Creating an SPN from a linux build server

I'm not quite sure whether my-user-name refers to a computer object or a user object in active directory; I'll assume it's a user object. In that case, I think setspn is not appropriate; this is meant to modify the SPNs of existing machine accounts. For a user account, I'm skeptical that SRV_HST is right.

Apparently, support for SPNs associated with user objects is somewhat limited; I read somewhere that this is really restricted to one user. I also couldn't manage to get your ktpass invocation to work for me, as it insisted on a) specifying a user account (through mapuser) that should be associated with the SPN, and b) setting the SPN password. I think the latter is unavoidable to create a keytab through ktpass.

I managed to create a keytab in the "standard way", i.e. by setting up a dedicated user account and associating it with an SPN:

ktpass /princ TEST/host@DOMAIN /mapuser user@DOMAIN /pass *  /out foo.keytab /ptype KRB5_NT_PRINCIPAL

That operation (expectly) broke login for the user, however, I was then able to kinit with

 kinit -k -t /tmp/foo.keytab  TEST/host@DOMAIN

Research into how Kerberos delegation works shows that no, you cannot share SPNs between service accounts on the same box.

I solved the problem by provisioning a second IP address for my server and mapping IIS to one IP address and SSRS to the other.

I then created two new A records in DNS (don't use C records, they are unreliable with Kerberos delegation) to point to the services. iis.server.d.com points to the IIS IP address and ssrs.server.d.com points to the SSRS IP.

Lastly, I deleted all the SPNs for both d\acct1 and d\acct2 and reassigned the SPNs as HTTP/iis.server.d.com and HTTP/ssrs.server.d.com respectively.

Additionally, I find that editing SPNs using ADSIEdit far easier than using the setspn command line.