Implement Kerberos authentication in SharePoint 2013

Question

We are building a new SharePoint 2013 environment with Kerberos authentication. I have been looking for a Microsoft provided document which can be considerd for planning this implementation. I am new to Kerberos and so far understood that, I
need to involve a Domain admin along with SharePoint admin to implement this. However I need to provide clear cut steps to both the parties.
Also as this is a development environment we are building, do I need to plan for a hostname, public IP etc ?  
Thanks, Bivsworld

Answer 1

There is a lot of information here:
http://technet.microsoft.com/en-us/library/ee806870(v=office.15).aspx
Most of it boils down to simply this:
Register the SPN to the user account running the service, e.g. the user running the SQL Server service would have the SQL SPN registered:
setspn -A MSSQLSvc/sqlserver.company.com:1433 domain\s-sqlserveruser
setspn -A MSSQLSvc/sqlserver:1433 domain\s-sqlserveruser
For a SharePoint Web Application (regardless if it is SSL or not):
setspn -A HTTP/webAppUrl.company.com domain\s-webapppooluser
And so on. It becomes more complex if you need to implement delegation, or if you have users in multiple domains, or cross forest (as constrained delegation does not work cross-domain, and no type of delegation works cross-forest). In addition, Kerberos
does not work across the Internet (as clients cannot contact the KDC to get a Kerberos ticket).
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.