Generating the Kerberos Service Keytab File

You need to generate the service keytab file on your Kerberos/Active Directory® server in order to configure Kerberos on your library. This is the file you select when configuring Kerberos. See Configuring Kerberos.

These instructions are for generating the service keytab file for use with Microsoft® Active Directory. If you not using Active Directory, refer to your Kerberos vendor for instructions on generating this file.

  1. Set up an Active Directory domain on the Windows server.
  2. At the command prompt, enter dcpromo.
  3. For Windows 2003 servers only: Install Windows Support Tools on the Windows 2003 server as follows:
    1. Go to www.microsoft.com and search for ”windows server 2003 support tools sp2” or click on the following link: http://www.microsoft.com/downloads/details.aspx?FamilyID=96a35011-fd83-419d-939b-9a772ea2df90&DisplayLang=en
    2. Download both support.cab and suptools.msi.
    3. Run suptools.msi to begin installation.
  4. Create a computer account in Active Directory. Do not select any of the check boxes during creation. The account name will be used for fields shown in the following steps.
  5. At the command prompt, map SPN to the computer account.

    Use the following format: setspn -A library/<fqdn of library> <computer account>

    For example: setspn -A library/delos.dvt.mycompany.com kerbtest
  6. At the command prompt, create the keytab file for the SPN. Use one of the following formats:

See also: