SPN syntax and multiple tickets

Ben H bhendin at gmail.com
Wed May 14 14:39:34 EDT 2014


Right now I'm experiencing this on my windows client connected to a Windows
KDC, but have experienced it before on MIT clients - but am not seeing it
now, and not sure how to recreate it....

A Windows KDC (DC) registers many SPN records, among them:

        ldap/SERVER/DOMAIN
        ldap/{GUID}._msdcs.domain.local
        ldap/SERVER.domain.local/DOMAIN
        ldap/SERVER
        ldap/SERVER.domain.local
        ldap/SERVER.domain.local/domain.local

I am currently seeing tickets on my client for both:

ldap/SERVER.domain.local/domain.local @ DOMAIN.LOCAL
and
ldap/SERVER.domain.local @ DOMAIN.LOCAL

I'm trying mostly to understand the syntax/terms to use in researching both
what these multi-part SPNs are for (with the "/") as well as under what
circumstances one would be chosen over the other.  I'm under the impression
that the application is going to decide what SPN to query and if that's the
case, then it is simply Microsoft choosing in some cases to use one over
the other (seems pointless and redundant) - but as I've mentioned I am 95%
sure I've seen these on my MIT clients in the past.

Can someone provide any insight into what these non-standard multi-part
SPNs are for and if they are acceptable in MITkerb?


More information about the Kerberos mailing list