Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to move the web layer of our app onto Apache on Centos and use mod_auth_kerb to authenticate AD users and automatically log them in the app. I have successfully joined the domain, and can successfully issue kerberos tickets for AD users.

The problem I have is that the backend app service is running as a local user on a windows server and not as an AD user, so I am not sure how to make the correct keytab to import into apache.

My thought was to create an identical user in the AD, and then add the SPN for HTTP to that user and export the keytab using ktpass. The problem is, that the AD administrators want to avoid creating a new user, as they need to obtain approvals etc...

So, is there a way to make this work without making a new user in the AD?

share|improve this question
up vote 0 down vote accepted

You don't need to create a new AD user; just add the new service principal with setspn.exe to any existing account, and create the corresponding keytab to give to Apache. It doesn't matter which account, since no Windows service will need access to the keys; all you need is for the principal to be added to the AD Kerberos database so that the domain controllers will issue tickets for it. That AD account will have access to the service keys and could impersonate the app to users and vice versa, so the account security matters in that regard.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.