You can also include a port value if you
want to limit the SPN to a specific port or you
are using non-standard ports for a particular
Web application. For example, if your central
administration site is hosted on port 35000, you
might want to include this specification in your
SPN registrations for the SharePoint Central
Administration site. To offer a more detailed
example, if you host Central Administration
on a computer named CA01 in the fabrikam
.com domain on port 35000, your SPNs for this
site would be HTTP/CA01.fabrikam.com:35000
and HTTP/CA01:35000.
Finally, the name part of the SPN is rarely
used except for services that are replicated. You
can safely omit the name part of an SPN for your
MOSS-related SPN registrations.
In terms of AD, the SPNs are values automatically
written to the servicePrincipalName
multivalued attribute of a computer account
when it’s registered in an AD domain. For
example, workstation01 in the fabrikam.com
domain will have the following two SPNs automatically
registered: HOST/WORKSTATION01
and HOST/workstation01.fabrikam.com. Servers
registered in the domain will also have the
HOST SPN entries and are likely to have some
symbolic class as well, such as SMTPSVC.
Because of this automatic registration, your
AD client can use Kerberos authentication to
authenticate you to a domain. In addition, the
NT AUTHORITY\NETWORK SERVICE (aka
Network Service) acts as the computer on the
network and therefore inherits the SPN settings
of the computer.
You might ask then, if Network Service has
an SPN on it already, why bother having to set
the SPN if an IIS application pool can use this
account for its identity? To that we would say,
great question! Microsoft recommends that
you use an AD user account for each application
pool supporting a MOSS Web application.
Although we don’t have specific information
about this, we believe Microsoft discourages the
use of Network Service for this purpose because
it would require that you assign several permissions
to this ubiquitous and typically low-privilege
account. Therefore, when you assign a user
account to an Application Pool’s identity that
will provide Kerberos authentication, you must
then assign an SPN to that account. During the
authentication handshake between the client
browser and the Web application, IIS uses the
SPN to retrieve a Kerberos ticket from the KDC
and a session key on behalf of the logged-on
user.
Setting SPNs
With the aptly named setspn command-line
tool that’s part of Windows Server 2003 SP1 and
later (and included as a support tool for Windows
2000 Server), you can perform SPN create,
read, update, and delete operations. The create
operation is referred to as registering an SPN. Figure 2 shows the registration process.
Because registering an SPN is a securitysensitive
operation, you must have administrative
permissions in the domain to create, update
or delete an SPN. Any authenticated user can
read SPNs created for a user account or computer.
Being able to read an SPN is important,
especially if you work in an organization where
you don’t have administrative permission in
the domain to set it yourself, so you can check
for configuration accuracy and troubleshoot
errors.
In the example of a host named corpweb
and corpweb.fabrikam.com, if the application
user account assigned to the MOSS Application
Pool identity is fabrikam\PortalAppPool,
the following SetSPN commands prepare the
account for Kerberos authentication:
setspn -A HTTP/corpweb fabrikam\
PortalAppPool
setspn -A HTTP/corpweb.fabrikam
.
com fabrikam\PortalAppPool
The first command sets the HTTP class and
the NetBIOS name of the Web server on the
fabrikam\PortalAppPool user account. The
second command sets the HTTP class and fully
qualified host name (DNS name) for the portal
on the same user account. After registering the
user account with the required SPNs, running
the following command:
setspn -L portalapppol
returns the following output:
Registered ServicePrincipalNames for CN=
PORTALAPPPOOL,OU=SVCACCOUNTS,
DC=FABRIKAM,DC=COM:
HTTP/corpweb
HTTP/corpweb.fabrikam.com
The -L parameter shows the distinguished
name of the PortalAppPool account and the
SPNs registered on that account. Note the command
parameter syntax suggests that you can
run setspn commands only against computer
names. However, it also works for user accounts,
as the previous example demonstrates.
Continued on Page 3
SCG December 18, 2007 (Article Rating: