What is the correct format for specifying SPN?

Question

Firstly, the name of the service participant is registered for the user using the setspn command.

setspn -a CS / [e-mail] dummyuser

setspn -l dummyuser

gives the result as

CS / [e-mail]

Then, when the ktpass command is executed with the / mapUser switch, the service principal name of the user account changes so that the domain component is dropped.

ktpass / pass Password @ 123 -out dummy.1.keytab -princ CS / [e-mail] -crypto DES-CBC-MD5 + DumpSalt -ptype KRB5_NT_PRINCIPAL + desOnly / mapOp set / mapUser dummyuser

setspn -l dummyuser

gives the result as

CS / dummy

Do both of the following commands work correctly and work the same?

setspn -a CS / dummy dummyuser

setspn -a CS / [e-mail] dummyuser

SPN ? ?

Answer 1

, , Windows Active Directory? , "ktpass", , Windows. , , Active Directory - abc.com, Kerberos - ABC.COM.

• keytab, SPN (, Kerberos), SPN , SPNs.
• Kerberos keytab. , . SSB Kerberos . Kerberos "/mapUser". , .
• , DES. . , , .
• "setspn -a" SPN , "setspn -s", "-s" SPN, "-a" - (. "setspn -s" vs. "setspn -a" ).
• , - SPN (.. dummy.abc.com, ). , NTLM Kerberos, .
• , DNS Kerberos, Kerberos DNS ( /etc/krb 5.conf, UNIX/Linux Windows , C:\Windows\krb5.ini, ), Kerberos SPN "setspn -a" "setspn -s", Kerberos.

, , , , :

setspn -a CS/dummy dummyuser

:

setspn -s CS/dummy.abc.com dummyuser

keytab, DES, .

ktpass +rndPass -out dummy.1.keytab -princ CS/[e-mail] -crypto DES-CBC-MD5 +DumpSalt -ptype KRB5_NT_PRINCIPAL +desOnly /mapOp set /mapUser [e-mail]