Planning for SPNs - what SPNs would I need?

Question

I'm planning to set-up Kerberos in SharePoint 2013, but I'm unsure about the amount of SPNs I need. The farm I want to install is 3-tier:

• Server02: AD and KDC
• Server06: MSSQL Database Server
• Server37: SharePoint WFE
• Server38: SharePoint Application Server

Following best practice guidelines found online, I've planned for the following user accounts:

• sp_farm: for server management / application pool identity for SP CA / timer service account
• sp_admin: just for installation and spconfig
• sp_pool: for the web application pool
• sp_services: for the service application pool
• sp_crawl: crawl service
• sp_search: service account / search windows service
• sp_userprofiles: user profile sync account

I'm unsure what SPNs I need to enable Kerberos. This is my lucky guess, but I'm not sure this will work:

setspn -S http/server37 domain\sp_pool (for the web app)
setspn -S http/server37:10000 domain\sp_farm (for the CA web app)
setspn -S http/server38 domain\sp_services (for the service app pool)
setspn -S mssqlsvc/server06 domain\(sql service account here)

Is this correct? I'm having a bit of a hard time wrapping my head around the setspn process.

Answer 1

I would start by creating a service principal name for the SQL Server instance. I assume you use a default instance on the default port here:

• SQL Server Instance: servername\mssqlserver
• SQL Server service account: domain\sql

setspn -S MSSQLSvc/servername:1433 domain\sql
setspn -S MSSQLSvc/servername.fully.qualified:1433 domain\sql

Notice how it is recommended to create two SPN's: one for the netbios hostname, one for the fully qualified hostname.

Then if you just want to enable users to authenticate to SharePoint with Kerberos, you only need a service principal name for each web application they are going to access.

• Web Application: https://fully.qualified.domain
• Application pool account: domain\pool

setspn -S HTTP/fully.qualified.domain DOMAIN\pool

You need to do this for every web application. The Central Administration website is a special case, please refer to Spence Harbar's articles (1 and 2) on how to accomplish this. Good practice here is to use SSL and a custom host name for this site too:

• Central Administration Web Application: https://admin.fully.qualified
• Application pool account: domain\farm

setspn -S HTTP/admin.fully.qualified DOMAIN\farm

If you want to do advanced delegation scenario's, you might need additional SPN's created and configure delegation. For authentication however, this is not needed.

Additionally, if you are using claims based authentication (and you probably should) - then you need to configure the claims to windows token service if you want to do delegation too. The following article gives a pretty good overview of what is involved:

http://technet.microsoft.com/en-us/library/ee806870.aspx

Also, the following whitepaper (for SharePoint 2010 but still very valid) explains almost everything you need to know:

https://www.microsoft.com/en-us/download/details.aspx?id=23176