We are currently setting up a SQL 2012 environment and it will be used for storing data that will be accessed by SSRS in sharepoint integrated mode. We will be using Kerberos for authentication.

Something we would like to be able to do is use cnames for the sql server. We are using the default instance and only require one instance per server.

What I am concerned about is the known issue with kerberos, IE/.NET, and CNAMEs. I was wondering if this configuration will work so long as I ensure that SPNs are properly setup for both the CNAME and the A-Record of the SQL server?


At first I wanted badly to say no you can't do that, but on second thought, go for it.

"“You must register the Kerberos service principal names (SPNs), the host name, and the fully-qualified domain name (FQDN) for all the new DNS alias (CNAME) records. If you do not do this, a Kerberos ticket request for a DNS alias (CNAME) record may fail and return the error code KDC_ERR_S_SPRINCIPAL_UNKNOWN.”


For follow up I can confirm that the kerberos connection is established correctly. Thanks for the link as it confirms that only a CNAME is needed as long as the SPN is created for the SQL Cluster Name.


Technically, because SQL Server SPNs include an instance name (if you are using the second-named instance on the same computer), you can register the DNS host for the cluster as a CNAME alias and avoid the CNAME issue described in Appendix A, Kerberos configuration known issues (SharePoint Server 2010). However, if you choose to use CNAMEs, you have to register an SPN using the DNS (A) record host name for the CNAME aliases.



You can register an SPN for a CNAME. We do it where I work and it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.