Versions Compared

Old Version 2

changes.mady.by.user Ole Kristian Aune

Saved on

compared with

New Version Current

changes.mady.by.user Steinar Line

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Creating the keytab with ktpass 

Command / parameter

 

Code Block
ktpass

ktpass is included in windows 2008 onward and is located in C:\Windows\System32\

Code Block
/princ HTTP/issues.example.com@EXAMPLE.LOCAL 

HTTP - defines the protocol. HTTP (uppercase) is used regardless of accessing the site with https
issues.example.com - Host part must match the hostname of your service
@EXAMPLE.COM - Realm name must match your Active Directory name written in uppercase 

Code Block
/mapuser EXAMPLE\svc-jira-sso 

Maps the Service Principal Name to an Active Directory user account. A unique account for each service should be created. The account should be configured with "Password never expires" and "User cannot change password" checked.

/pass * 

Some password. The password set replaces the user password.

Code Block
/out C:\issues.example.com.keytab 

The output location of the newly created keytab

Code Block
/ptype KRB5_NT_PRINCIPAL
Code Block
    The general ptype. Recommended by Microsoft.

Get-ADUser command

The Get-ADUser command will set the requested UserPrincipalName potentially bound to another service acocunt to $null. This assures that the new keytab created will work even though the UserPrincipalName was bound to another account from before. It will not do any harm on a first time installation.

 Example command:

Code Block
Get-ADUser -Filter "UserPrincipalName -like 'HTTP/issues.example.com@EXAMPLE.LOCAL'" | Set-ADUser -UserPrincipalName $null
ktpass /princ HTTP/issues.example.com@EXAMPLE.LOCAL -mapuser EXAMPLE\svc-jira-sso -pass * /out C:\issues.example.com.keytab /ptype KRB5_NT_PRINCIPAL

ktpass must be run in an elevated command (administrator) PowerShell prompt as a user with domain or enterprise permissions.

...