title: Kerberos: difference between UPN and SPN
body: <p>I'm now kerberizing a cross-platform application with GSSAPI.
  While I'm not clear about the difference between UPN and SPN.</p>
  
  <p>The development environment is a Samba4 AD DC server on CentOS 6.4 with a Windows server 2008 R2 a member box in the domain, say EXAMPLE.COM (You may be curious why not use Win2008 as DC directly. And as I stated previously, the application is cross-platform, I'm now testing in this setting. The normal Win DC-Linux MEM setting works fine.).
  I create a new user <code>foobar:users</code> to run the application.
  When I use <code>foobar@EXAMPLE.COM</code>, i.e. the UPN, to authenticate the application against Kerberos, I keep receiving</p>
  
  <blockquote>
    <p>Kerberos: Principal may not act as server ERROR</p>
  </blockquote>
  
  <p>Following a <a href="https://lists.samba.org/archive/samba/2012-July/168331.html" rel="noreferrer">thread</a> on Samba maillist, I think I should create a service principal name say <code>app/dc.example.com</code> for the UPN with <code>samba-tool</code></p>
  
  <pre><code>samba-tool spn add app/dc.example.com foobar
  </code></pre>
  
  <p>This time I will receive another error</p>
  
  <blockquote>
    <p>Samba4 KDC - no such entry found in hdb</p>
  </blockquote>
  
  <p>My question is what's the difference between a UPN and SPN?
  By <code>samba-tool spn list foobar</code>, it says <code>foobar</code> <em>has</em> servicePrincipalName <code>app/dc.example.com</code>.
  How could I associate a UPN with an SPN?</p>
  
  <p>Thank you very much.</p>