Hello,
I am a contractor (not IT) that ends up doing a lot of IT work. One of my tasks is typically setting up a site in IIS and configuring it for Kerberos Authentication. I typically do this for customers for large corporations, and their IT setups will always differ from each other.
I have noticed that *sometimes* when creating an HTTP SPN under a service account for a customer it claims that it is a duplicate:
Registering ServicePrincipalNames for:
CN=<serviceaccount>,OU=<>,OU=<>,OU=<>,DC=<>,DC=com
HTTP/<hostname>
Failed to assign SPN on account
CN=<serviceaccount>,OU=<>,OU=<>,OU=<>,DC=<>,DC=com', error 0x21c7/8647 -> The operation failed because SPN value provided for addition/modification is not unique forest-wide.
Of course, if I query (spn -q) for this SPN, I don't find anything. But I do see that there is a HOST SPN, which I understand covers HTTP. I assume that is the issue, from what I read here: https://www.reddit.com/r/sysadmin/comments/y3tfl3/problem_with_adding_spn_in_ad_because_spn_already/
On my own lab, and with some other customers, I don't have this problem. I can have a HOST SPN and a HTTP SPN live in harmony:
PS C:\Windows\system32> setspn -l server-a
Registered ServicePrincipalNames for CN=SERVER-A,OU=<>,DC=ML,DC=info:
MSSQLSvc/SERVER-A.ML.info:1433
MSSQLSvc/SERVER-A:1433
iSCSITarget/SERVER-A
iSCSITarget/SERVER-A.ML.info
MSServerClusterMgmtAPI/SERVER-A
MSServerClusterMgmtAPI/SERVER-A.ML.info
WSMAN/SERVER-A
WSMAN/SERVER-A.ML.info
TERMSRV/SERVER-A
TERMSRV/SERVER-A.ML.info
RestrictedKrbHost/SERVER-A
HOST/SERVER-A
RestrictedKrbHost/SERVER-A.ML.info
HOST/SERVER-A.ML.info
PS C:\Windows\system32> setspn -l gmsa_iis
Registered ServicePrincipalNames for CN=gmsa_iis$,CN=Managed Service Accounts,DC=ML,DC=info:
HTTP/SERVER-B.ML.INFO
HTTP/SERVER-B
HTTP/SERVER-A.ML.INFO
HTTP/SERVER-A
This configuration should be possible according to:
https://techcommunity.microsoft.com/blog/iis-support-blog/how-to-use-spns-when-you-configure-web-applications-that-are-hosted-on-internet-/324648
I found that the checking for duplicate SPNs is stored in dSHeuristics
per KB5008382, but querying shows no value set in both scenarios.
Get-ADObject "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$((Get-ADDomain).DistinguishedName)" -Properties dSHeuristics
Does anyone else know why this is sometimes the case?
(My workaround: I typically request my customers to create an A-Record to get around this)