Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I deploy a server call FOO/host.example.com@myrealm how does a client become aware that the service name is FOO?

ENV: Unix / MIT kerberos 1.4 or 1.10

I see windows has some sort of mapping: How exactly does the HOST/machine SPN work?, what about unix?

share|improve this question

1 Answer 1

Usually the client is specific for the service FOO and the SPN syntax FOO/<hostname> would be hard-coded in the client application.

You'll need to manually set up the correct SPN's for the services you're offering.

Sometimes multiple services are grouped under the same SPN, for instance it is not uncommon to see both the actual webserver, apache, responding using the HTTP/host service principal name as well as an application server like Jboss or Websphere. This can be explained that often those services are accessed by the same type of client, i.e. a web browser.

SSH and telnet for instance use HOST/<hostname> rather than a service specific SPN like SSH/<hostname>.

If you set up Dovecot and offer both POP3 as well as IMAP access you'll need two SPN's one for each service/protocol, despite that it is only a single application.

share|improve this answer
    
HBruijn - thank you - your first sentence makes perfect sense. Thanks for the additional info as well. –  jouell Mar 3 at 14:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.