Generating the keytab file

Last Updated : Jun 05, 2020 |
Prolog information
Metadata
Keywords:
You can generate the keytab file on a Key Distribution Center (KDC). Typically, this is the same server where the Enterprise Directory service is running. The Microsoft enterprise directory is called Active Directory.
  1. Create a new IWA service account.
    ADDITIONAL INFORMATION:
    For example: ps_spn_user
    Do not select an account that is associated with an existing user.
  2. If you are using Microsoft Active Directory 2008 or later, run the following command to attach the service principal name (SPN) to the domain name:
    ADDITIONAL INFORMATION:
    setspn -S HTTP/<PS_LB_FQDN> <SPN_User_Login_WithoutDomain>
    For example:setspn -S HTTP/ps.example.com ps_spn_user
  3. Generate the ps.keytab file by running the following command:
    ADDITIONAL INFORMATION:
    ktpass /out c:\ps.keytab /mapuser <SPN_User_Login_WithoutDomain>@<KERBEROS_REALM> /princ HTTP/<PS_LB_FQDN>@<KERBEROS_REALM> /pass +rndPass /crypto all /kvno 0
    ADDITIONAL INFORMATION:
    For example:ktpass /out c:\ps.keytab /mapuser ps_spn_user@EXAMPLE.COM /princ HTTP/ps.example.com@EXAMPLE.COM /pass +rndPass /crypto all /kvno 0
    ADDITIONAL INFORMATION:
    where:
    <SPN_User_Login_WithoutDomain> is ps_spn_user
    <KERBEROS_REALM> is EXAMPLE.COM
    <PS_LB_FQDN> is ps.example.com
    ADDITIONAL INFORMATION:
    Note:
    Parameters are case-sensitive. For example, kerberos_realm is not the same as KERBEROS_REALM.
Related links
Enterprise IWA over Kerberos authentication to authenticate REST API clients