Used to initialize kerberos support in active directory domain. Case is sensitive for capitalized words
Active directory admins have to make the following:
- Create account for application (webapi)
domain<Application title (arbitrary)>
Example
domain\Atlas_acc
- Create spn
C:\Windows\system32>setspn -A HTTP/ <Application title (arbitrary)>
Example
C:\Windows\system32>setspn -A HTTP/ssuvorov.domain.corp atlas_acc
C:\Windows\system32>setspn -L
Example
C:\Windows\system32>setspn -L atlas_acc
- Create keytab file
C:\Windows\system32>ktpass -princ HTTP/@ -mapuser -pass <Application password (from application account)> -ptype KRB5_NT_PRINCIPAL -out
Example
C:\Windows\system32>ktpass -princ HTTP/[email protected] -mapuser atlas_acc -pass UjRxS3hU -ptype KRB5_NT_PRINCIPAL -out C:\atlas.keytab
- Create application properties (webapi)
security.kerberos.keytabPath - Absolute path to keytab file
security.kerberos.spn - HTTP/@
Example
security.kerberos.keytabPath=c://tmp//atlas.keytab
security.kerberos.spn=HTTP/[email protected]