title: Kerberos/SPNEGO : multiple SPNs for the same AD account
body: <p>Deploying the same HTTP based application on several web servers (<code>srv1</code>, <code>srv2</code>, etc). Protecting the application with SPNEGO auth. The servers are Linux and AD doesn't know of their existence, i.e. they are not joined to the domain. I've got the whole SPNEGO working smoothly on a single host. Now moving on to the subsequent hosts.</p>
  
  <p>Most guides I've found will tell you that you need</p>
  
  <ol>
  <li>An account in AD</li>
  <li>A SPN</li>
  <li>A keytab (generated on the AD server and then
  moved to the Linux host)</li>
  </ol>
  
  <p>While I believe that (2) + (3) will always need to be per-server, I'm somewhat uncertain about (1). Can I do with only one account? I would really like to not having all these accounts in AD if I can do with only one.</p>
  
  <p><a href="http://blogs.nologin.es/rickyepoderi/index.php?/archives/104-Two-Tips-about-Kerberos.html" rel="nofollow">This blog</a> has a good recipe for how it can be done: The first invocation of <code>ktpass</code> (for <code>srv1</code>) should be as described in the all the guides you find on the internet, however subsequent invocations (for <code>srv2</code>, <code>srv3</code>, etc) should be using the -setpass and -setupn options.</p>
  
  <p>However I've found that when one uses the <code>ktpass.exe</code> tool the account's <code>userPrincipalName</code> attribute changes to become as given by princ argument from the last invocation of <code>ktpass</code>. So the name of the srv, e.g. <code>srv3</code> is coded into the name and the name of the account will therefore basically change with each invocation of ktpass. When the web server performs the final step in the SPNEGO chain of events, which is to contact AD using the keytab as credentials, it will look for an account in AD with a <code>userPrincipalName</code> equal to the SPN and this step will therefore fail. (<a href="https://devcentral.f5.com/questions/apm-how-to-create-a-keytab-file-with-multiple-spns" rel="nofollow">source</a>, scroll to last post, list item 3). Contradicting this is that I'm using Tomcat and thereby JAAS and as far as I understand I can <a href="https://docs.oracle.com/javase/7/docs/jre/api/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html" rel="nofollow">hardcode the principal name to use in my <code>jaas.conf</code> file</a> thereby effectively ignoring the principal name from the keytab.</p>
  
  <p>Can multiple app servers + single account in AD ever work and if so how?</p>