[Samba] Asking help exporing a valid keytab file for cups http

[Rowland Penny]

On Thu, 19 Jun 2025 19:11:45 +0200
Thorsten Otto via samba <samba at lists.samba.org> wrote:

> Thank you so much for your answer.
> 
> Am Donnerstag, dem 19.06.2025 um 17:19 +0100 schrieb Rowland Penny via
> samba:
> > On Thu, 19 Jun 2025 16:34:33 +0200
> > Thorsten Otto via samba <samba at lists.samba.org> wrote:
> > 
 > 
> > > 
> > > root at dc:~# samba-tool spn add
> > > HTTP/cupsserver.domain.tld at DOMAIN.TLD cupsserver$
> > > root at dc:~# samba-tool spn list cupsserver$
> > > cupsserver$
> > > User
> > > CN=CUPSSERVER,OU=Dateiserver,OU=Linux,OU=Rechner,DC=domain,DC=tld
> > > has the following servicePrincipalName: 
> > > 	 HOST/CUPSSERVER
> > > 	 HOST/cupsserver.domain.tld
> > > 	 HTTP/cupsserver.domain.tld at DOMAIN.TLD
> > 
> > That is another mistake, 'HOST' is a placeholder for other services
> > (amongst which is 'HTTP'), you can see the entire list with:
> 
> I did not create the HOST entries. They must have been put there by
> samba or another service.

I wasn't referring to the 'HOST' part, I was referring to the 'HTTP'
part, you do not need it.

> > 
> > sudo ldbsearch --cross-ncs --show-binary -H
> > /var/lib/samba/private/sam.ldb -P -b 'dc=samdom,dc=example,dc=com'
> > -s sub '(sPNMappings=*)' sPNMappings

If you replace the '-P' above with '--use-kerberos', it still works,
but using kerberos.

> > 
> > Which should produced something like this:
> > # record 1
> > dn: CN=Directory Service,CN=Windows
> > NT,CN=Services,CN=Configuration,DC=samdom,DC=example,DC=com
> > sPNMappings:
> > host=alerter,appmgmt,cisvc,clipsrv,browser,dhcp,dnscache,replicator,e
> > ventlog,eventsystem,policyagent,oakley,dmserver,dns,mcsvc,fax,msiserv
> > er,ias,messenger,netlogon,netman,netdde,netddedsm,nmagent,plugplay,pr
> > otectedstorage,rasman,rpclocator,rpc,rpcss,remoteaccess,rsvp,samss,sc
> > ardsvr,scesrv,seclogon,scm,dcom,cifs,spooler,snmp,schedule,tapisrv,tr
> > ksvr,trkwks,ups,time,wins,www,http,w3svc,iisadmin,msdtc
> > 
> > I hope you can see from that, you should be able to use the servers
> > host key.
> 
> > Rowland
> > 
> 
> I get the same output for the mappings. But I don't reallly understand
> how I could use that for the http authentication. I did tried these
> steps and got the same error as before

What I am saying is, you should not need the 'HTTP' SPN, because the
standard 'HOST' SPN should cover it.

Rowland