KB35492: How to add the port number to the SPN Internet Explorer uses when querying the KDC for a Web Service SPN

When accessing Strategy Web via Internet Explorer using Integrated Authentication (Kerberos) the web browser will query the Key Distribution Center (KDC, Domain Controller) for the SPN of the Web Service being hosted in the Web Server Machine. By default Internet Explorer will construct the SPN with the following format HTTP/ and will omit the port number.
 
If two Web Sites are hosted in the same web server and all that differentiates the two is the port number then integrated authentication will fail since the SPN has to be unique to each service.
 
The following documentation from the Microsoft knowledge base shows how to configure Internet Explorer to add the port number to the SPN query so the format becomes HTTP/
 
http://support.microsoft.com/kb/908209
 
Note that if multiple Web sites are reached by the same URL but on different ports, delegation will not work. To make this work, you must use different hostnames and different SPNs. When Internet Explorer requests either http://www.mywebsite.com or http://www.mywebsite.com:81, Internet Explorer requests a ticket for SPN HTTP/www.mywebsite.com. Internet Explorer doesn't add the port or the vdir to the SPN request. This behavior is the same for http://www.mywebsite.com/app1 or http://www.mywebsite.com/app2. In this scenario, Internet Explorer will request a ticket for SPN http://www.mywebsite.com from the Key Distribution Center (KDC). Each SPN can be declared only for one identity. Therefore, you would also receive a KRB_DUPLICATE_SPN error message if you try to declare this SPN for each identity.
 
 
Post-hotfix installation instructions
 
Note These steps should be applied on the client computer on which you try to open the Web page. 
 
After you install the hotfix, you must add the FEATURE_INCLUDE_PORT_IN_SPN_KB908209 registry key, and then set its DWORD value to iexplore.exe. To do this, follow these steps.
 
 
For 32-bit computers
 
 

1. Click Start, click Run, type regedit, and then click OK.
2. In the left pane, locate and then click the following registry subkey:
3. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl
4. On the Edit menu, point to New, and then click Key.
5. Type FEATURE_INCLUDE_PORT_IN_SPN_KB908209, and then press ENTER.
6. On the Edit menu, point to New, and then click DWORD Value.
7. Type iexplore.exe, and then press ENTER.
8. On the Edit menu, click Modify.
9. Type 1 in the Value data box, and then click OK.
10. Exit Registry Editor.

 
 
 
 
For 64-bit computers
 
 

1. Click Start, click Run, type regedit, and then click OK.
2. In the left pane, locate and then click the following registry subkey:
3. HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl
4. On the Edit menu, point to New, and then click Key.
5. Type FEATURE_INCLUDE_PORT_IN_SPN_KB908209, and then press ENTER.
6. On the Edit menu, point to New, and then click DWORD Value.
7. Type iexplore.exe, and then press ENTER.
8. On the Edit menu, click Modify.
9. Type 1 in the Value data box, and then click OK.
10. Exit Registry Editor.

 
Third Party Software Installation WARNING
 
The third-party product(s) discussed in this technical note is manufactured by vendors independent of Strategy. Strategy makes no warranty, express, implied or otherwise, regarding this product, including its performance or reliability.
 
 
KB35492