Creating a keytab file

You can use the same account to authenticate on all cluster nodes. To do so, create a keytab file containing the service principal names (SPN) for each of these nodes. When creating a keytab file, you will have to use an attribute for generating the salt, which modifies the hash function input.

You must use any convenient method to save the generated "salt" so that it can be used later when adding new SPNs to the keytab file.

You can also create a separate Active Directory user account for each cluster node that requires configuration of Kerberos authentication.

The keytab file is created on the domain controller server or on a Windows Server computer that is part of the domain, under the domain administrator account.

To create a keytab file using one user account:

1. In the Active Directory Users and Computers snap-in, create a user account (for example, named control-user).
2. To use the AES256-SHA1 encryption algorithm, in the Active Directory Users and Computers snap-in:
   1. Open the properties of the created account.
   2. On the Account tab, select the This account supports Kerberos AES 256 bit encryption check box.
3. Use the ktpass tool to create a keytab file for control-user. To do so, run the following command on the command line:

   C:\Windows\system32\ktpass.exe -princ HTTP/<fully qualified domain name (FQDN) of the Control node>@<realm Active Directory domain name in uppercase> -mapuser control-user@<realm Active Directory domain name in uppercase> -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * +dumpsalt -out <path to file>\<file name>.keytab

   The tool will prompt you for the control-user password when running the command.

   The SPN of the Control node is added to the created keytab file. The screen will display the generated salt: Hashing password with salt "<hash value>".

4. For each cluster node, add an SPN entry to the keytab file. To do so, run the following command:

   C:\Windows\system32\ktpass.exe -princ HTTP/<fully qualified domain name (FQDN) of the node>@<realm Active Directory domain name in uppercase> -mapuser control-user@<realm Active Directory domain name in uppercase> -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * -in <path and name of the previously created file>.keytab -out <path and new name>.keytab -setupn -setpass -rawsalt "<salt hash value obtained when creating the keytab file at step 3>"

   The tool will prompt you for the control-user password when running the command.

The keytab file will be created. This file creates all added SPNs of cluster nodes.

Example: For example, you need to create a keytab file containing the SPNs of 3 nodes: control-01.test.local, secondary-01.test.local, and secondary-02.test.local. To create a file named filename1.keytab containing the SPN of the Control node in the C:\keytabs\ folder, run the following command: C:\Windows\system32\ktpass.exe -princ HTTP/control-01.test.local@TEST.LOCAL -mapuser control-user@TEST.LOCAL -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * +dumpsalt -out C:\keytabs\filename1.keytab Let's assume you have received the salt "TEST.LOCALHTTPcontrol-01.test.local". To add one more SPN, run the following command: C:\Windows\system32\ktpass.exe -princ HTTP/secondary-01.test.local@TEST.LOCAL -mapuser control-user@TEST.LOCAL -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * -in C:\keytabs\filename1.keytab -out C:\keytabs\filename2.keytab -setupn -setpass -rawsalt "TEST.LOCALHTTPcontrol-01.test.local" To add a third SPN, run the following command: C:\Windows\system32\ktpass.exe -princ HTTP/secondary-02.test.local@TEST.LOCAL -mapuser control-user@TEST.LOCAL -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * -in C:\keytabs\filename2.keytab -out C:\keytabs\filename3.keytab -setupn -setpass -rawsalt "TEST.LOCALHTTPcontrol-01.test.local" This will result in the creation of a file named filename3.keytab containing all three added SPNs.

To create a keytab file using a separate user account for each node:

1. In the Active Directory Users and Computers snap-in, create a separate user account for each cluster node (for example, you can create user accounts named control-user, secondary1-user, secondary2-user, and so on).
2. To use the AES256-SHA1 encryption algorithm, in the Active Directory Users and Computers snap-in:
   1. Open the properties of the created account.
   2. On the Account tab, select the This account supports Kerberos AES 256 bit encryption check box.
3. Use the ktpass tool to create a keytab file for control-user. To do so, run the following command on the command line:

   C:\Windows\system32\ktpass.exe -princ HTTP/<fully qualified domain name (FQDN) of the Control node>@<realm Active Directory domain name in uppercase> -mapuser control-user@<realm Active Directory domain name in uppercase> -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * -out <path to file>\<file name>.keytab

   The tool will prompt you for the control-user password when running the command.

   The SPN of the Control node is added to the created keytab file.

4. For each cluster node, add an SPN entry to the keytab file. To do so, run the following command:

   C:\Windows\system32\ktpass.exe -princ HTTP/<fully qualified domain name (FQDN) of the node>@<realm Active Directory domain name in uppercase> -mapuser secondary1-user@<realm Active Directory domain name in uppercase> -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * -in <path and name of the previously created file>.keytab -out <path and new name>.keytab

   The tool will prompt you for the secondary1-user password when running the command.

The keytab file will be created. This file creates all added SPNs of cluster nodes.

Example: For example, you need to create a keytab file containing the SPNs of 3 nodes: control-01.test.local, secondary-01.test.local, and secondary-02.test.local. To create a file named filename1.keytab containing the SPN of the Control node in the C:\keytabs\ folder, run the following command: C:\Windows\system32\ktpass.exe -princ HTTP/control-01.test.local@TEST.LOCAL -mapuser control-user@TEST.LOCAL -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * -out C:\keytabs\filename1.keytab To add one more SPN, run the following command: C:\Windows\system32\ktpass.exe -princ HTTP/secondary-01.test.local@TEST.LOCAL -mapuser secondary1-user@TEST.LOCAL -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * -in C:\keytabs\filename1.keytab -out C:\keytabs\filename2.keytab To add a third SPN, run the following command: C:\Windows\system32\ktpass.exe -princ HTTP/secondary-02.test.local@TEST.LOCAL -mapuser secondary2-user@TEST.LOCAL -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass * -in C:\keytabs\filename2.keytab -out C:\keytabs\filename3.keytab This will result in the creation of a file named filename3.keytab containing all three added SPNs.

Page top