授权给adfs读取ad 在ad服务器上运行 - setspn 命令 -摘自网络

最新推荐文章于 2025-06-10 16:19:35 发布

转载最新推荐文章于 2025-06-10 16:19:35 发布 · 399 阅读

文章标签：

#数据库 #运维

本文介绍如何为ADFS 2.0应用池配置Service Principal Name (SPN)，确保应用池能够使用域用户/服务帐户身份运行。通过使用Setspn.exe工具设置SPN，并调整SQL Server数据库的访问控制列表（ACL），允许新帐户读取策略数据。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Because the application pool identity for the AD FS 2.0 AppPool is running as a domain user/service account, you must configure the Service Principal Name (SPN) for that account in the domain with the Setspn.exe command-line tool. Setspn.exe is installed by default on computers running Windows Server 2008. Run the following command on a computer that is joined to the same domain where the user/service account resides:

Copy

setspn -a host/<server name> <service account>

For example, in a scenario in which all federation servers are clustered under the Domain Name System (DNS) host name fs.fabrikam.com and the service account name that is assigned to the AD FS 2.0 AppPool is named adfs2farm, type the command as follows, and then press ENTER:

Copy

setspn -a host/fs.fabrikam.com adfs2farm

It is necessary to complete this task only once for this account.

After the AD FS 2.0 AppPool identity is changed to the service account, set the access control lists (ACLs) on the SQL Server database to allow Read access to this new account so that the AD FS 2.0 AppPool can read the policy data.

http://technet.microsoft.com/en-us/library/dd807078(WS.10).aspx

关注博主即可阅读全文