I'm planning to set-up Kerberos in SharePoint 2013, but I'm unsure about the amount of SPNs I need. The farm I want to install is 3-tier:
- Server02: AD and KDC
- Server06: MSSQL Database Server
- Server37: SharePoint WFE
- Server38: SharePoint Application Server
Following best practice guidelines found online, I've planned for the following user accounts:
- sp_farm: for server management / application pool identity for SP CA / timer service account
- sp_admin: just for installation and spconfig
- sp_pool: for the web application pool
- sp_services: for the service application pool
- sp_crawl: crawl service
- sp_search: service account / search windows service
- sp_userprofiles: user profile sync account
I'm unsure what SPNs I need to enable Kerberos. This is my lucky guess, but I'm not sure this will work:
setspn -S http/server37 domain\sp_pool (for the web app)
setspn -S http/server37:10000 domain\sp_farm (for the CA web app)
setspn -S http/server38 domain\sp_services (for the service app pool)
setspn -S mssqlsvc/server06 domain\(sql service account here)
Is this correct? I'm having a bit of a hard time wrapping my head around the setspn process.