In the XI 3.1 SP3 admin guide, page 503, the SETSPN command which is
used as part of the setup process to establish a service account to
enable AD authentication is outlined as follows:
SETSPN.exe -A /
The guide suggests that the can be anything you want to
arbitrarily assign. If I choose something other than the
suggested “BOBJCentralMS” value, is there anywhere else I have to
specify this value to allow the service account to function properly?
The guide suggests that the should be the domain name on
which the service account exists however I’ve seen many posts online which seem to
indicate this should actually be the FQDN of the server
running the CMS service instead of the general domain name.
Clarification there would be very helpful if anyone has some insight.
I recently went through this on a proof of concept machine. We did the following to get everything working on a single machine install:
C:>setspn -a BOBJCentralMS/[doman netbios name] [account]
C:>setspn -a BOBJCentralMS/[ad domain name] [account]
C:>setspn -a HTTP/[machine netbios name] [account]
C:>setspn -a HTTP/[machine fqdn name] [account]
We decided to do all four after reading that information in the BO doc on implementing Vintela SSO. Even though we’re not doing the SSO, I found the discussion of AD authentication to be much more complete than what what was in the admin guide.
So did your first two commands wind up looking something like the above? Without the actual server name running the application services in there anywhere?
Also that domain name should be the domain on which [account] exists correct? Not necessarily the domain the app server itself is on if I understand the documentation correctly.
Yes, to the second question as well. Though if your server resides on a different domain than the account, you’ll want to verify the trusts between the domains are two way, transitive trusts.
You don’t happen to have the link to that vintela sso document off hand do you? Trying to locate stuff on their web site is like trying to find a piece of hay in a needlestack…
I know you can’t post the actual document (copyright issues) but a link would be awesome if you have it, I’ve got a login for their site.
I think that this is the link you are looking for. Not sure why it’s coming down without the .pdf extension. Just rename it and add a .pdf after you download it.
(BOB member since 2003-07-01)