SPN settings in a ADFS 3.0 lab setup

Question

I am a developer trying to understand authentication with ADFS (2012 R2), so I am trying to setup an ADFS lab. I have found 2 guides:

• doc1 - http://technet.microsoft.com/en-us/library/dn280939.aspx
• doc2 - http://blogs.technet.com/b/askpfeplat/archive/2013/12/09/how-to-build-your-adfs-lab-on-server-2012-part-1.aspx

Doc1 starts with creating a gSMA account, however Doc2 says "The ADFS configuration wizard will automatically configure the correct Service Principal Names (SPN) on this service account so don’t worry about this configuring the SPN."

Which path should I take? If you think I should create the gSMA account, can you help me understand what values I should provide in my lab? They are using

New-ADServiceAccount FsGmsa -DNSHostName adfs1.contoso.com -ServicePrincipalNames http/adfs1.contoso.com

My server is called server1.mydomain.local. Should my new gSMA command look like this?:

New-ADServiceAccount FsGmsa -DNSHostName server1.mydomain.local -ServicePrincipalNames http/server1.mydomain.local

I am specifically asking about the "ServicePrincipalNames" attribute because doc2 says to "Ensure that the physical computer name of any of the ADFS servers in the farm don’t match the ADFS service name"

Solution

You can either let the ADFS wizard make necessary configuration for gMSA account

or

you can pre-create your gMSA account with correct SPN (which is your adfs Service name). Same name needs to be also at certificate subject and SAN fields.

-Sami

Comments

[HopelessN00b]

Could you clarify this? I'm not sure what the question is. Either let the wizard create an SPN for you, or make one yourself, but either way, you have to make sure that the SPN is different from any computer hostname. (Is that the answer you're looking for?)

[itaysk]

Can I run the wizard without creating a user\SPN\gSMA in advance? I am not an IT guy, I'm a developer so I don't know the consequences...

[HopelessN00b]

You can - worst that happens is that authentication won't work until you register an SPN, and under other circumstances that can be a bitch to troubleshoot, but since you already know what to look at, there should be no problem with registering the SPN manually after the fact, if you want.