Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are currently setting up a SQL 2012 environment and it will be used for storing data that will be accessed by SSRS in sharepoint integrated mode. We will be using Kerberos for authentication.

Something we would like to be able to do is use cnames for the sql server. We are using the default instance and only require one instance per server.

What I am concerned about is the known issue with kerberos, IE/.NET, and CNAMEs. I was wondering if this configuration will work so long as I ensure that SPNs are properly setup for both the CNAME and the A-Record of the SQL server?

share|improve this question

2 Answers 2

At first I wanted badly to say no you can't do that, but on second thought, go for it.

"“You must register the Kerberos service principal names (SPNs), the host name, and the fully-qualified domain name (FQDN) for all the new DNS alias (CNAME) records. If you do not do this, a Kerberos ticket request for a DNS alias (CNAME) record may fail and return the error code KDC_ERR_S_SPRINCIPAL_UNKNOWN.”

http://blogs.msdn.com/b/karang/archive/2009/12/12/why-do-we-need-spn-for-file-server-nas-ras-file-share-system-dna-alias-cname.aspx

For follow up I can confirm that the kerberos connection is established correctly. Thanks for the link as it confirms that only a CNAME is needed as long as the SPN is created for the SQL Cluster Name.

http://social.msdn.microsoft.com/Forums/en/sqldatabaseengine/thread/fa0a38ef-106a-4521-b4f3-a62c60f89a99

Technically, because SQL Server SPNs include an instance name (if you are using the second-named instance on the same computer), you can register the DNS host for the cluster as a CNAME alias and avoid the CNAME issue described in Appendix A, Kerberos configuration known issues (SharePoint Server 2010). However, if you choose to use CNAMEs, you have to register an SPN using the DNS (A) record host name for the CNAME aliases.

http://msdn.microsoft.com/en-us/library/gg502606.aspx

share|improve this answer

You can register an SPN for a CNAME. We do it where I work and it works.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.