4

I am running IIS and SQL Reporting Server on the same server. IIS runs as d\acct1 and SSRS is running as d\acct2.

Initially, I registered an SPN HTTP/server.d.com for both d\acct1 and d\acct2 and configured both for unconstrained kerberos delegation in Active Directory.

This configuration broke kerberos because there were duplicate SPNs for HTTP/server.d.com.

If I delete the SPN for SSRS, IIS works. If I delete the SPN for IIS, SSRS works.

Is there a way to share an SPN between two different service accounts that run on the same server such that they do not create a duplicate SPN?

Or, must I create two A records in active directory for iis.server.d.com and reports.server.d.com and use host headers to keep the two aliases straight inside each respective service?

2
  • Why do you think that you have to use host headers? They are not a must. Nov 18, 2009 at 19:32
  • I decided to use multiple IP addresses rather than host headers. Nov 19, 2009 at 3:29

1 Answer 1

4

Research into how Kerberos delegation works shows that no, you cannot share SPNs between service accounts on the same box.

I solved the problem by provisioning a second IP address for my server and mapping IIS to one IP address and SSRS to the other.

I then created two new A records in DNS (don't use C records, they are unreliable with Kerberos delegation) to point to the services. iis.server.d.com points to the IIS IP address and ssrs.server.d.com points to the SSRS IP.

Lastly, I deleted all the SPNs for both d\acct1 and d\acct2 and reassigned the SPNs as HTTP/iis.server.d.com and HTTP/ssrs.server.d.com respectively.

Additionally, I find that editing SPNs using ADSIEdit far easier than using the setspn command line.

2
  • 1
    You actually should be using SetSPN from W2K8 or Vista - MS added the -S and -F parms to add an SPN, but only if it doesn't exist. Basically a "don't shoot myself in the foot" check before adding the SPN. Nov 24, 2009 at 5:47
  • That is great info. I'll have to look into that. Nov 24, 2009 at 21:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .