Generate the Service Principal Name (SPN) and Keytab File

To set up the SPN and generate the keytab file, perform the following steps:

  1. Log into the active directory that uses the Kerberos Key Distribution Center (KDC).
  2. Find the user account and check the Password never expires and This account supports checkboxes. 

  1. Open Windows Command prompt and run the following command to generate a keytab for the user account.

ktpass -princ HTTP/[FQDN_LOWERCASE]@[DOMAIN_UPPERCASE] -mapuser [USERNAME] @ [DOMAIN_NAME] -pass [PASSWORD] -ptype KRB5_NT_PRINCIPAL -kvno 0 -crypto AES256-SHA1 -out [OUTPUT-FILENAME].keytab

Note: Execute this command in the Active Directory server

FQDN is the RiskVision Web Server Hostname

  1. After the keytab file is generated, open Windows Command Prompt, and run the following command to verify whether the SPN is registered for the hostname that a user will need for logging into RiskVision.

setspn -l <username>

  1. Copy the keytab file to a directory in the RiskVision Application Server to enable the Kerberos Authentication.

Related Articles

New Articles