To enable association of an SPN to the account that the instance of SQL Server 2005 or SQL Server 2008 is running on, use the Windows SetSPN.exe support tool. This tool adds the SPN for the computer name on which the SQL Server instance is running under the Windows domain service user account located in Active Directory. In this scenario, the SetSPN.exe tool can be used to add two SPNs: one for the NetBIOS name and another for the fully qualified DNS name.
For example, if the SetSPN.exe tool is executed from the SQL Server instance running on MyComputer, the following two SPNs are associated with the account the SQL Server instance is running under and must be added to directory:
HTTP/MyComputer;
HTTP/MyComputer.fully.qualified.domain.name.com
Note that a single account may have multiple SPNs, but an SPN can only be registered for one account.
To delete these same two SPN names, both NetBIOS and fully qualified DNS, also use the SetSPN.exe.
Considerations
-
Similar to Httpcfg.exe, SetSPN.exe is available with Windows Server 2003 and is installed when you use the same procedure to install Httpcfg.exe and other Windows Support Tools. For more information, see Configuring the HTTP Kernel-Mode Driver (Http.sys).
-
If a SQL Server instance is not running as the local system account, only integrated authentication users that have DOMAIN ADMIN privileges can change SPN registration by using the SetSPN.exe tool.
-
If a SQL Server instance is running as the local system account, only members of the SQL Server sysadmin fixed server role can change SPN registrations by using the SetSPN.exe tool.
-
If the service account is Local System, the SPN is added in the Active Directory account of the computer without having to use the SetSPN.exe tool.
Syntax for SetSPN.exe
The syntax for SetSPN.exe is:
setspn { -A SPN | -D SPN | -L } service_account
Arguments
-
-A
-
Adds the specified SPN to the account.
-
-D
-
Deletes the specified SPN to the account.
-
-L
-
Lists all SPNs registered to the account.
Examples
If an instance of SQL Server is running as a domain user (MyDomain\MySQLAccount) on a computer that is named MySQLHost, the following commands can be used to set the appropriate SPNs:
setspn –A http/MySQLHost MyDomain\MySQLAccount
setspn –A http/MySqlHost.Mydomain.Mycorp.com MyDomain\MySQLAccount
Note that one account can have multiple SPNs (one for each service or host name), but an SPN can be registered under only one account. Having the same SPN registered on multiple accounts causes Kerberos authentication to fail.
For example, the account MyDomain\MySQLAccount can have the following different SPNs registered on it. The first two commands are for two different services (http and rpc). The last one is for a different host name, assuming the computer has multiple host names.
setspn –A http/MySQLHost MyDomain\MySQLAccount
setspn –A rpc/MySQLHost MyDomain\MySQLAccount
setspn –A http/MySecondHost MyDomain\MySQLAccount
Conversely, the following scenario will cause a Kerberos failure:
setspn –A http/MySQLHost MyDomain\MySQLAccountOne
setspn –A http/MySQLHost MyDomain\MySQLAccountTwo
Failure occurs because there are two instances of SQL Server on a computer that is running under two different service accounts (MySQLAccountOne and MySQLAccountTwo). Registering both SPNs, one for each instance of SQL Server is not a supported scenario.
This has implications when multiple instances of SQL Server that are run on the same computer under different accounts. The SPN can only be registered for one account. If you require multiple instances of SQL Server (for example, Inst1 and Inst2) to coexist beside other applications (such as IIS) and you want to use HTTP Kerberos authentication for all services, use one of the following options to resolve SPN registration conflicts:
-
Have all instances and applications run as the same account.
For example, have Inst1, Inst2 and IIS all run as LocalSystem or Mydomain\MyServiceAccount.
-
Register multiple host names for the same computer and have each instance and application listen on a different host. Therefore, in this case, you would have to do the following:
-
Create three different host names for the computer.
-
Assign each host to a different application.
-
Register three sets of SPNs, one for each host name/application combination.