Using ktab to generate a Kerberos Ticket File without spn.exe or ktpass.exe

The Novell Documentation clearly describes how to set up Kerberos for Access Manager, but it does not take into account when the iDP is running on Windows and that server is a member server of the domain. spn.exe requires the User ID, which is the server name according to the documentation, but this is already taken by the Computer object in Active Directory.

The following describes an alternative way of setting the servicePrincipalName on the user object and generating the nidpkey.keytab file.

The assumption for this article is that a 2008 Domain Controller exists in the domain (supported as of Access Manager 3.1 SP2).

In this example, the 2008 Active Directory Domain is domain.com, the Kerberos Rhelm is DOMAIN.COM, the Domain Controller is srvdc, the iDP server name is srvidp, and the iDP URL is idp.domain.com. The workstation performing these actions only needs to be able to communicate with AD and the KDC, it does not have to be a member of the domain.

1. Create the user srvidp in Active Directory with the userPrincipalName of HTTP/idp.domain.com@DOMAIN.COM, the pre-Windows 2000 username of srvidp, and the desired password (in this example it is idpuserpassword).
2. Using the Windows Server 2008 Active Directory Users and Computers console, enable Advanced Features under the View menu.
3. Under the properties of the srvidp user, select the Attribute Editor tab.
4. Double click the servicePrincipalName attribute to edit.
5. Add HTTP/idp.domain.com and HTTP/idp.domain.com@DOMAIN.COM.
6. Install Sun JRE SE and make the bin directory part of the path (if this worksation is part of the domain, the klist executable in this same directory can also list issued Kerberos Tickets to the domain workstation and logged in domain user).
7. Create a C:\WINDOWS\krb5.ini file with the following content:

[libdefaults]
    default_realm = DOMAIN.COM
    default_tkt_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5
    default_tgs_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5
    permitted_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5

[realms]
    DOMAIN.COM = {
        kdc = srvdc.domain.com
        admin_server = srvdc.domain.com
        default_domain = domain.com
    }
 
[domain_realms]
    domain.com = DOMAIN.COM
    .domain.com = DOMAIN.COM

8. From a command prompt, execute

ktab -a HTTP/idp.domain.com idpuserpassword -k nidpkey.keytab

9. Validation of the content is made by executing the following command which should output something similar to the below output.

ktab -l -k nidpkey.keytab

Keytab name: C:\nidpkey.keytab
KVNO    Principal
---------------------------------------------------------
  1     HTTP/idp.domain.com@DOMAIN.COM
  1     HTTP/idp.domain.com@DOMAIN.COM
  1     HTTP/idp.domain.com@DOMAIN.COM
  1     HTTP/idp.domain.com@DOMAIN.COM

Each line represents a key for the desired encryption as defined in the krb5 file (rc4-hmac, des3-cdc-sha1, etc).

Oooh, my own first personal TID: 7006039