| The following is a procedure for regenerating Kerberos SPNs keytab keys. Environment: - Domain: fortilab.local.
- Host: fpx.fortilab.local.
- Kerberos Service Account: fpx.
- Service Principal: HTTP/fpx.fortilab.local@fortilab.local.
- Verify existing SPN.
Check which SPN is currently registered for the service account. C:\>setspn -L fpx
Registered ServicePrincipalNames for CN=FPX,CN=Users,DC=fortilab,DC=local:
HTTP/fpx.fortilab.local -
Remove the existing SPN. Unregister the SPN before recreating the keytab. C:\>setspn -D HTTP/fpx.fortilab.local@fortilab.local fpx
Unregistering ServicePrincipalNames for CN=FPX,CN=Users,DC=fortilab,DC=local
HTTP/fpx.fortilab.local@fortilab.local
Updated object -
Generate a new keytab. Create a new Kerberos keytab mapped to the service account. C:\>ktpass -princ HTTP/fpx.fortilab.local@fortilab.local -mapuser fpx -pass <password> -crypto all -ptype KRB5_NT_PRINCIPAL -out fpx.keytab
Targeting domain controller: winsvr16.fortilab.local
Successfully mapped HTTP/fpx.fortilab.local to FPX.
Password successfully set!
Key created.
Key created.
Key created.
Key created.
Key created.
Output keytab to fpx.keytab:
Keytab version: 0x502
keysize 65 HTTP/fpx.fortilab.local@fortilab.local ptype 1 (KRB5_NT_PRINCIPAL) vno 8 etype 0x1 (DES-CBC-CRC) keylength 8 (0xd3fb58b607491c7a)
keysize 65 HTTP/fpx.fortilab.local@fortilab.local ptype 1 (KRB5_NT_PRINCIPAL) vno 8 etype 0x3 (DES-CBC-MD5) keylength 8 (0xd3fb58b607491c7a)
keysize 73 HTTP/fpx.fortilab.local@fortilab.local ptype 1 (KRB5_NT_PRINCIPAL) vno 8 etype 0x17 (RC4-HMAC) keylength 16 (0x5fbc3d5fec8206a30f4b6c473d68ae76)
keysize 89 HTTP/fpx.fortilab.local@fortilab.local ptype 1 (KRB5_NT_PRINCIPAL) vno 8 etype 0x12 (AES256-SHA1) keylength 32 (0x790940a03ceb0276aaaaeac72bf1b83cef20d7a000433f9ed6f224c3be57d6c8)
keysize 73 HTTP/fpx.fortilab.local@fortilab.local ptype 1 (KRB5_NT_PRINCIPAL) vno 8 etype 0x11 (AES128-SHA1) keylength 16 (0x5ccbd0bfc4c736a2d55e150862d55f71) -
Convert the keytab to Base64. FortiProxy requires the keytab to be pasted in Base64 format.
C:\>certutil -encode fpx.keytab tmp.b64 && findstr /v /c:- tmp.b64 > fpx.txt
Input Length = 387
Output Length = 590
CertUtil: -encode command completed successfully.
-
Remove whitespace and line breaks. Using Notepad++. Open the Replace dialog (press Ctrl + H).
Select Regular Expression.
In the 'Find what:' box, enter \h*\R.
\h* matches any horizontal whitespace characters (spaces, tabs).
\R matches any newline sequence (e.g., \r\n, \n).
Keep the replace box empty.
Select Replace All. -
Update Keytab in FortiProxy. Update the encoded Keytab string in the FortiProxy configuration. config user krb-keytab
edit "keytab1"
set principal "HTTP/fpx.fortilab.local@fortilab.local"
set ldap-server "Adserver"
set keytab "ENC <BASE64_KEYTAB>"
next
end Related articles: Technical Tip: Configuring FortiProxy Kerberos authentication for explicit proxy Technical Tip: How to debug Kerberos authentication in FortiProxy | 
