在TC服务器上设置kerberos的问题

Question

tc server on red hat linux I have been trying to follow this example: http://tomcat.apache.org/tomcat-7.0-doc/windows-auth-howto.html AD service account setup setspn and ktpass commands executed to create spn and keytab

If I use the mapuser option with the ktpass command and allow the userprincipalname to be changed it will work for that one spn. I cannot get it configured to be able to use multiple spns for one AD service ID. AD account is setup for delegation.

jaas.conf snipit

com.sun.security.jgss.krb5.initiate {
        com.sun.security.auth.module.Krb5LoginModule required
        useTicketCache=false
        useKeyTab=true
        keyTab="<path>/test5a.keytab"
        principal="<fqdn>"
        storeKey=true
        doNotPrompt=true;
};

com.sun.security.jgss.krb5.accept {
        com.sun.security.auth.module.Krb5LoginModule required
        useTicketCache=false
        useKeyTab=true
        keyTab="<path>/test5a.keytab"
        principal="HTTP/<fqdn>"
        storeKey=true
        doNotPrompt=true;
};

If I change the upn to anything but the spn I am working with it fails with either could not find user in kerberos database. What am I missing to be able to use one AD service account for multiple spns?

Answer 1

SPN也链接到密钥表，因此您需要为每个SPN生成一个新的密钥表文件。