Questions on SETSPN syntax and what is required for MANUAL AD auth

Question

I'll preface this by stating that I don't need to do all the extra stuff for Vintela SSO, SSO to database, etc.  I just need to know precisely what is necessary to do to get AD authentication working.  I managed to get it working in XIr2 previously but it's been so long and I'm not 100% sure that everything I wound up doing was absolutely necessary that I wanted to sort it out for good as we look at going to XI 3.1 SP3.
In the XI 3.1 SP3 admin guide, page 503, the SETSPN command which is
used as part of the setup process to establish a service account to
enable AD authentication is outlined as follows:
SETSPN.exe -A <ServiceClass>/<DomainName> <Serviceaccount>
The guide suggests that the <ServiceClass> can be anything you want to
arbitrarily assign. If I choose something other than the
suggested "BOBJCentralMS" value, is there anywhere else I have to
specify this value to allow the service account to function properly?
The guide suggests that the <DomainName> should be the domain name on
which the service account exists however I've seen many posts online which seem to
indicate this <DomainName> should actually be the FQDN of the server
running the CMS service instead of the general domain name.
Clarification there would be very helpful if anyone has some insight.

Answer 1

The CMS account can have an SPN of spaghetti/meatballs, there are no requirements (cept 2 characters on each side of the / I believe). The SPN created should be the value entered in the CMC > Authentication > Windows AD
The account must run the SIA and it therefore must have AD permissions. Now if you are using IIs or client tools you don't even need an SPN. The SPN is for kerberos only which is required for java app servers.
The vintela SSO white paper in the this forums sticky post explains the roles of a service account.
Regards,
Tim