3 Replies Latest reply on Aug 30, 2018 10:57 PM by Guilherme Ferreira

    Can't find AFServer Service Type for Kerberos Delegation

    Guilherme Ferreira

      Hello all!

       

      I tried to configure Kerberos constrained delegation but couldn't find the AFServer service type.

      I have tried adding the AF Server Computer as well as the domain account under which it runs.

       

      Do I need first to create a SPN for the AF Server?

      If that is the case, can I set more than one SPN for the same domain account? Because both VIsion and AF Service use the same account!

       

      Regards

        • Re: Can't find AFServer Service Type for Kerberos Delegation
          Guilherme Ferreira

          I think I found the answer in live library:

          Check and set permissions for SPN creation

           

          I will try it tomorrow and get back here...

            • Re: Can't find AFServer Service Type for Kerberos Delegation
              jowens

              Hi Guilherme Ferreira,

               

              Were you able to resolve your issue? To answer your question: yes, the AFServer service will need an SPN created. When configuring constrained delegation to the AFServer service, the service can be found under whichever account the SPN is created for.

               

              As the document you linked specifies, if the AF Application Service is running under the Network Service account, it will probably have permissions to create SPNs and should create them on startup. In this case, when configuring constrained delegation to the AFServer service, it would be located under the AF Server computer.

               

              However, if the AF Application Service is running under a domain service account, the account probably does not have permissions to create SPNs, and these will need to be created manually by a user with permission to create SPNs. In this case, when configuring constrained delegation to the AFServer service, it would be located under the domain service account user.

               

              And yes, you can set more than one SPN for the same domain account. The SPNs just must be either for different services or for different servers, or they will be duplicates.

               

              Please let me know if you have any further questions or confusion about this!

               

              Regards,

              James Owens

              2 of 2 people found this helpful