Example command
rndPass -ptype KRB5_NT_SRV_HST -princ
HTTP/[email protected] -mapuser [email protected]
-out myilo.keytab
Example output
Targeting domain controller: domaincontroller.example.net
Using legacy password setting method
Successfully mapped HTTP/iloname.example.net to iloname.
WARNING: pType and account type do not match. This might cause problems.
Key created.
Output keytab to myilo.keytab:
Keytab version: 0x502
keysize 69 HTTP/[email protected] ptype 3
(KRB5 _NT_SRV_HST) vno 3 etype 0x17 (RC4-HMAC) keylength 16
(0x5a5c7c18ae23559acc2 9d95e0524bf23)
The
Ktpass
command might display a message about not being able to set the UPN. This result is
acceptable because iLO is a service, not a user. You might be prompted to confirm the password change
on the computer object. To close the window and continue creating the keytab file, click
OK
.
Setspn
Syntax
Setspn [options]
Description
The
Setspn
command displays, modifies, and deletes SPNs.
Parameters
-A <SPN>
Specifies an SPN to add.
-L
Lists the current SPN for a system.
Example command
SetSPN -A HTTP/myilo.somedomain.net myilo
The SPN components are case-sensitive. The primary (service type) must be in uppercase letters, for
example,
HTTP
. The instance (iLO hostname) must be in lowercase letters, for example,
myilo.somedomain.net
.
The
SetSPN
command might display a message about not being able to set the UPN. This result is
acceptable because iLO is a service, not a user. You might be prompted to confirm the password change
on the computer object. Click
OK
to close the window and continue creating the keytab file.
Verifying that your environment meets the Kerberos authentication time
requirement
For Kerberos authentication to function properly, the date and time must be synchronized between the
iLO processor, the KDC, and the client workstation. Set the date and time in iLO with the server, or obtain
the date and time from the network by enabling the SNTP feature in iLO.
Setspn
309
