我正在设置一个过程，该过程将自动为新公开的服务 URL 创建 SPN。我知道如何利用具有正确权限的 setspn -A 命令在 Windows 中创建 SPN。
由于我的构建服务器在 Linux 上运行，我想知道，除了登录到 Windows 服务器并运行 setspn 之外，还有其他方法可以从 Linux 服务器创建 SPN 吗？
答案1
当你使用该setspn工具时，你所做的就是修改服务主体名称AD 中指定计算机/用户的属性。
要在 Linux 机器上执行相同操作，您只需使用 LDAP 工具连接到域控制器并像修改其他属性一样修改该属性。但请记住，这是一个多值属性。因此，不要意外删除目标上可能存在的现有条目。
答案2
Windows 远程管理的 Python 库（WinRM）可让您从 Linux 计算机在 Windows 计算机上运行远程命令
pywinrm 是 Windows 远程管理 (WinRM) 的 Python 客户端。这允许您从任何可以运行 Python 的机器调用目标 Windows 机器上的命令。
https://blogs.technet.microsoft.com/heyscriptingguy/2015/10/27/using-winrm-on-linux/
https://github.com/diyan/pywinrm
我认为 Linux 上没有可以在 Active Directory 中注册 SPN 的工具。根据您的应用程序及其设置方式，您可以委派服务帐户注册 SPN 的能力。
Open Active Directory Users and Computers.
To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then press ENTER.
Click View, and verify that the Advanced Features check box is selected.
Click Advanced Features, if it is not selected.
If the domain to which you want to allow a disjoint namespace does not appear in the console, take the following steps:
In the console tree, right-click Active Directory Users and Computers, and then click Connect to Domain.
In the Domain box, type the name of the Active Directory domain to which you want to allow the disjoint namespace, and then click OK.
As an alternative, you can use the Browse button to locate the Active Directory domain.
In the console tree, right-click the node that represents the domain to which you want to allow a disjoint namespace, and then click Properties.
On Security tab, click Advanced.
On the Permissions tab, click Add.
In Enter the object name to select, type the group or user account name to which you want to delegate permission, and then click OK.
Configure the Apply onto box for Computer objects.
At the bottom of the Permissions box, select the Allow check box that corresponds to the Validated write to service principal name permissions, and then click OK on the three open dialog boxes to confirm your changes.
Close Active Directory Users and Computers.