Markus Moeller wrote: > John, > > That is correct. msktutil updates the key of the computer account. So the > second msktutil call with the same computer-name will make the first entry > invalid. But you can have host and http asssigned to the same AD account if > you use other tools like net ads join with net ads keytab.
You can also use the msktutil feature to have multiple entries in the same keytab, for example principals for host and HTTP. They both have the same key which may not be what you really want. To do this use mutiple -s <service> options when you create the keytab and account. Note in AD they will each have SPN, but a common UPN, in case you want to use kinit with a keytab. IMHO I would use separate accounts for each principal. > > Regards > Markus > > "John Hefferman" <[email protected]> wrote in message > news:[email protected]... >> Dear list, >> >> To my knowledge (and after some tests), msktutil requires a separate >> account in active directory for each service principal needed for a >> machine. >> >> For instance, if a Linux computer is going to need a host/ and a http/ >> service principal it would be nessesary to run msktutil twice, such as: >> >> msktutil -h fqdn --computer-name linux-computer --verbose -s host/fqdn -k >> linuxComputer.keytab --server domainControllerFqdn >> >> msktutil -h fqdn --computer-name linux-computer-http --verbose -s >> http/fqdn -k linuxComputerHttp.keytab --server domainControllerFqdn >> >> I just wanted to confirm this was the case, or whether it is possible to >> have both host/ and http/ under the same account in AD. >> >> Thanks in advance for any help, >> >> John >> >> >> >> ________________________________________________ >> Kerberos mailing list [email protected] >> https://mailman.mit.edu/mailman/listinfo/kerberos >> > > > ________________________________________________ > Kerberos mailing list [email protected] > https://mailman.mit.edu/mailman/listinfo/kerberos > > -- Douglas E. Engert <[email protected]> Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
