Detent Point

SpnManager Kerberos SPN auditing and repair for Active Directory

Export-JavaSpnegoSpnRunbook

As a manager, you care about the business value of Export-JavaSpnegoSpnRunbook when dealing with Java SPNEGO web SPN gaps. This command is used by the secu...

As a manager, you care about the business value of Export-JavaSpnegoSpnRunbook when dealing with Java SPNEGO web SPN gaps. This command is used by the security team to address audit findings from Get-JavaSpnegoSpnAudit.

  • Business Value: Ensures correct authentication for Java-based applications using SPNEGO
  • Who Uses This:
    • Security Team (responsible for addressing audit findings)
    • DevOps/Infrastructure Teams (involved in application deployment and configuration)
  • Risks:
    • Failure to properly configure SPNEGO may result in unauthorized access or data breaches
    • Incorrect keytab management can lead to authentication failures and downtime
  • When a Manager Cares: When an audit finding is raised, requiring immediate attention to ensure compliance and prevent security risks.

To use Export-JavaSpnegoSpnRunbook effectively:

  1. Run Get-JavaSpnegoSpnAudit to identify potential issues.
  2. Pipe the output from Get-JavaSpnegoSpnAudit into Export-JavaSpnegoSpnRunbook:
Get-JavaSpnegoSpnAudit | Export-JavaSpnegoSpnRunbook
  1. Review and validate the generated setspn bundle, keytab, and JAAS configuration.

Watchpoints:

  • Ensure correct input from Get-JavaSpnegoSpnAudit to avoid incorrect output.
  • Validate generated files for accuracy and completeness.

Export-JavaSpnegoSpnRunbook takes an audit finding as input and produces the necessary AD-side setspn bundle, container-side keytab, and JAAS configuration. To use this command:

  1. Run Get-JavaSpnegoSpnAudit to find potential issues.
  2. Pipe output into Export-JavaSpnegoSpnRunbook to generate required files.
  3. Review and validate generated files for accuracy.

If you’re stuck:

  • Check the audit finding input is correct.
  • Verify generated files match expected outputs.
Field Value
Vendor Detent Point LLC
Product SpnManager 0.4.0
Licence Proprietary - licensed, not sold. See LICENSE.
Operational impact Read-only. Queries Active Directory and reports findings; changes nothing.
Rights required Directory read access. Some providers additionally need rights to read delegation and encryption-type attributes.
Providers covered AD.JavaSpnego
Approval recommendation Approve for general operational use. It cannot alter directory state.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

What Why
Windows PowerShell 5.1 or later Declared by the module manifest.
ActiveDirectory 1.0.0.0 Required module. Ships with RSAT; install the Active Directory PowerShell feature.
A reachable domain controller Every provider reads from Active Directory.
An account with directory read access Needed to enumerate accounts and their SPNs.

Export-JavaSpnegoSpnRunbook does not handle sensitive data directly. However:

  • Input from Get-JavaSpnegoSpnAudit may contain sensitive audit findings.
  • Generated files (setspn bundle, keytab, JAAS configuration) are used to ensure correct authentication and compliance with SPNEGO standards.

Compliance requirements:

  • Ensure proper configuration of SPNEGO in target environment.
  • Validate generated files for accuracy and completeness.
  • Regularly review and update audit findings using Get-JavaSpnegoSpnAudit.

This is the hand-off step. It renders the commands for a human to run; SpnManager does not run them. Providers: AD.JavaSpnego.

Example 1

Get-JavaSpnegoSpnAudit -TargetComputer 'wildfly01.corp.example.test' | Export-JavaSpnegoSpnRunbook

Audits the Java application server and renders the hand-off runbook.

Also uses: Get-JavaSpnegoSpnAudit (Sense).

Example 2

(Get-JavaSpnegoSpnAudit -TargetComputer 'tomcat01.corp.example.test' | Export-JavaSpnegoSpnRunbook).Runbook

Prints the runbook text for pasting into a change ticket.

Also uses: Get-JavaSpnegoSpnAudit (Sense).

Example 3

Get-JavaSpnegoSpnAudit -TargetComputer 'jboss01.corp.example.test' |
    Export-JavaSpnegoSpnRunbook |
    Where-Object { $_.MissingSpns.Count -gt 0 }

Emits nothing when the host is already correct, which is what you want when looping over many application servers and only care about the ones needing work.

Also uses: Get-JavaSpnegoSpnAudit (Sense).