The NetIQ Documentation clearly describes how to set up Kerberos for Access Manager, but it does not take into account when the iDP is running on Windows and that server is a member server of the domain. spn.exe requires the User ID, which is the server name according to the documentation, but this is already taken by the Computer object in Active Directory.

The following describes an alternative way of setting the servicePrincipalName on the user object and generating the nidpkey.keytab file.

The assumption for this article is that a 2008 Domain Controller exists in the domain (supported as of Access Manager 3.1 SP2).

In this example, the 2008 Active Directory Domain is, the Kerberos Rhelm is DOMAIN.COM, the Domain Controller is srvdc, the iDP server name is srvidp, and the iDP URL is The workstation performing these actions only needs to be able to communicate with AD and the KDC, it does not have to be a member of the domain.

    1. Create the user srvidp in Active Directory with the userPrincipalName of HTTP/ @DOMAIN.COM, the pre-Windows 2000 username of srvidp, and the desired password (in this example it is idpuserpassword).
    2. Using the Windows Server 2008 Active Directory Users and Computers console, enable Advanced Features under the View menu.
    3. Under the properties of the srvidp user, select the Attribute Editor tab.
    4. Double click the servicePrincipalName attribute to edit.
    5. Add HTTP/ and HTTP/
    6. Install Sun JRE SE and make the bin directory part of the path (if this worksation is part of the domain, the klist executable in this same directory can also list issued Kerberos Tickets to the domain workstation and logged in domain user).
    7. Create a C:\WINDOWS\krb5.ini file with the following content:
    default_realm = DOMAIN.COM
    default_tkt_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5
    default_tgs_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5
    permitted_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5

    DOMAIN.COM = {
        kdc =
        admin_server =
        default_domain =

[domain_realms] = DOMAIN.COM = DOMAIN.COM
    1. From a command prompt, execute
ktab -a HTTP/ idpuserpassword -k nidpkey.keytab
  1. Validation of the content is made by executing the following command which should output something similar to the below output.
ktab -l -k nidpkey.keytab
Keytab name: C:\nidpkey.keytab
KVNO    Principal
  1     HTTP/
  1     HTTP/
  1     HTTP/
  1     HTTP/

Each line represents a key for the desired encryption as defined in the krb5 file (rc4-hmac, des3-cdc-sha1, etc).

Related TID: 7006039

More articles on my Website.

1 vote, average: 5.00 out of 51 vote, average: 5.00 out of 51 vote, average: 5.00 out of 51 vote, average: 5.00 out of 51 vote, average: 5.00 out of 5 (1 votes, average: 5.00 out of 5)
You need to be a registered member to rate this post.

Disclaimer: As with everything else at NetIQ Cool Solutions, this content is definitely not supported by NetIQ, so Customer Support will not be able to help you if it has any adverse effect on your environment.  It just worked for at least one person, and perhaps it will be useful for you too.  Be sure to test in a non-production environment.

Leave a Reply

Leave a Comment

May 11, 2010
10:39 am
Active Directory Authentication Automation Cloud Computing Cloud Security Configuration Customizing Data Breach DirXML Drivers End User Management Identity Manager Importing-Exporting / ICE/ LDIF Intelligent Workload Management IT Security Knowledge Depot LDAP Monitoring Open Enterprise Server Passwords Reporting Secure Access Supported Troubleshooting Workflow