ldap/ with kerberos through F5

Hi,

 

We have an F5 BigIP load balanced address fronting a few Domain

 

Controllers in our AD (e.g. adldap.domain.com). We have OpenLDAP clients

 

using this Virtual address to do lookups on AD and we wish to have the

 

clients authenticate using Kerberos instead of a normal LDAPS bind. We're

 

having trouble understanding how or where we create SPN's to allow the Domain

 

Controllers to accept service tickets for this virtual address. Normally in a

 

situation like this you set the SPN on the user account that runs the service. The

 

LDAP service runs on the Domain Controllers computer account which leads me

 

to believe we need an SPN set on the DC computer objects. However, you can

 

only have 1 SPN per forest.

 

 

If we do the following then we can have separate SPN's per DC.

 

 

setspn -A ldap//adldap.domain.com

 

 

However, when the client asks for a Service Ticket, which SPN would he get? When he goes back to the F5 to present his ticket he would be forwarded to a random DC and may not have the ticket. Or is he given a Service Ticket for all DC's that provide that service?