Generating the Kerberos Service Keytab File

You need to generate the ServiceKeytab file on your Kerberos (AD) server in order to configure Kerberos on your library. This is the file you select when configuring Kerberos. See Configuring Kerberos.

  1. Set up an Active Directory domain on the Windows 2003 server.
  2. At the command prompt, enter dcpromo.
  3. For Windows 2003 servers only: Install Windows Support Tools on the Windows 2003 server as follows:
    1. Go to www.microsoft.com and search for “windows server 2003 support tools sp2” or click on the following link: http://www.microsoft.com/downloads/details.aspx?FamilyID=96a35011-fd83-419d-939b-9a772ea2df90&DisplayLang=en
    2. Download both support.cab and suptools.msi.
    3. Run suptools.msi to begin installation.
  4. Create a computer account in Active Directory. Do not select any of the checkboxes during creation. The account name will be used for fields shown in the following steps.
  5. At the command prompt, map SPN to the computer account.

    Use the following format: setspn -A library/<fqdn of library> <computer account>

    For example: setspn -A library/delos.dvt.mycompany.com kerbtest
  6. At the command prompt, create the keytab file for the SPN. Use one of the following formats:

See also: