Setup Wizard - Task summary

Task summary

The final page of the wizard starts by displaying the configuration determined in the previous steps:

Step 1 of the task list describes how to create and/or configure the service account.

Depending on your AD permissions, you might need to hand this task over to your AD team.

The account svc-jirasso-issues needs to be created with "password never expires."

Please note you will need to dedicate account svc-jirasso-issues to only keytab export since running the ktpass command will invalidate the user password. So always set up using another account for user directory synchronization.

And also, never reuse the same user account in AD for more domains or environments. Always create a new user account every time you need to run ktpass when setting up against a new domain.

Then, in the account options, we need to enable "This account supports Kerberos AES 256 bit encryption":

Step 2:

Shows you how to create a keytab file using ktpass. Again, this is a task you might have to delegate to your AD team.

Step 3:

Finally, you may upload the keytab file created. After the upload has finished, a login test will be performed.

Note that if you have multiple domains, then you are offered to add keys to the existing keytab file.

A quick review of the syntax:

Command / parameter	Description

Command / parameter	Description
ktpass	ktpass is pre-installed in Windows 2008 onward. Located in c:\Windows\System32
/princ HTTP/issues.example.com@EXAMPLE.LOCAL	HTTP is always used for web servers, also when using https. issues.example.com is the canonical DNS name of JIRA EXAMPLE.LOCAL is the Kerberos realm name of the Active Directory Domain
/mapuser svc-jirasso-issues@EXAMPLE.LOCAL	Maps the /princ name above to the account svc-jirasso-issues. ktpass will add this attribute on the account: servicePrincipalName: HTTP/issues.example.com
/crypto AES2568-SHA1	Specifies the encryption type used when generating keys in the keytab. Must match the account supported encryption type.
/ptype KRB5_NT_PRINCIPAL	The general ptype, recommended by Microsoft.
/out c:\issues.example.com	Output location of the generated keytab file

Running the ktpass command will output a keytab file and register issues.examples.com as an HTTP Kerberos service.

Specifically, ktpass will:

Add a servicePrincipalName attribute on the account with the value HTTP/issues.example.com.
Set the userPrincipalName attribute to HTTP/issues.example.com.
Ask the admin to provide a password and confirm it.
Set that password on the account.
Generate a keytab file with an AES-256 key for the principal HTTP/issues.example.com@EXAMPLE.LOCAL.

Note that ktpass must be running in a "run as administrator" cmd window by a user with Domain Admin permissions.