Integration Guide

10.5.1
- 10.5.5
- 10.5.4.1
- 10.5.4
- 10.5.3
- 10.5.2
- 10.5
- 10.4.1
- 10.4.0
- 10.2.2 HotFix 1
- 10.2.2 Service Pack 1
- 10.2.2
- 10.2.1

Back Next

Generating Keytab Files for the SPN User

Use the Microsoft Windows Server ktpass utility to generate a keytab file for the SPN user.

You must generate the keytab files on a member server or on a domain controller within the Active Directory domain. You cannot generate keytab files on a workstation operating system such as Microsoft Windows 10.

To use ktpass to generate a keytab file, run the following command:

ktpass.exe -out  <keytab filename> -princ <service principal name> -mapuser <user account> [-pass <user account password>]-crypto <keys> -ptype <principal type>

The following table describes the command options:

Option	Description
-out	The file name of the Kerberos keytab file to generate as shown under the KEY_TAB_NAME column in the SPNKeytabFormat.txt file.
-princ	The service principal name displayed under the SPN column in the SPNKeytabFormat.txt file.
-mapuser	The Active Directory user account to associate with the SPN.
-pass	The password set in Active Directory for the Active Directory user account, if applicable.
-crypto	Specifies the key types generated in the keytab file. Set to all to use all supported cryptographic types.
-ptype	The principal type. Set to KRB5_NT_PRINCIPAL.

When you run ktpass, you associate each node account and HTTP process account with the corresponding SPN in Active Directory. The following table shows the association between the accounts and the SPNs described in this article:

User Account	Keytab Type	SPN
nodeuser01	NODE_SPN	isp/node01/InfaDomain/COMPANY.COM
httpuser01	NODE_HTTP_SPN	HTTP/US001DEV.company.com@COMPANY.COM
nodeuser02	NODE_SPN	isp/node02/InfaDomain/COMPANY.COM
httpuser02	NODE_HTTP_SPN	HTTP/US005DEV.company.com@COMPANY.COM
nodeuser03	NODE_SPN	isp/node03/InfaDomain/COMPANY.COM