AD FS 2.0: How to Configure the SPN (servicePrincipalName) for the Service Account

AD FS 2.0: How to Configure the SPN (servicePrincipalName) for the Service Account

Summary

When you deploy an AD FS 2.0 Federation Server farm you must specify a domain-based service account, and the AD FS 2.0 service account needs to have a SPN (servicePrincipalName) registered to allow Kerberos to function for the Federation Service.

When you initially configure the AD FS 2.0 farm, the configuration wizard will attempt to set the SPN for you as long as the account running the configuration wizard has Write access to the servicePrincipalName attribute on the service account in Active Directory.

 

Reasons you may need to manually set the SPN on the AD FS 2.0 service account:

  • SPN registration failed during initial configuration of the farm
  • The Federation Service name has changed
  • The service account has changed

 

The SPN to register is in the following format:

HOST/{your_Federation_Service_name}

 

You can register the SPN using setspn.exe, ADSIEDIT, or any utility capable of writing Active Directory LDAP attributes.

 

Syntax for SetSPN.exe:

setspn -a host/{your_Federation_Service_name} {domain_name}\{service_account}

 

In Windows Server 2008 and later, the SetSPN.exe utility provides a way to ensure that you are not duplicating SPN's in the forest:

setspn -x

or

setspn -s host/{your_Federation_Service_name} {domain_name}\{service_account}

 

More Information

As an Active Directory admin, you may ask: "Why do we need the HOST SPN instead of the HTTP SPN?"

Answer:

AD FS 2.0 utilizes the HOST service type for SPN registration because of default Windows Communication Foundation (WCF) SPN requirements. While HTTP makes sense for web-based applications, it does not satisfy rich clients who use the WS-Trust protocol.


What's my Federation Service Name?

Answer:

From the ADFS Management console, select Edit Federation Service Properties. The Federation Service name is listed in the middle textbox.

Sort by: Published Date | Most Recent | Most Useful
Comments
  • do you have to restart AD FS service after setting this SPN? what should i do after i set this Spn

  • How ADFS must be configured if HOST SPN is already registered with the computer account?

    I am setting up ADFS farm and I am using user created service account in AD, but I cannot register HOST SPN on it, because it is already registered with the computer account. What I am supposed to do?

  • Ditto...I've rebuilt mine (with different server names) and each time I get that warning at the end of install.

    Also, what might be an appropriate question is what is the "your_Federation_Service_name"? Is that the server name, or something else?

  • You could run the following PowerShell to locate the object that is currently holding the HOST SPN you are trying to use.

    Note: Make sure you replace the******** below with the HOST SPN you are trying to find.

    Cheers,

    Mark

    Import-Module ActiveDirectory

    get-aduser -filter * -Properties cn,servicePrincipleName | Where {$_.servicePrincipleName -eq "host/********"}

Page 1 of 1 (4 items)