Forum Discussion

Wire's avatar
Wire
Sep 03, 2013

APM - How to create a keytab file with multiple SPNs

Hi,   I have run into a problem using Kerberos Authentication when using CNAMEs in DNS.   You can search the web but basically if you use a CNAME record like "www CNAME www1" and then A records...
BIG-IP Access Policy Manager (APM)
design
kerberos
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Sep 03, 2013

Are you saying that I should just use one keytab file on "Site A" with SPN of "HTTP/www1" and a different keytab file on "Site B" with SPN of "HTTP/www2" and ignoring the SPN of "HTTP/www" completely?

 

That depends if the initial problem also exists in other browsers. Does Firefox also use the A name? I don't remember if it does. If it's universal, and a browser will always use the A name, then you probably don't need to worry about a keytab for the CNAME.

 

The "-in" option in ktpass just allows you to add information from other keytabs. So if you have an existing keytab file (ie. for "www"), then you'd create a new keytab (ie. for "www1") and include the other keytab with the -in option to aggregate the two keys. Repeat this process for as many keytabs as you need.