Forum Discussion

Wire's avatar
Wire
Sep 03, 2013

APM - How to create a keytab file with multiple SPNs

Hi,   I have run into a problem using Kerberos Authentication when using CNAMEs in DNS.   You can search the web but basically if you use a CNAME record like "www CNAME www1" and then A records...
BIG-IP Access Policy Manager (APM)
design
kerberos
security
Wire's avatar
Wire
Sep 03, 2013

Thanks for your answer Kevin, it has prompted me to clarify the multiple SPN issue I have.

 

We are using Win2008R2.

 

I'm using APM (11.3.0 HF6) in APM+LTM mode and only performing the Authentication on APM, not passing any credentials onto the Webservers which are not IIS.

 

No GSLB exists but instead a manual DR process is required where in the event of "Site A" failing which carries the VIP "10.10.10.1" (resolving to "www1") the CNAME record for "www" will be changed to point to "www2" (the "Site B" VIP "10.10.20.1").

 

Are you saying that I should just use one keytab file on "Site A" with SPN of "HTTP/www1" and a different keytab file on "Site B" with SPN of "HTTP/www2" and ignoring the SPN of "HTTP/www" completely?

 

In the meantime I'll read the article on the link above to see how to create the keytab file that contains existing keytabs which they refer to above (as this is the problem I have).

 

Thanks.