Warning I am not a Windows AD Security “expert”, I don’t play one on TV, and I did not stay at a Holiday Inn Express last night.
Ok, so it is 1 am in the morning and I am working on my labs for Professional SharePoint Administration. In the class we do a least-privilege install where we end up with about 8 different accounts. Then we configure the whole farm to use Kerberos authentication. Lots of fun and I really think it is important to understand. It isn’t hard to do, just tedious. Anyway.
I do my setspn.exe for central admin as setspn.exe –A HTTP/server.tpg.local tpg\sp_farm and again as setspn.exe –A HTTP/server tpg\sp_farm no problem. I log onto the server as tpg\sp_farm and open Central Administration. It takes me to http://server:5555 and all is well. I then make Bob Farmer a member of the farm administrator group. Then I hit the sign in as a different user and input tpg\bob. Nothing but errors. What the heck?
After 5 minutes of cussing I see this error message in Event Viewer.
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/server.tpg.local. The target name used was HTTP/server.TPG.local. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (TPG.LOCAL), and the client realm. Please contact your system administrator.
I am the system administrator. Who do I see? Do you see the issue? Apparently the proper FQDN is server.TPG.loca instead of server.tpg.local. Surely that can’t be the problem? Let’s see. I run setspn.exe –A HTTP/server.TPG.local tpg\sp_farm Then I try to login again. It WORKS!!!
So I have read lot of contradicting stuff about if SPN’s are case sensitive or not. I still don’t know. What I do know what setting a new SPN with TPG fixed my problem immediately. If you have 2 cents to add I would love to hear it.
Back to work with me. Now it is 1:30 and I still need to play Halo 3 some more before I go to bed. Good thing the wife is already asleep.
Shane – SharePoint Help