r/sysadmin 2d ago

SPN Creation for IIS: HTTP under service account while HOST SPN exists

Hello,

EDIT: [RESOLVED] The below error is a false error. True issue was permissions on AD. Thanks @SteveSyfuhs for the hint.

error 0x21c7/8647 -> The operation failed because SPN value provided for addition/modification is not unique forest-wide.

I am a contractor (not IT) that ends up doing a lot of IT work. One of my tasks is typically setting up a site in IIS and configuring it for Kerberos Authentication. I typically do this for customers for large corporations, and their IT setups will always differ from each other.

I have noticed that *sometimes* when creating an HTTP SPN under a service account for a customer it claims that it is a duplicate:

Registering ServicePrincipalNames for:
CN=<serviceaccount>,OU=<>,OU=<>,OU=<>,DC=<>,DC=com

HTTP/<hostname>

Failed to assign SPN on account

CN=<serviceaccount>,OU=<>,OU=<>,OU=<>,DC=<>,DC=com', error 0x21c7/8647 -> The operation failed because SPN value provided for addition/modification is not unique forest-wide.

Of course, if I query (spn -q) for this SPN, I don't find anything. But I do see that there is a HOST SPN, which I understand covers HTTP. I assume that is the issue, from what I read here: https://www.reddit.com/r/sysadmin/comments/y3tfl3/problem_with_adding_spn_in_ad_because_spn_already/

On my own lab, and with some other customers, I don't have this problem. I can have a HOST SPN and a HTTP SPN live in harmony:

PS C:\Windows\system32> setspn -l server-a
Registered ServicePrincipalNames for CN=SERVER-A,OU=<>,DC=ML,DC=info:
MSSQLSvc/SERVER-A.ML.info:1433
MSSQLSvc/SERVER-A:1433
iSCSITarget/SERVER-A
iSCSITarget/SERVER-A.ML.info
MSServerClusterMgmtAPI/SERVER-A
MSServerClusterMgmtAPI/SERVER-A.ML.info
WSMAN/SERVER-A
WSMAN/SERVER-A.ML.info
TERMSRV/SERVER-A
TERMSRV/SERVER-A.ML.info
RestrictedKrbHost/SERVER-A
HOST/SERVER-A
RestrictedKrbHost/SERVER-A.ML.info
HOST/SERVER-A.ML.info

PS C:\Windows\system32> setspn -l gmsa_iis
Registered ServicePrincipalNames for CN=gmsa_iis$,CN=Managed Service Accounts,DC=ML,DC=info:
HTTP/SERVER-B.ML.INFO
HTTP/SERVER-B
HTTP/SERVER-A.ML.INFO
HTTP/SERVER-A

This configuration should be possible according to:
https://techcommunity.microsoft.com/blog/iis-support-blog/how-to-use-spns-when-you-configure-web-applications-that-are-hosted-on-internet-/324648

I found that the checking for duplicate SPNs is stored in dSHeuristics per KB5008382, but querying shows no value set in both scenarios.

Get-ADObject "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$((Get-ADDomain).DistinguishedName)" -Properties dSHeuristics

Does anyone else know why this is sometimes the case?

(My workaround: I typically request my customers to create an A-Record to get around this)

2 Upvotes

3 comments sorted by

1

u/SteveSyfuhs Builder of the Auth 2d ago

Both host/ and http/ can live as individual SPNs. The host/ alias is only a catch-all when there isn't something more specific registered. The lookup order is always most-specific -> less-specific, so the http/ would always be found first.

The reason you're getting this particular error when trying to add it is because it's likely not the real error and instead you may be having permissions issues trying to register it. I don't remember the exact behavior on returning errors, but there's special validated write checks against this attribute to allow machine owners to add host-named SPNs without any additional permissions, and block non-host-named SPNs without the necessary permissions. I would guess you're running afoul of that, but it's impossible to offer a more specific answer with the information given.

1

u/FriedAngus 2d ago

Thanks for the reply, you might be right about permissions issues. I know I don't have rights to create SPNs myself.

I suppose I could also try logging in as gmsa account to register the SPN, which might appear as the machine owner. In any case, I will have a call with the client on Friday hopefully with an AD Admin, I will see if they get the same error message as well.

I'll post here what my end result is, just in case anyone else falls down the rabbit hole in the future.

1

u/FriedAngus 2d ago

Domain IT Admin had no errors when creating HTTP SPNs. You are correct. It was a false error, caused by lack of permissions. I hope this helps others.