0

So I created a Single Web Application: rootsite.contoso.com with a Root Site Collection. I set the Authentication in the Web App to use Kerberos and then Set the SPN for the AppPool account running the Web App with HTTP/rootsite.contoso.com and HTTP/rootsite.

Checking for Kerberos via Fiddler and it works, wonderful. However, now it seams I have to Add Each Host-Named Site Collection to the same Service Account running the AppPool in order for these sites to render via Kerberos.

Is this correct? I'm concerned first that it's a maintenance issue, and second, that the list of SPN values will get out of hand.

| improve this question | |
1

Yes, you need an SPN for every hostname site collection URL. Technically, we need a SPN for all the url which leads us to get the web application.

Number of SPN depends upon number HNSC collections, tough job.

| improve this answer | |
  • So, I could conceivably overrun the hard coded 8k limit ? – Bismarck Apr 29 '16 at 20:20
  • 8K limit, which limit we are talking about? – Waqas Sarwar MVP♦ Apr 29 '16 at 20:21
  • I may be wrong in this particular area, I don't think its Token Bloat but I believe there is a limit to the multi-string value. How is MS doing this in the Cloud? – Bismarck Apr 29 '16 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.