1

I'd like to know, if it is possible to set an SPN with non root url as something like that:

setspn -U -A http/www.example.com/someApp/path/ someServiceUser

So that different applications running in different IIS-Application Pools can have different SPNs

I tried the command, but it tells me that the name reference is invalid (which i can understand, since / is a special char in SPNs).

Improve this question

1 Answer 1

Reset to default
1

Probably not. As far as I know, Kerberos service principals are always in the form service/hostname (exactly two components), and the hostname always matches the one that the client wants to access (not the one the server claims to be). It's possible for HTTP/* SPNs to include the port, but never the HTTP path.

Improve this answer
3
  • That's not what i wanted to hear, but it matches my experience.
    – TGlatzer
    Jul 9, 2013 at 13:30
  • Btw this here is core information for me: the hostname always matches the one that the client wants to access (not the one the server claims to be) - i was not aware of that.
    – TGlatzer
    Jul 9, 2013 at 13:31
  • @Grumbler85: A small addition to that: MIT Kerberos and Heimdal (the most common Kerberos implementations for Unix(-like) systems) often use the "reverse DNS" of the server's address as the principal's hostname. However, Windows itself does not seem to do this, which makes sense given that DNS is insecure.
    – user1686
    Jul 9, 2013 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.