Creating a Kerberos service principal (SPN) and keytab file on your Microsoft domain controller machine

You must create a Kerberos service principal name (SPN) and keytab file on your Microsoft domain controller machine to support HTTP requests using the Simple and Protected GSS-API Negotiation Mechanism (SPNEGO) web authentication for WebSphere® Application Server.

Before you begin

Configure the Microsoft Windows Server running the Active Directory Domain Controller and associated Kerberos Key Distribution Center (KDC).

For information on the supported Microsoft Windows Servers, see the System Requirements for WebSphere Application Server Version 8.5 on Windows.

Procedure

  1. Create a user account for the WebSphere® Application Server in a Microsoft Active Directory.
    This account is eventually mapped to the Kerberos service principal name (SPN).
  2. On the Microsoft Active Directory machine where the Kerberos key distribution center (KDC) is active, map the user account to the Kerberos service principal name (SPN).
    This user account represents the WebSphere Application Server as being a Kerberos service with the KDC. Use the Microsoft setspn command to map the Kerberos service principal name to a Microsoft user account.
  3. Create the Kerberos keytab file and make it available to WebSphere Application Server.

    Use the Microsoft ktpass tool to create the Kerberos keytab file (krb5.keytab).

    To make the keytab file available to WebSphere Application Server, copy the krb5.keytab file from the Domain Controller (LDAP machine) to the WebSphere Application Server machine. Read about Creating a Kerberos service principal name and keytab file for more information.

Results

The product can use the Kerberos keytab file that contains the Kerberos service principal keys to authenticate the user in the Microsoft Active Directory and the Kerberos account.