Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'd like to know, if it is possible to set an SPN with non root url as something like that:

setspn -U -A http/www.example.com/someApp/path/ someServiceUser

So that different applications running in different IIS-Application Pools can have different SPNs

I tried the command, but it tells me that the name reference is invalid (which i can understand, since / is a special char in SPNs).

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Probably not. As far as I know, Kerberos service principals are always in the form service/hostname (exactly two components), and the hostname always matches the one that the client wants to access (not the one the server claims to be). It's possible for HTTP/* SPNs to include the port, but never the HTTP path.

share|improve this answer
    
That's not what i wanted to hear, but it matches my experience. –  Grumbler85 Jul 9 '13 at 13:30
    
Btw this here is core information for me: the hostname always matches the one that the client wants to access (not the one the server claims to be) - i was not aware of that. –  Grumbler85 Jul 9 '13 at 13:31
    
@Grumbler85: A small addition to that: MIT Kerberos and Heimdal (the most common Kerberos implementations for Unix(-like) systems) often use the "reverse DNS" of the server's address as the principal's hostname. However, Windows itself does not seem to do this, which makes sense given that DNS is insecure. –  grawity Jul 9 '13 at 13:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.