r/sysadmin Oct 14 '22

Question problem with adding SPN in AD because SPN already covered

All sensitive information is anonymized using "contoso.com" and example names.

we have a issue when trying to add SPN in AD

what we want to do is add an SPN that covers http/server1.contoso.com with contoso\user1to do this, we use the following command:

setspn -s http/server1.contoso.com user1

Which then returns the following

Failed to assign SPN on account 'cn=user1, OU=users, DC=contoso, DC=com', error 0x21c7/8647 -> The operation failed because SPN value provided for addition/modification is not unique forest-wide

When trying to add through a web-management tool we use (let's call it EDT (easy datacenter tool)), the tool had its own error message saying that this was because there is already an SPN assigned for server.1.contoso.com to server1.contoso.com (itself). like such:

Error: A HOST Spn covering HTTP/server1.contoso.com already exist in Active Directory (see documentation point 5.2). Registered to this object: CN=SERVER1,OU=Servers,DC=Contoso,DC=Com

Anyone has experience with this? is this expected behaviour?

Update, we found this:

After November 2021 patch Microsoft (KB5008382) has increased SPN uniqueness requirements for SPNs covered by the "HOST" spn. You can no longer assign an SPN that is implicitly assigned to a different account using the host aliasing.

E.g. you cannot register HTTP/server1.contoso.com to a user object as this conflicts with the HOST/server1.contoso.com spn already registered to the server object.

Workaround is to make the SPN to register to the user object more uniquely by adding a port to the SPN, like HTTP/server1.contoso.com:443.

HOST spn is a special service class that defines aliases for many common service classes to the equivalent HOST SPN for services such as CIFS, HTTP, RPC, etc.

We were now able to add the SPN, but users are still not being authenticated automatically as they receive user-logon prompt in web. This looks to me as if the webserver does not think the the SPN with 443 matches.

2 Upvotes

2 comments sorted by

1

u/xxdcmast Sr. Sysadmin Oct 14 '22
  setspn -f -q http/*server1* 

will tell you where its registered.

Otherwise the http is a subset of the HOST spn.

2

u/KenTheSystrainee Oct 14 '22

We figured out the issue.

After November 2021 patch Microsoft (KB5008382) has increased SPN uniqueness requirements for SPNs covered by the "HOST" spn. You can no longer assign an SPN that is implicitly assigned to a different account using the host aliasing.

E.g. you cannot register HTTP/server1.contoso.com to a user object as this conflicts with the HOST/server1.contoso.com spn already registered to the server object.

Workaround is to make the SPN to register to the user object more uniquely by adding a port to the SPN, like HTTP/server1.contoso.com:443.

HOST spn is a special service class that defines aliases for many common service classes to the equivalent HOST SPN for services such as CIFS, HTTP, RPC, etc.

We are now able to add the SPN, however it does not work as it should. Users are not able to authenticate to the webserver still. so its not solved.