1

I'd like to know, if it is possible to set an SPN with non root url as something like that:

setspn -U -A http/www.example.com/someApp/path/ someServiceUser

So that different applications running in different IIS-Application Pools can have different SPNs

I tried the command, but it tells me that the name reference is invalid (which i can understand, since / is a special char in SPNs).

1

Probably not. As far as I know, Kerberos service principals are always in the form service/hostname (exactly two components), and the hostname always matches the one that the client wants to access (not the one the server claims to be). It's possible for HTTP/* SPNs to include the port, but never the HTTP path.

3
  • That's not what i wanted to hear, but it matches my experience.
    – TGlatzer
    Jul 9 '13 at 13:30
  • Btw this here is core information for me: the hostname always matches the one that the client wants to access (not the one the server claims to be) - i was not aware of that.
    – TGlatzer
    Jul 9 '13 at 13:31
  • @Grumbler85: A small addition to that: MIT Kerberos and Heimdal (the most common Kerberos implementations for Unix(-like) systems) often use the "reverse DNS" of the server's address as the principal's hostname. However, Windows itself does not seem to do this, which makes sense given that DNS is insecure.
    – user1686
    Jul 9 '13 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.