SPN

security

Stands for: Service Principal Name

The name a Kerberos client uses to request a service ticket.

A Service Principal Name uniquely identifies a service instance in Kerberos, tied to the account running it. A misregistered SPN is a classic cause of single sign-on failures.

A service principal name identifies a service instance in Kerberos, tying a service and host to the account that runs it. A client constructs the name from what it is connecting to and asks the KDC for a ticket for it.

Nearly all Kerberos failures are SPN failures. A missing name means no ticket can be issued and the client silently falls back to NTLM, which is why a password prompt appears where single sign-on should have been seamless. A duplicate name registered on two accounts breaks authentication for both. And because the client builds the name from the address it used, connecting by IP address or by an alias that is not registered produces the same failure, which is why the first question in any Kerberos problem is what name the client actually asked for.

Also known as: spn

← All glossary entries