Create the service principal names and keytab files
Create the service principal names and keytab files
After you generate the list of SPN and keytab file names in
CDI-PC
format, send a request to the Kerberos administrator to add the SPNs to the Kerberos principal database and create the keytab files. Enable 256-bit encryption for each user account that you use to generate the keytab files.
Use the following guidelines when you create the SPN and keytab files:
The user principal name (UPN) must be the same as the SPN.
When you create a user account for the service principal, you must set the UPN with the same name as the SPN. The application services in the
CDI-PC domain
can act as a service or a client depending on the operation. You must configure the service principal to be identifiable by the same UPN and SPN.
A user account must be associated with only one SPN. Do not set multiple SPNs for one user account.
Enable delegation in Microsoft Active Directory.
You must enable delegation for all user accounts with service principals used in the
CDI-PC domain
. In the Microsoft Active Directory Service, set the
Trust this user for delegation to any service (Kerberos only)
option for each user account that you set an SPN.
Delegated authentication happens when a user is authenticated with one service and that service uses the credentials of the authenticated user to connect to another service. Because services in the
CDI-PC domain
need to connect to other services to complete an operation, the
CDI-PC domain
requires the delegation option to be enabled in Microsoft Active Directory.
Use the ktpass utility to create the service principal keytab files.
Microsoft Active Directory supplies the ktpass utility to create keytab files.
CDI-PC
supports Kerberos authentication only on Microsoft Active Directory and has certified only keytab files that are created with ktpass.
The keytab files for a node must be available on the machine that hosts the node. By default, the keytab files are stored in the following directory:
<CDI-PC installation directory>/isp/config/keys
. During installation, you can specify a directory on the node to store the keytab files.
When you receive the keytab files from the Kerberos administrator, copy the keytab files to a directory that is accessible to the machine where you plan to install the
CDI-PC
services. When you run the
CDI-PC
installer, specify the location of the keytab files. The
CDI-PC
installer copies the keytab files to the directory for keytab files on the CDI-PC node.
ASK INFAPreview
