To create ServicePrincipalName (SPN) entries for the Federated Authentication domain service account, follow the steps.

To create SPN entries for the domain service account

  1. On a Domain Controller in the domain where Active Roles is installed, log in with Domain Admin credentials to set the following SPNs for the Federated Authentication domain service account, and the delegation settings.

    1. Open the Command Prompt with Administrator privileges and enter each of the following commands one by one:

      setspn -U -S HTTP/ARWebServerName.YourDomain.com YourDomain\ARFederatedAccountName
      setspn -U -S HTTP/ARWebServerName YourDomain\ARFederatedAccountName
      setspn -U -S ArAdminSvc/ARServerName.YourDomain.com YourDomain\ARFederatedAccountName
      setspn -U -S ArAdminSvc/ARServerName YourDomain\ARFederatedAccountName
    2. To confirm that all SPNs are set, run:

      setspn -L YourDomain\ARFederatedAccountName

    3. Close the Command Prompt.