[MSSQL] SPN, Kerberos 접근 ERROR

 

The target principal name is incorrect.  Cannot generate SSPI context. (Microsoft SQL Server, Error: 0)

SSMS를 통해 host 명으로 Windows 인증으로 접속하려 할 때 위와 같은 에러가 발생하는 경우입니다.

---

 

로그 분석 xp_readerrorlog 로 로그 확인 결과 메세지

The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/xxxxxx ] for the SQL Server service. Windows return code: 0x2098, state: 15. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered. The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/xxxxxx:port] for the SQL Server service. Windows return code: 0x2098, state: 15. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.

 

즉, 서비스를 시작할 때 SPN ( Service Principal Name )을 등록하지 못하였기 때문에 발생하는 오류입니다.

 

 

• 해결 방법

이미 등록된 SPN이 있다면 삭제해주고 새로 SPN을 등록해줍니다.

 

💡 SPN 등록

 - SETSPN -A MSSQLSvc/xxxxx 서비스계정

 - SETSPN -A MSSQLSvc/xxxxx:포트 서비스계정

 

💡 SPN 해제

 - SETSPN -D MSSQLSvc/xxxxx 서비스계정

 - SETSPN -D MSSQLSvc/xxxxx:포트 서비스계정

 

💡 SPN 확인

 - SETSPN -L 서비스계정