Checking the Kerberos identity mapping

Check the Kerberos identity mapping before enabling WSTEP for users and devices.

The commands below show the configuration state. Do not run ktpass unless you are remediating an SPN or UPN mapping issue.

Verifying the HTTP service SPN

Verify that the RootAD service account has the correct HTTP SPN for your WSTEP URL.

To check the HTTP SPN value:

On a domain controller in the forest root domain, open a Command Prompt as a user with domain administration permissions.
Run the following command.
```
 setspn -L <user>
```
Where <user> is the Kerberos service account in the following format:
- username@domain or domain\username for a domain user account
- machine$@domain or host\FQDN for a computer domain account
Confirm the output includes the expected SPN format.
```
 HTTP/<pkiaas-wstep-url>
```
Where <pkiaas-wstep-url> is the URL of the WSTEP service.

Verify that the RootAD service account has the correct UPN.

To verify the UPN:

Verify that the service account UPN is correct. You can either:
- Open Active Directory Users and Computers and confirm the User logon name for the RootAD service account.
- Start a PowerShell session with the Active Directory module, and run: Get-ADUser <user> -Properties UserPrincipalName | Select-Object SamAccountName,UserPrincipalName.
Confirm that the UPN suffix matches your forest root domain.

Verify that the WSTEP agent can synchronize Kerberos SPN and KVNO values from RootAD.

To verify WSTEP-Kerberos synchronization:

Start or restart the WSTEP agent and review the agent logs.
Confirm the logs show a successful synchronization of Kerberos data from RootAD, including SPN and KVNO.
If validation fails, see Access denied by remote endpoint for remediation steps.