Background
IT Ops often ask themselves about servicePrincipalNames in the context of Kerberos and ActiveDirectory. When a system is Centrified, part of the process is to populate some of these entries to facilitate certain services to "just work"; SPNs play a part on that equation; however there may be conflicts as well; many organizations use Centrify software to simplify and secure Hadoop implementations at the OS-layer; there may be conflicts with other Kerberos-enabled apps as well. This quick article consolidates the questions that we commonly get as it relates to SPNs and Centrify DirectControl.
What is a Kerberos SPN?
ServicePrincipalName is the name by which a Kerberos client identifies an instance of a service. The simple format entry in Active Directory looks like this: service/realm:PORT. E.g. HTTP/host.example.com
What does this have to do with Centrify?
Centrify uses Kerberos for authentication against Active Directory. When you join a UNIX, Linux or Mac system into Active Directory using Centrify, there are a set of ServicePrincipalNames defined for the system by default. Some of these are (varies between platforms).
afpserver: for an Apple file server
cifs: for a Samba file server
ftp: for a Kerberos-enabled ftp server
host: for host services like SSHD
http: for Web Servers that use SPNEGO
ipp: for web-based printing
nfs: for Kerberos-enabled NFS
How commonly used are this servicePrincipalNames?
In an Active Directory environment, because it uses Kerberos as the authentication protocol, you interact with Kerberos-enabled services all the time. As an example, right now, you can connect to a Centrified system using ssh. When you do, you are getting a service ticket for the HOST service for that system. You can verify this with the klist command on Windows or in UNIX. For example: Diana (dwirth) connects to two centrified systems using PuTTY (engcen6 and linux2); then she opens PowerShell and verifies that she has a service ticket.
Windows PowerShell
Copyright (C) 2014 Microsoft Corporation. All rights reserved.
PS C:\Users\dwirth> klist | sls host
Server: host/engcen6.centrify.vms @ CENTRIFY.VMS
Server: host/linux2.centrify.vms @ CENTRIFY.VMS
When does the service registration happen, when I install your CentrifyDC package?
No. Remember that installing our packages only will place our binaries in your system. These changes happen when you run the adjoin command OR on the AD side, when you use the "Prepare UNIX computer" option in Centrify Access Manager or when you use the
New-CdmManagedComputer PowerShell commandlet.
You have a chance to add/remove or modify SPNs during the Pre-Create stage.
Why do you do this?
To make sure that certain common services that rely on Kerberos just work out of the box.
Can I control the behavior of the default SPNs?
Yes. The adclient.krb5.service.principals parameter takes care of what SPNs are set up in the computer’s AD object and its corresponding system keytab entries. All you need to do is enable the parameter, PRIOR to running adjoin to join AD and only the entries defined will be created by default. From the Centrify UNIX configuration guide:
"adclient.krb5.service.principals
This configuration parameter specifies additional service principals
for entries in the Kerberos key table. The key table is populated by
default with the service principals host, http, cifs, and nfs.
This parameter's value must be one or more principal service names,
separated by a space or by a comma. For example:
adclient.krb5.service.principals: http ftp cifs nfs
If this parameter is not defined in the configuration file, no
additional principal names are added to the Kerberos key table."
You can also leverage the Precrate option in Access Manager or the New-CdmManagedComputer PowerShell commandlet.
How can I see the existing registered SPNs for a Centrified system?
On UNIX/Linux/Mac CLI: Use the “adinfo –C” command from the CLI.
- Make sure you have a current Kerberos ticket. If you get a "cannot bind" error, just kinit and reauthenticate against AD.
$ adinfo -C
Computer Account Diagnostics
Joined as: engcen6
Trusted for Delegation: true
Use DES Key Only: false
Run adinfo as root to examine local key info
Key Version: 11 (local key version unavailable)
Service Principal Names: myservice/engcen6
myservice/engcen6.centrify.vms
nfs/engcen6.centrify.vms
nfs/engcen6
ipp/engcen6.centrify.vms
ipp/engcen6
http/engcen6.centrify.vms
http/engcen6
host/engcen6.centrify.vms
host/engcen6
ftp/engcen6.centrify.vms
ftp/engcen6
cifs/engcen6.centrify.vms
cifs/engcen6
afpserver/engcen6.centrify.vms
afpserver/engcen6
Supported Encryption Type(s): RC4-HMAC
AES128-CTS-HMAC-SHA1-96
AES256-CTS-HMAC-SHA1-96
Operating System Version: 6.1:6.5 (Final)
From Windows using the CLI: Use the “setspn.exe –L <hostname>”
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
C:\>setspn -L engcen6
Registered ServicePrincipalNames for CN=engcen6,OU=Servers,OU=centrifyse,DC=cent
rify,DC=vms:
myservice/engcen6
myservice/engcen6.centrify.vms
nfs/engcen6.centrify.vms
nfs/engcen6
ipp/engcen6.centrify.vms
ipp/engcen6
http/engcen6.centrify.vms
http/engcen6
host/engcen6.centrify.vms
host/engcen6
ftp/engcen6.centrify.vms
ftp/engcen6
cifs/engcen6.centrify.vms
cifs/engcen6
afpserver/engcen6.centrify.vms
afpserver/engcen6
From Windows Using Active Directory Users and Computers
- Make sure that the Advanced Features check is set in the View menu.
- Find the computer object > right click > Properties > Attribute Editor
- In the Attribute Editor, find the servicePrincipalName field.
What if I need to change the SPNs for an existing system?
There are several ways to do it. The easiest way to do it is using adkeytab; however if you want this to happen automatically during join, you have to modify the configuration file.
You can also use adleave/adjoin, however this has the drawback that the agent will be disabled temporarily.
Using adkeytab
To add an SPN to the computer
Example: adding the oracle service to the shortname engcen6 – notice that you need to be root or elevate to change the system keytab, plus you'll need an AD user that can modify the computer object in AD.
- Run “dzdo adkeytab --addspn --principal [principal in correct format] --user [ad-user-that-can-modify-computer-object] --verbose”
$ dzdo adkeytab --addspn --principal oracle/engcen6 --user dwirth --verbose
Active Directory Password:
ADKeyTab version: CentrifyDC 5.2.0-218
Options
-------
use machine ccache: no
domain: centrify.vms
server: null
user: dwirth
container: null
account: null
trust: no
des: no
dwirth@CENTRIFY.VMS's password:
Attempting bind to centrify.vms site:Demo-Network server:dc.centrify.vms: ccache:MEMORY:0x5666c0
Bind successful to server dc.centrify.vms
Searching for AD Object: filter = (samAccountName=engcen6$), root = DC=centrify,DC=vms
AD Object found: CN=engcen6,OU=Servers,OU=centrifyse,DC=centrify,DC=vms
Key Version = 11
Success: Add SPNs: Default Key Tab
- Verify the new SPN with “adinfo –C”
$ adinfo -C | grep oracle
Service Principal Names: oracle/engcen6
- Optional: List the contents of the system keytab
dzdo /usr/share/centrifydc/kerberos/bin/klist -kt /etc/krb5.keytab | grep oracle
11 12/16/15 07:27:47 oracle/engcen6@CENTRIFY.VMS
[output truncated]
The KVNO goes up, and the new entry is present.
To remove an SPN from the computer (example: removing the entry I added above to the same system)
- Run “dzdo adkeytab --delspn --principal oracle/engcen6 --user [ad-user-that-can-modify-computer-object] --verbose”
$ dzdo adkeytab --delspn --principal oracle/engcen6 --user dwirth --verbose
ADKeyTab version: CentrifyDC 5.2.0-218
Options
-------
use machine ccache: no
domain: centrify.vms
server: null
user: dwirth
container: null
account: null
trust: no
des: no
dwirth@CENTRIFY.VMS's password:
Attempting bind to centrify.vms site:Demo-Network server:dc.centrify.vms: ccache:MEMORY:0x5666c0
Bind successful to server dc.centrify.vms
Searching for AD Object: filter = (samAccountName=engcen6$), root = DC=centrify,DC=vms
AD Object found: CN=engcen6,OU=Servers,OU=centrifyse,DC=centrify,DC=vms
Key Version = 11
Deleting SPN oracle/engcen6
Keeping SPN myservice/engcen6
Keeping SPN myservice/engcen6.centrify.vms
Keeping SPN nfs/engcen6.centrify.vms
Keeping SPN nfs/engcen6
Keeping SPN ipp/engcen6.centrify.vms
Keeping SPN ipp/engcen6
Keeping SPN http/engcen6.centrify.vms
Keeping SPN http/engcen6
Keeping SPN host/engcen6.centrify.vms
Keeping SPN host/engcen6
Keeping SPN ftp/engcen6.centrify.vms
Keeping SPN ftp/engcen6
Keeping SPN cifs/engcen6.centrify.vms
Keeping SPN cifs/engcen6
Keeping SPN afpserver/engcen6.centrify.vms
Keeping SPN afpserver/engcen6
Removing SPNs from ADObject engcen6
Removing spns and from config file for engcen6
Removing SPNS from Keytab for engcen6
Success: Del SPNs: Default Key Tab
- Verify the new deleted SPN with “adinfo –C”
$ adinfo -C | grep oracle
$
No results imply that there's no entry.
Using adleave/adjoin
- Edit the /etc/centrifydc/centrifydc.conf file and use the krb5.service.principals parameter to reflect the desired SPNs and save the file
- Note the Zone and Computer Roles the system belongs to (using access manager, UNIX CLI or ADUC)
- Leave AD by running “dzdo adleave –r –u [AD-user-that-can-remove-the-computer-object]”
this will leave the domain and remove the computer object; if you rather do an offline leave, use the adleave -f command.
- Join AD by running the “[elevate] adjoin –z [zone] –c [container-in-ad] –u [ad-user-that-can-join] [domain.name]”
if you have to join any computer roles, use the –computerrolrole parameter and list the computer roles.
- Verify that the newly-joined system has the SPNs you require by using adinfo -C
Do you know any instances of conflicts with these SPNs?
Yes. Other Kerberos-enabled apps may rely on these SPNs. Some notables:
- Hadoop: Applications like Cloudera Manager, Hortonworks Ambari or MapR Control System will create HTTP records for SNEGO-enabled services. The best practice is to disable the http SPN using the krb5.service.principals parameter PRIOR to joining any systems that will participate in Hadoop clusters.
For example, if I forgot to remove the http entry and I already joined my Hadoop node, all I need to do is run the "sudo adkeytab --delspn --principal http/shortname --principal http/fqdn --user myuser" > this will remove all http SPNs.
- Certain Java apps: Some Kerberized java applications may have other conflicts. Applications vary.
- Mixed Kerberos Environments: In environments with mixed Kerberos environments (where AD and MIT Kerberos coexist) there may be conflicts, however if you follow the guidelines on Mixed Kerberos, there should be none given that the realms are different and the system keytabs & krb5.conf files are independent.
