a·gen·tic a·gil·i·ty

Kerberos and SharePoint 2007

TL;DR; Explains how to configure Kerberos authentication for SharePoint 2007 by setting Service Principal Names (SPNs) in Active Directory for each DNS and port combination.

Published on
2 minute read
Image
https://nkdagility.com/resources/REHiKbbVOD8
Subscribe

If you want to use Kerberos authentication and not NTLM with SharePoint then there are some extra tasks that you need to get someone with Domain Admin privileges to perform. For EVERY dns / port combination a SPN needs to be added to Active Directory to tell it that it  is allowed to use Kerberos to authenticate a specific account or server to that URL. In a production environment with a farm of multiple server you will need to use the account option.

The account option lets you create an Active Directory account called..say… svc_Sharepoint and add a bunch of SPN’s to it. This account then needs to be used to run the application you are trying to connect to. So if it is an IIS website then the AppPool needs to run under that account. if it is SQL Server then the services need to run under that account.

You need to add an SPN for each protocol URL and port combination:

setspn -a admin.ep-dev.[domain].biz [domain]svc_sharepoint
setspn -a admin.ep-dev.[domain].biz:8080 [domain]svc_sharepoint
setspn -a bi.ep-dev.[domain].biz [domain]svc_sharepoint
setspn -a nrcdashboard.ep-dev.[domain].biz [domain]svc_sharepoint
setspn -a ep-dev.[domain].biz     [domain]svc_sharepoint
setspn -a team.ep-dev.[domain].biz [domain]svc_sharepoint
setspn -a search.ep-dev.[domain].biz [domain]svc_sharepoint
setspn -a my.ep-dev.[domain].biz [domain]svc_sharepoint
setspn -a technet.ep-dev.[domain].biz [domain]svc_sharepoint
setspn -a tfs01.ep-dev.[domain].biz [domain]svc_tfsservices
setspn -a tfs01.ep-dev.[domain].biz:8080 [domain]svc_tfsservices
setspn -a TFS .ep-dev.[domain].biz [domain]svc_tfsservices

These SPN’s will allow authentication to work on these domains, but it does require Domain Admin to run them. And these are only my initial FQDN for this environment. We will be having a production environment soon and most likely a UAT environment before we start any development work on our Enterprise Portal.

Technorati Tags: SP 2007   MOSS   SP 2010   TFS   SharePoint

Smart Classifications

Each classification [Concepts, Categories, & Tags] was assigned using AI-powered semantic analysis and scored across relevance, depth, and alignment. Final decisions? Still human. Always traceable. Hover to see how it applies.

Subscribe

Connect with Martin Hinshelwood

If you've made it this far, it's worth connecting with our principal consultant and coach, Martin Hinshelwood, for a 30-minute 'ask me anything' call.

Our Happy Clients​

We partner with businesses across diverse industries, including finance, insurance, healthcare, pharmaceuticals, technology, engineering, transportation, hospitality, entertainment, legal, government, and military sectors.​

Lean SA Logo

Lean SA

New Signature Logo

New Signature

Flowmaster (a Mentor Graphics Company) Logo

Flowmaster (a Mentor Graphics Company)

Kongsberg Maritime Logo

Kongsberg Maritime

Slaughter and May Logo

Slaughter and May

Lockheed Martin Logo

Lockheed Martin

Ericson Logo

Ericson

Alignment Healthcare Logo

Alignment Healthcare

Graham & Brown Logo

Graham & Brown

Philips Logo

Philips

SuperControl Logo

SuperControl

Xceptor - Process and Data Automation Logo

Xceptor - Process and Data Automation

Bistech Logo

Bistech

Brandes Investment Partners L.P. Logo

Brandes Investment Partners L.P.

Slicedbread Logo

Slicedbread

Milliman Logo

Milliman

Akaditi Logo

Akaditi

Hubtel Ghana Logo

Hubtel Ghana

Nottingham County Council Logo

Nottingham County Council

Washington Department of Transport Logo

Washington Department of Transport

Washington Department of Enterprise Services Logo

Washington Department of Enterprise Services

Ghana Police Service Logo

Ghana Police Service

Department of Work and Pensions (UK) Logo

Department of Work and Pensions (UK)

Royal Air Force Logo

Royal Air Force

Boeing Logo

Boeing

Genus Breeding Ltd Logo

Genus Breeding Ltd

Workday Logo

Workday

Graham & Brown Logo

Graham & Brown

SuperControl Logo

SuperControl

Teleplan Logo

Teleplan