SPN syntax and multiple tickets

Ben H bhendin at gmail.com
Wed May 14 14:39:34 EDT 2014

Right now I'm experiencing this on my windows client connected to a Windows
KDC, but have experienced it before on MIT clients - but am not seeing it
now, and not sure how to recreate it....

A Windows KDC (DC) registers many SPN records, among them:


I am currently seeing tickets on my client for both:

ldap/SERVER.domain.local/domain.local @ DOMAIN.LOCAL
ldap/SERVER.domain.local @ DOMAIN.LOCAL

I'm trying mostly to understand the syntax/terms to use in researching both
what these multi-part SPNs are for (with the "/") as well as under what
circumstances one would be chosen over the other.  I'm under the impression
that the application is going to decide what SPN to query and if that's the
case, then it is simply Microsoft choosing in some cases to use one over
the other (seems pointless and redundant) - but as I've mentioned I am 95%
sure I've seen these on my MIT clients in the past.

Can someone provide any insight into what these non-standard multi-part
SPNs are for and if they are acceptable in MITkerb?

More information about the Kerberos mailing list