What SPN do I need to set for a net.tcp service?

Question

I have a wcf application hosted in a windows service running a local windows account. Do I need to set an SPN for this account? If so, what's the protocol the SPN needs to be set under? I know how to do this for services over HTTP, but have never done it for net.tcp.

Answer 1

By default (i.e. out of the box) net.tcp services are unsecured and don't perform any authentication at all. So you won't need (and in fact can't) set a service principal name.

If you need to authenticate, then check the net.tcp security modes on MSDN. The best way to understand the different combinations is to experiment!

Answer 2

Change the service account to an AD account and register the SPN's as shown. Use your own service name e.g. fooservice

setspn -A fooservice/servermachinename domain\serviceAccountName
setspn -A fooservice/servermachinename.fullyqualifieddomainname domain\serviceAccountName

In the client config set:

<identity>
    <serviceprincipalname value="fooservice/servermachinename" />
</identity>