Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running IIS and SQL Reporting Server on the same server. IIS runs as d\acct1 and SSRS is running as d\acct2.

Initially, I registered an SPN HTTP/ for both d\acct1 and d\acct2 and configured both for unconstrained kerberos delegation in Active Directory.

This configuration broke kerberos because there were duplicate SPNs for HTTP/

If I delete the SPN for SSRS, IIS works. If I delete the SPN for IIS, SSRS works.

Is there a way to share an SPN between two different service accounts that run on the same server such that they do not create a duplicate SPN?

Or, must I create two A records in active directory for and and use host headers to keep the two aliases straight inside each respective service?

share|improve this question
Why do you think that you have to use host headers? They are not a must. – Igal Serban Nov 18 '09 at 19:32
I decided to use multiple IP addresses rather than host headers. – Ryan Michela Nov 19 '09 at 3:29
up vote 2 down vote accepted

Research into how Kerberos delegation works shows that no, you cannot share SPNs between service accounts on the same box.

I solved the problem by provisioning a second IP address for my server and mapping IIS to one IP address and SSRS to the other.

I then created two new A records in DNS (don't use C records, they are unreliable with Kerberos delegation) to point to the services. points to the IIS IP address and points to the SSRS IP.

Lastly, I deleted all the SPNs for both d\acct1 and d\acct2 and reassigned the SPNs as HTTP/ and HTTP/ respectively.

Additionally, I find that editing SPNs using ADSIEdit far easier than using the setspn command line.

share|improve this answer
You actually should be using SetSPN from W2K8 or Vista - MS added the -S and -F parms to add an SPN, but only if it doesn't exist. Basically a "don't shoot myself in the foot" check before adding the SPN. – Christopher_G_Lewis Nov 24 '09 at 5:47
That is great info. I'll have to look into that. – Ryan Michela Nov 24 '09 at 21:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.