Duplicate SPN in the Domain.

Question

Duplicate SPN in the Domain.

Cobion 111

Hello everyone!
Tell me, can it happen that this delegation will allow you to create a duplicate SPN?
AD is large enough and roughly speaking, one object in AD can be linked to several SPNs, and how would it not happen that when delegating and creating SPN, whatever other service in AD will stop working?

Or write a script on Posh that will check the identity of the SPN?
Link to a related question:delegation-of-authority-to-create-an-spn.html

Thanks!

Thameur-BOURBITA 36,261 Reputation points Moderator

2022-03-21T17:53:33.807+00:00

Do you have a update ?

4 answers

Your answer

Thameur-BOURBITA 36,261 Reputation points Moderator

2022-03-21T17:53:33.807+00:00

Do you have a update ?

Answer 1

Thameur-BOURBITA 36,261 Moderator

Hi,

Tell me, can it happen that this delegation will allow you to create a duplicate SPN?

Yes, it's possible when the admin don't use the command setspn -S to add a SPN . Setspn -A or add spn by editing AD attribute can generate a duplicate SPN.
The only way to prevent duplicate SPN when you generate new one is to use setspn -s

AD is large enough and roughly speaking, one object in AD can be linked to several SPNs, and how would it not happen that when delegating and ****creating SPN, whatever other service in AD will stop working?

if you need to delete duplicate SPN , you should removing SPN on the wrong computer or service account to restore the service.
the command setspn -X -F will help you to identify duplicate SPN. Setspn -F -Q host/servernam will help you to identify on with object the SPN has been added in the forest.

Type Setpspn /? you will find all option provided by this command to manage SPN.

*Please don't forget to mark helpful reply as answer

Gary Reynolds 9,621 Reputation points

2022-03-18T11:00:30.073+00:00

Hi Thameur

I don't believe it is possible to added a duplicate SPN, even with the setSPN -A it doesn't work and directly adding an existing SPN to another object will also produce an error, which states the SPN must be unique forest wide. From a kerberos point of view, duplicate SPN would cause authentication issues, as the issued token against the SPN, is signed with the computer object and server's shared secret (password) to ensure that only that computer can verify the ticket.
Thameur-BOURBITA 36,261 Reputation points Moderator

2022-03-18T11:20:35.863+00:00

@Gary Reynolds : the option -A has been removed from help on new version. In old version - A doesn't check if the SPN already exist but in last OS versions , Microsoft fixed it to avoid duplicate SPN.

Please don't forget to mark helpful reply as answer
Gary Reynolds 9,621 Reputation points

2022-03-18T11:45:18.057+00:00

Which version of the OS introduction the additional checks at the DS service level to prevent duplicates? Windows 2008R2 allows duplicate, Windows 20019 doesn't.
Charles Thivierge 4,171 Reputation points

2022-03-18T12:25:11.74+00:00

I think it came with Windows 2012 R2
Thameur-BOURBITA 36,261 Reputation points Moderator

2022-03-18T13:01:42.587+00:00

@Gary Reynolds : if i have a good memory , I think since windows 2012 or Windows 2012 R2

Answer 2

Hi @Cobion

In the context of an SPN you can only have one SPN entry per forest, i.e. host/server1 can only exist on one object. The setSPN command has logic to check if an entry exists before it's added. If you do try to bypass setSPN and set the SPN directly on an object using a AD editing tool, such as ADSIEdit, LDP, etc this will also fail as the DS service also prevents multiple entries being created.

The linked post is talking about changing the permissions and who can change the SPN value, this doesn't change the underlying logic which will prevent multiple SPN being created.

Gary.

Answer 3

Cobion 111

That is, the administrator of *Nix services will be able to attach the hosts of the HADOOP cluster to the Active Directory domain and create an SPN for using Kerberos+HADOOP?
At the same time, even if there is an SPN with the same name in AD in the domain, it will not be possible to register it?

Answer 4

Gary Reynolds 9,621

If you want to allow user's to join additional machines to the domain, this will require additional delegation rights over the SPN rights mentioned in the post. Have a look at this question for more information.

After Windows 2012R2 if an SPN already exists, it was not possible to assign the same SPN to another object.

Gary.

Share via

Duplicate SPN in the Domain.

4 answers

Your answer