Can I share one SPN between two service accounts?

Question

I am running IIS and SQL Reporting Server on the same server. IIS runs as d\acct1 and SSRS is running as d\acct2.

Initially, I registered an SPN HTTP/server.d.com for both d\acct1 and d\acct2 and configured both for unconstrained kerberos delegation in Active Directory.

This configuration broke kerberos because there were duplicate SPNs for HTTP/server.d.com.

If I delete the SPN for SSRS, IIS works. If I delete the SPN for IIS, SSRS works.

Is there a way to share an SPN between two different service accounts that run on the same server such that they do not create a duplicate SPN?

Or, must I create two A records in active directory for iis.server.d.com and reports.server.d.com and use host headers to keep the two aliases straight inside each respective service?

Why do you think that you have to use host headers? They are not a must. — Igal Serban, Nov 18 '09 at 19:32
I decided to use multiple IP addresses rather than host headers. — Ryan Michela, Nov 19 '09 at 03:29

score 4 · Accepted Answer · answered Nov 19 '09 at 03:26

Research into how Kerberos delegation works shows that no, you cannot share SPNs between service accounts on the same box.

I solved the problem by provisioning a second IP address for my server and mapping IIS to one IP address and SSRS to the other.

I then created two new A records in DNS (don't use C records, they are unreliable with Kerberos delegation) to point to the services. iis.server.d.com points to the IIS IP address and ssrs.server.d.com points to the SSRS IP.

Lastly, I deleted all the SPNs for both d\acct1 and d\acct2 and reassigned the SPNs as HTTP/iis.server.d.com and HTTP/ssrs.server.d.com respectively.

Additionally, I find that editing SPNs using ADSIEdit far easier than using the setspn command line.

You actually should be using SetSPN from W2K8 or Vista - MS added the -S and -F parms to add an SPN, but only if it doesn't exist. Basically a "don't shoot myself in the foot" check before adding the SPN. — Christopher_G_Lewis, Nov 24 '09 at 05:47

Can I share one SPN between two service accounts?

1 Answers1