with the account under which it operates so that Kerberos can ask for a ticket for the right identity. SPN must match the name actually used by the customer and remain unique in the forest.
For Novitier the SPN from an account, use setspn -L COMPTE. To search for a SPN precise, setspn -Q <SPN> avoid creating a duplicate.
Common issues
setspn -X search SPN duplicates. A duplicate can prevent Kerberos determine the right service account. Before deleting or moving an entry, identify the service that uses it, the account that executes it and the alias DNS employees by customers.
- Find SPN exact with
setspn -Q. - Compare returned accounts.
- Validate the FQDN or alias used by the client.
- Correct only after identifying the legitimate owner.
How to validate Kerberos after correction SPN ?
After correction, just purge the necessary tickets or open a new test session, then check Kerberos with klist. If authentication still fails, check DNS, timing of the time, name used by the client and possible delegation. SPN correct does not correct a resolution DNS inconsistent or non-tolerant clock.
Related terms
Key takeaway: Exact behavior and commands may vary depending on versions, products and architectures.
FAQ — SPN and Kerberos
One SPN Must it be unique?
Yes for a given service instance: same SPN recorded on multiple accounts may cause failures Kerberos.
What difference between terns -Q and terns -X?
-Q looks for a value SPN precise; -X searches for duplicates in the directory.
Why? Kerberos fails with a SPN Apparently correct?
The customer can use another name, DNS or the time may be incorrect, or the service may be performed under an account different from the one expected.