If a server's keytab file includes SPNs that do not match the server's hostname, these SPNs are not used when clients try to verify their tickets. Is this a Kerberos limitation by design?
Here's what I've done: I have a Linux HTTP server running, with the hostname testbox1. I've joined it to the testAD.com domain via Samba, and things run great when my clients have the ticket for testbox1 (so they have a ticket for HTTP/testbox1.testAD.com@TESTAD.COM).
I've now added a new SPN to testbox1, HTTP/testing.testAD.com. I generated the keytab file, moved it over to the Linux server, and appended the keytab to the existing one.
Clients are able to get the ticket "HTTP/testing.testAD.com@TESTAD.COM", but my Linux server rejects it. Upon looking at Samba's code, I found that the server will only use the SPNs from its keytab file that match a certain regex (composed of its hostname, domain, realm).
I can make the necessary code changes in the Kerberos module of my samba library to allow a new regex which does not include the hostname of the server, but would this essentially 'break' Kerberos?
My initial thought: No, because merely TRYING to decrypt a ticket based on an existing SPN is completely ok. If the ticket is indeed for a different service, the decryption will fail all the same.
Any information would be greatly appreciated.