In the process of setting up Service Principal Names (SPNs) for Kerberos authentication in Tableau Server, what is an essential step for ensuring…

For Kerberos authentication to function, the client application must request a service ticket from the Key Distribution Center (KDC) for a specific service. The Service Principal Name (SPN) uniquely identifies this service instance in Active Directory. In the context of Tableau Server, the SPN must be registered against the "Run As User" service account. This SPN is composed of the service class (HTTP) and the server's fully qualified domain name (FQDN), for example, HTTP/tableau.example.com. This configuration correctly associates the Tableau Server service with its service account, enabling the KDC to issue valid tickets for authentication.

A. SPNs are registered for services, not individual user accounts. Users are identified by User Principal Names (UPNs).

C. SPNs are linked to hostnames (FQDNs), not dedicated IP addresses. A single IP can host services with multiple SPNs.

D. SSL encrypts HTTP traffic, whereas Kerberos is an authentication protocol with its own encryption. SSL is not a prerequisite for SPN configuration.

---

1. Tableau Server Documentation: In the guide for configuring Kerberos

it explicitly states the requirement to create an SPN for the Run As User account. The command provided is setspn -s HTTP/.

which directly links the SPN (using the FQDN) to the service account.

Source: Tableau Help

"Configure Kerberos"

Step 1: Configure Kerberos on the Active Directory computer.

2. Microsoft Official Documentation: Microsoft's documentation on SPNs clarifies their purpose: "A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account." This supports the fundamental principle behind option B.

Source: Microsoft Docs

"Service Principal Names"

Overview section.

3. MIT Kerberos Consortium Documentation: The foundational documentation for Kerberos explains that a service principal is typically composed of a service name and the fully qualified hostname of the machine the service is running on. This reinforces the importance of the FQDN in the SPN.

Source: MIT Kerberos Documentation

"Kerberos V5 System Administrator's Guide"

Section 2.3 Principals.