How to create WebApplication with claims based authentication using Kerberos in PowerShell in SP2013

Question

I want to create WebApplication in PowerShell (SharePoint 2013) with the recommended claims based authentication and using Kerberos (instead of default NTLM). Based on the documentation I used command that takes SPAuthenticationProvider as parameter to create claims based authentication and specify also authentication method to be Kerberos:

$ap = New-SPAuthenticationProvider
New-SPWebApplication -Name "qwe1" -Host "qwe1" -Url "http://qwe1.blah.int" -Port 80 -ApplicationPoolAccount (Get-SPManagedAccount "DOMAIN\account") -ApplicationPool "qwe1" -AuthenticationProvider $ap -AuthenticationMethod "Kerberos"

The behavior is a bit strange - first, it issues warning: WARNING: The Windows Classic authentication method is deprecated .. but creates WebApplication with claims based authentication. Second, the authentication method is NTLM, not Kerberos. Feels like Alice in Wonderland..

Answer 1

OK, found it. The two parameters -AuthenticationProvider and -AuthenticationMethod are from different worlds, not to be used together. The first one works with claims based auth while the second one with Classic Windows auth.

To achieve my goal I need to use these commands:

$auth = New-SPAuthenticationProvider -DisableKerberos:$false
New-SPWebApplication -Name "t3" -Host "t3" -Url "http://t3.blah.int" -Port 80 -ApplicationPoolAccount (Get-SPManagedAccount "DOMAIN\account") -ApplicationPool "t3" -AuthenticationProvider $auth

For reference I'm adding also commands for changing existing WebApplication with claims based authentication from NTLM to Kerberos:

$auth = New-SPAuthenticationProvider -DisableKerberos:$false
Set-SPWebApplication t3 -Zone Default -AuthenticationProvider $auth

Hope it saves you some time..