MQSeries.net :: View topic - Setup Kerberos in a Load balanced message broker environment

rama91

Hello WMB Gurus,

We have IIB 10.0.0.12 running on Windows Server 2012 R2. We are looking to setup Kerberos -Token based authentication for SOAP services that are exposed to internal/external consumers.

We have around 4 System test servers running on a Same domain. The test servers are not load balanced; can we create a Single User account (Say "IIBTestPrincipal") in Active Directory and map multiple SPN's to this user account and setup the test environments like below.

setspn -A HTTP/server3.somedomain.co.uk@SOMEDOMAIN.CO.UK IIBADPrincipal

setspn -A HTTP/server5.somedomain.co.uk@SOMEDOMAIN.CO.UK IIBADPrincipal

Can somebody please advice/ guide on process for setting the same in load balanced environment.?

We have 4 broker servers load balanced via Netscalar. Can the load balancer perform a kerberos passthrough and broker perform all the kerberos authentication work ? If so should we be creating a SPN on Load balancer Host name and map all the prod servers as alias to that SPN ?

Couldn't find much info from Info center,Any thoughts on the above are much appreciated.

Thank You,
Ram