Keytab File Creation for The Kerberos Authentication in Active Directory

A keytab (key table) file is a way to store long-term keys for one or more Kerberos principals. This tool allows non-Windows services to utilize Kerberos authentication functionality in an Active Directory infrastructure.

To create a keytab file for the Kerberos authentication in the Active Directory:

1. Create a new user profile in the Active Directory with regular user rights. This profile will be used as a service profile for creating the keytab file. Specify a known password for the profile and check the "User cannot change password" and "Password never expires" checkboxes.
2. Create a keytab file using the ktpass command line utility. The utility is available on Windows Server. On workstation operating systems, you may need to install additional components to make the utility available.

Example command for creating a keytab file:

ktpass /mapuser operavix.test.keytab@TEST.OPERAVIX.COM /princ
HTTP/operavix.test.operavix.com@TEST.OPERAVIX.COM /pass
Strong_Pa$$word /crypto All /ptype KRB5_NT_PRINCIPAL /out
c:\operavix.keytab.keytab

Explanation:

• after /mapuser you must specify the UPN (UserPrincipalName) of the newly created service profile. The domain name must be in upper case
• after /princ you must specify the Operavix server address which will be used by users of the system. The address is specified in the same format as in the example with the “HTTP/” prefix. The domain name must be in upper case
• after /pass you must specify the password of the service profile
• after /out you must specify the path where the keytab file will be saved

You can learn more about ktpass on the official site.