Re: format of service principal name (SPN)

ADSIEDIT should be allowing it, I can't speak to DsWriteAccountSpn.

I justed used my own admod (simple LDAP mod tool) to set an SPN with spaces in both the service name and service class.


G:\TEMP>adfind -default -f name=someuser serviceprincipalname

AdFind V01.31.00cpp Joe Richards (joe@xxxxxxxxxxx) March 2006

Using server: 2k3dc01.joe.com:389
Directory: Windows Server 2003
Base DN: DC=joe,DC=com

dn:CN=someuser,OU=TestOU,DC=joe,DC=com
>servicePrincipalName: this is a test/test@xxxxxxxxxxxxxx/this is a test2


1 Objects returned



The directory uses DsCrackSpn to check the SPN prior to setting it, if it doesn't pass the DsCrackSpn check (i.e. status!=ERROR_SUCCESS) it will not allow the change.




--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm



johnny wrote:
The application registers the spn by calling DsGetSpn followed by DsWriteAccountSpn. We have also tried setting it with ADSI edit.

Shakti
"Joe Richards [MVP]" <humorexpress@xxxxxxxxxxx> wrote in message news:e$Z5z7saGHA.4416@xxxxxxxxxxxxxxxxxxxxxxx
How exactly are you trying to set them.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm



Johnny wrote:
Thanks for the response. Yes this is in reference to Kerberos entities. The SPN allows
us to use the syntax I mentioned but for some reason it does not work with spaces in the servicename part (which accroding to docmumentation can be the distinguished name or ldap name of the service). Delegation of impersonated credentials to a remote server fails because the remote server receives the "anonymous logon" credential.

Thanks for any help

Shakti
"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message news:%23anIGyNaGHA.3740@xxxxxxxxxxxxxxxxxxxxxxx
SPNs are Kerberos entities and they make use the the Kerberos
canonical name. The distinguished names you mention sound like
Ldap names.

"Johnny" <prem14@xxxxxxx> wrote in message news:%23uSzc4GaGHA.1204@xxxxxxxxxxxxxxxxxxxxxxx
Hello,

We need to set up the service principal name for a service in this format

<class>/<host:port>/<service name>

we provide the distinguished name of the service in question. However we found that this cannot have spaces in them. Surely distinguished names of objects can have spaces in them. Can you suggest a solution to this. If we use object guid what format do we enter that?

Thanks
Shakti


.

Relevant Pages

  • RE: DC migrated from NT4 to 2003: cannot LDAP top level search dc=
    ... Unified Messaging ... As far as I know within the tool LDAP V2 is used, ... > more about the error you mentioned in an upgraded Windows Server 2003 ... > the flash installed Windows Server 2003 system, it should be no problem to ...
    (microsoft.public.windows.server.migration)
  • Re: Create User who can only query LDAP
    ... There is no way of creating a such user account, How ever Anonymous LDAP ... operations to Active Directory are disabled on Windows Server 2003 domain ...
    (microsoft.public.windows.server.active_directory)
  • LDAP Error - 1216
    ... Windows 2008 server and the 2003 are domain controllers and the second ... article on "How to enable LDAP signing in Windows Server 2008" but I am ... these are the only LDAP errors being logged. ...
    (microsoft.public.windows.server.active_directory)
  • Re: mail validation for multiple active directory domains [ldap_routing]
    ... acting as a mail hub and a windows server 2003 running exchange. ... Using the available howtosI have already configured sendmail to ... server as the default ldap configuration is ...
    (comp.mail.sendmail)
  • Re: error event id 11
    ... Download ADFIND: ... That will list all objects with that SPN. ... Microsoft MVP - Windows Server - Directory Services ...
    (microsoft.public.windows.server.active_directory)