從 linux 建構伺服器創建 SPN

我正在設置一個程序，它將自動為新公開的服務 URL 創建 SPN。我知道如何使用具有正確權限的 setspn -A 命令在 Windows 上創建 SPN。

由於我的建構伺服器在 Linux 上執行，我想知道，除了登錄到 Windows 伺服器並執行 setspn 之外，還有什麼方法可以從 Linux 伺服器創建 SPN？

使用該setspn工具時，您所做的只是修改 AD 中指定電腦/使用者的servicePrincipalName屬性。

要在 Linux 機器上執行相同的操作，您只需使用 LDAP 工具連接到域控制器並像其他任何操作一樣修改屬性。請記住，它是一個多值屬性。因此，不要意外清除目標上可能存在的現有條目。

用於 Windows 遠端管理 (WinRM) 的 Python 庫將允許您從 Linux 機器在 Windows 機器上執行遠端命令

pywinrm 是一個用於 Windows 遠端管理 (WinRM) 的 Python 客戶端。這允許您從任何可以執行 Python 的機器呼叫目標 Windows 機器上的命令。

https://blogs.technet.microsoft.com/heyscriptingguy/2015/10/27/using-winrm-on-linux/

https://github.com/diyan/pywinrm

我不認為有用於在 Active Directory 中註冊 SPN 的 Linux 工具。根據您的應用程序及其設置方式，您可以委託服務帳戶註冊 SPN。

Open Active Directory Users and Computers.

To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then press ENTER.

Click View, and verify that the Advanced Features check box is selected.

Click Advanced Features, if it is not selected.

If the domain to which you want to allow a disjoint namespace does not appear in the console, take the following steps:

   In the console tree, right-click Active Directory Users and Computers, and then click Connect to Domain.

   In the Domain box, type the name of the Active Directory domain to which you want to allow the disjoint namespace, and then click OK.

   As an alternative, you can use the Browse button to locate the Active Directory domain.

In the console tree, right-click the node that represents the domain to which you want to allow a disjoint namespace, and then click Properties.

On Security tab, click Advanced.

On the Permissions tab, click Add.

In Enter the object name to select, type the group or user account name to which you want to delegate permission, and then click OK.

Configure the Apply onto box for Computer objects.

At the bottom of the Permissions box, select the Allow check box that corresponds to the Validated write to service principal name permissions, and then click OK on the three open dialog boxes to confirm your changes.

Close Active Directory Users and Computers.

引用自：https://serverfault.com/questions/770744