1

I am working with a SharePoint 2010 set up operating in Classic mode and consisting of four servers:

  1. Web server
  2. Application server
  3. SQL server
  4. SQL reporting server

The SharePoint application pools on the web server are configured to run under domain service accounts. I would like to enable Kerberos on the system to allow it to function with some third-party web parts. What I am unsure of is how to properly set the SPNs. Specifically, my questions are as follows:

  1. Should SPNs for the domain service account be set for the SharePoint farm name (which is used by clients to access SharePoint) or the name of the web server? These are not the same in my implementation. Note: The third-party web part application is installed on the SharePoint web server and has its own application pool. This app pool is configured to use a different domain service account than the SharePoint app pools. I created SPNs for this account as well and pointed them to the name of the SharePoint web server.
  2. I understand that the DNS server needs an "A" record for the SharePoint server. Similar to my above question, is this record needed for the farm name or the web server name?
  3. I understand that there could be some issues with using Kerberos when SharePoint is running on non-default ports (as described here). In my setup, the SharePoint website runs on the default port 80, but if I am not mistaken, the Central Admin website runs on a port that was randomly generated by the installer. As such, is it necessary to create SPNs for the http service scheme on this port as well to allow clients to authenticate to the Central Admin page?

Thanks for your help :)

Improve this question

1 Answer 1

Reset to default
0

You need to create the SPN for the AppPool account( which domains Service accounts).

If your web app configured on port 80 then you need to create the SPN for short Name and DNS name. i.e

Web Application (default zone)    IIS App Pool Identity   
http://portal                       vmlab\svcPortal10App

In this case you should have the SPN like this(one for short name(server name) and one for FQDN).

  • HTTP/portal
  • HTTP/portal.vmlab.local

Now if you have the Web app on non-default port.

 Web Application (default zone)    IIS App Pool Identity   
    http://teams:5555              vmlab\ svcTeams10App

Now SPN should be like this:

  • HTTP/Teams
  • HTTP/Teams.vmlab.local
  • HTTP/Teams:5555
  • HTTP/Teams.vmlab.local:5555

For compete understanding please read this white paper.

In that case you have to create SPN for both...WE had same structure....our web server name is mwf01 and web app url is http://sp.wscheema.com, also on non default port and we created SPN for all.

Improve this answer
16
  • Thanks for your response. I had reviewed that white paper, but did not see mention in it of the specific scenario where the web server and farm hostnames differ. Could you clarify how to handle the SPN setting for this specific scenario, in line with my three questions?
    – skyfx
    Commented May 28, 2015 at 17:04
  • Could you please explain what u mean by farm name and Web server name?
    – Waqas Sarwar MVP ♦
    Commented May 28, 2015 at 17:05
  • The "farm" is not a physical server. It is merely a hostname used by clients to access SharePoint. In implementations with multiple web servers, it is my understanding that this allows for load balancing across the web servers. This is a moot point in my implementation, since there is only one web server, but there are still two different host names for the farm and web server.
    – skyfx
    Commented May 28, 2015 at 17:22
  • let me ask this way....you can access the sharepoint using somename.com but you web server name is spweb01, is this correct? what port you use for the web application....if possible share the AAM settings(may be fake the url)
    – Waqas Sarwar MVP ♦
    Commented May 28, 2015 at 17:24
  • That's correct. The web application using the default port 80. Could you clarify what you mean by AAM settings?
    – skyfx
    Commented May 28, 2015 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.