When adding a new SPN into the Kerberos domain, you have the option of mapping the SPN to a user. In general, I join the domain through Integrated Windows Authentication, and this creates a new computer account for the service, but now, I would like to try using Kerberos without IWA.
I believe I have a thorough understanding of how Kerberos authenticates clients for a computer host (good enough for what I'm trying to do) - but what exactly does mapping a SPN to a domain user do?
Edit: I am not asking about how SPNs work in general. I am asking specifically about the details of mapping a SPN to a domain USER.
- Kerberos will allow that specific user to HOST this service - rather than authenticating with a computer host account, the server would be joined into the Kerberos domain under this specific user. Authentication occurs via this user.
Any further information would be greatly appreciated.