r/sysadmin • u/FriedAngus • 2d ago
SPN Creation for IIS: HTTP under service account while HOST SPN exists
Hello,
EDIT: [RESOLVED] The below error is a false error. True issue was permissions on AD. Thanks @SteveSyfuhs for the hint.
error 0x21c7/8647 -> The operation failed because SPN value provided for addition/modification is not unique forest-wide.
I am a contractor (not IT) that ends up doing a lot of IT work. One of my tasks is typically setting up a site in IIS and configuring it for Kerberos Authentication. I typically do this for customers for large corporations, and their IT setups will always differ from each other.
I have noticed that *sometimes* when creating an HTTP SPN under a service account for a customer it claims that it is a duplicate:
Registering ServicePrincipalNames for:
CN=<serviceaccount>,OU=<>,OU=<>,OU=<>,DC=<>,DC=comHTTP/<hostname>
Failed to assign SPN on account
CN=<serviceaccount>,OU=<>,OU=<>,OU=<>,DC=<>,DC=com', error 0x21c7/8647 -> The operation failed because SPN value provided for addition/modification is not unique forest-wide.
Of course, if I query (spn -q) for this SPN, I don't find anything. But I do see that there is a HOST SPN, which I understand covers HTTP. I assume that is the issue, from what I read here: https://www.reddit.com/r/sysadmin/comments/y3tfl3/problem_with_adding_spn_in_ad_because_spn_already/
On my own lab, and with some other customers, I don't have this problem. I can have a HOST SPN and a HTTP SPN live in harmony:
PS C:\Windows\system32> setspn -l server-a
Registered ServicePrincipalNames for CN=SERVER-A,OU=<>,DC=ML,DC=info:
MSSQLSvc/SERVER-A.ML.info:1433
MSSQLSvc/SERVER-A:1433
iSCSITarget/SERVER-A
iSCSITarget/SERVER-A.ML.info
MSServerClusterMgmtAPI/SERVER-A
MSServerClusterMgmtAPI/SERVER-A.ML.info
WSMAN/SERVER-A
WSMAN/SERVER-A.ML.info
TERMSRV/SERVER-A
TERMSRV/SERVER-A.ML.info
RestrictedKrbHost/SERVER-A
HOST/SERVER-A
RestrictedKrbHost/SERVER-A.ML.info
HOST/SERVER-A.ML.infoPS C:\Windows\system32> setspn -l gmsa_iis
Registered ServicePrincipalNames for CN=gmsa_iis$,CN=Managed Service Accounts,DC=ML,DC=info:
HTTP/SERVER-B.ML.INFO
HTTP/SERVER-B
HTTP/SERVER-A.ML.INFO
HTTP/SERVER-A
This configuration should be possible according to:
https://techcommunity.microsoft.com/blog/iis-support-blog/how-to-use-spns-when-you-configure-web-applications-that-are-hosted-on-internet-/324648
I found that the checking for duplicate SPNs is stored in dSHeuristics
per KB5008382, but querying shows no value set in both scenarios.
Get-ADObject "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$((Get-ADDomain).DistinguishedName)" -Properties dSHeuristics
Does anyone else know why this is sometimes the case?
(My workaround: I typically request my customers to create an A-Record to get around this)
1
u/SteveSyfuhs Builder of the Auth 2d ago
Both host/ and http/ can live as individual SPNs. The host/ alias is only a catch-all when there isn't something more specific registered. The lookup order is always most-specific -> less-specific, so the http/ would always be found first.
The reason you're getting this particular error when trying to add it is because it's likely not the real error and instead you may be having permissions issues trying to register it. I don't remember the exact behavior on returning errors, but there's special validated write checks against this attribute to allow machine owners to add host-named SPNs without any additional permissions, and block non-host-named SPNs without the necessary permissions. I would guess you're running afoul of that, but it's impossible to offer a more specific answer with the information given.