Assigning SPNs using the setspn utility
The Active Directory administrator uses the setspn.exe utility to define the required DNS names in URLs as SPNs in an Active Directory account. To define SPNs in an account, the Active Directory administrator must belong to either the Domain Admins group or Enterprise Admins group or must have the Validated write to service principal name permission.
About this task
The Active Directory administrator performs the following steps:
Procedure
Results
To delete an SPN from an account, use the setspn command with the -d switch rather than the -a switch. For example, you might do this to delete an SPN from one account before assigning it to another account. Remember that an SPN can be assigned to one account only.
Determining if your Domino server is accessed through a DNS alias
About this task
Your Domino server might be accessed through an alias. In DNS, a CNAME (Canonical Name) record may define an alias. In some scenarios, the client browser may use DNS to resolve a CNAME alias to a hostname when determining the SPN for which to request a Kerberos service ticket; in this case you need an SPN defined for the resolved host name that the alias represents.
To investigate your DNS settings for aliases used by your Domino server, from a command prompt you use the nslookup command in interactive mode with debug settings (set d2). For example, to see DNS information that includes which hostname your alias www.renovations.com resolves to, enter:
C:\>nslookup
> set d2
> www.renovations.com
If the output of nslookup identifies www.renovations.com as a CNAME alias for the hostname server3.ad.east.renovations.com, you will need an SPN for HTTP/server3.ad.east.renovations.com.