2

I am trying to achieve Azure SSO in my organisation. I have a web server hosting multiple websites and web application under those sites. Users access them in below fashion

https:// < SiteName > / < ApplicationName > /

We have a service account configured for different application, means I have multiple service account for a single "WebSite" and same service account being used for different applications.

Now to achieve Azure SSO, I must configure SPNs for my service accounts, and as per microsoft same spn cannot be assigned to multiple service account.

to configure spn we have below command 

Setspn –S HTTP/NETBIOS_NAME_OF_IIS_SERVER domain\username
Setspn –S HTTP/FQDN_OF_IIS_SERVER domain\username

How can I assign same FQDN/NetBIOS name to all service account ?

Even if I use DNS name for my web Sites still I have to assign same spn to multiple service account.

Tolsadus
  • 1,183
  • 11
  • 23
Dheeraj Kumar
  • 23
  • 1
  • 3

1 Answers1

3

Yes, this is a fundamental issue with SPN's, you can't have more than one SPN for a URL on a single server. So in your situation where you different apps run under a single website and you need to use delegation or SSO, then they all have to run with the same service account, so you can register a single SPN for that URL.

If that is not possible you either need to host your apps with different service accounts on the same server under a different URL (assuming you setup the SPN for the URL), or different server if you are limited to using server names

Sam Cogan
  • 38,736
  • 6
  • 78
  • 114