If I wanted to create a keytab file using the server name for the SPN, and I hav

keytab should probably be created on the JBoss/Appian server, since your Appian will be referencing it in the spring security files.

What you said makes sense about the keytab existing on the Appian server and referenced in the spring security files, that’s what I thought too. Although, I have been researching and found some sites that state if you are using a reverse proxy (which I’m guessing Apache is acting as a reverse proxy), then you would add the SPN for both the DNS and physical host name of the reverse proxy, not the application server. So maybe the SPN is for what a user would actually type into the URL to get to the resource, which would either be the DNS or host name of the Apache web server. From one site, it states “To negotiate the SPN (service principal name "HTTP/..."), the browser does a DNS lookup from the host name used in the URL, and then a reverse-DNS lookup from the answered IP address to get the FQDN of the server. This FQDN is used in the SPN.” So now I’m thinking I would use the DNS and server name of the Apache web server, but still not sure. Guess I can try that first and see what happens. Thanks.

hi pattye , can you please share with me how you could solve this ? i will have too the request to configure service principal with App server and Webserver running on different machines
Thanks in advance

I used the web server (and DNS of web server) as the SPN in the keytab, not the application server, and that worked. I store the keytab file on the application server where the spring files can locate it. Let me know if you need more specifics on commands used to create the keytab and/or my spring files.

thank you for sharing it with me. i would apreciate to see your spring and also the commands used to create Keytab.
thanks

Attaching the keytab instructions and the two spring override files. Please let me know if you have any questions. Just to let you know, in the auth-mgr-override file, the reference to RegexDelegatingUserDetailsService is our own custom code.

Keytab Instructions.docx

spring-security-03-auth-mgr-override.xml

spring-security-07-portal-override.xml

hi pattye ,
Thank you for sharing . especially the Keytab Instructions document is so detailed and precise. great ! what if both appian and webserver are running Windows ? i don't expect any change . i am right ?

I am not sure, but I don't think there would be any changes between Linux and Windows.