I am working with a SharePoint 2010 set up operating in Classic mode and consisting of four servers:
- Web server
- Application server
- SQL server
- SQL reporting server
The SharePoint application pools on the web server are configured to run under domain service accounts. I would like to enable Kerberos on the system to allow it to function with some third-party web parts. What I am unsure of is how to properly set the SPNs. Specifically, my questions are as follows:
- Should SPNs for the domain service account be set for the SharePoint farm name (which is used by clients to access SharePoint) or the name of the web server? These are not the same in my implementation. Note: The third-party web part application is installed on the SharePoint web server and has its own application pool. This app pool is configured to use a different domain service account than the SharePoint app pools. I created SPNs for this account as well and pointed them to the name of the SharePoint web server.
- I understand that the DNS server needs an "A" record for the SharePoint server. Similar to my above question, is this record needed for the farm name or the web server name?
- I understand that there could be some issues with using Kerberos when SharePoint is running on non-default ports (as described here). In my setup, the SharePoint website runs on the default port 80, but if I am not mistaken, the Central Admin website runs on a port that was randomly generated by the installer. As such, is it necessary to create SPNs for the http service scheme on this port as well to allow clients to authenticate to the Central Admin page?
Thanks for your help :)