title: Service mapping for keytabs
body: <p>Say I have a HTTP server that has instances running on machines <code>virt01</code> through <code>virt09</code> which have CNAMEs <code>svc01</code> through <code>svc09</code>. I want to add Kerberos auth to it.</p>
  
  <p>Assume:</p>
  
  <ul>
  <li>I'm on AD domain <code>example.com</code></li>
  <li>My host DNS entries are <code>host@example.com</code></li>
  <li>My Kerberos realm is <code>EXAMPLE.COM</code>, </li>
  </ul>
  
  <p>From answers such as <a href="https://stackoverflow.com/a/22991646/3821009">this</a> one, I figured that the keytab has to contain entries such as:</p>
  
  <pre><code>HTTP/virt01.example.com@EXAMPLE.COM
  ...
  HTTP/virt09.example.com@EXAMPLE.COM
  HTTP/svc01.example.com@EXAMPLE.COM
  ...
  HTTP/svc09.example.com@EXAMPLE.COM
  </code></pre>
  
  <p>in order for browsers and other clients (such as other non-interactive services) to be able to authenticate against the servers. Is the above correct?</p>
  
  <p>If it is, a follow up question is - is there a way to make a "service alias" so to speak, so I can put just one entry in keytab:</p>
  
  <pre><code>HTTP/svc-alias.example.com@EXAMPLE.COM
  </code></pre>
  
  <p>somehow? This in order to be able to move the service to other hosts for example and not have to regen the keytab with a new host and CNAME added. Especially important for local testing. E.g. if this is tested on <code>workstation583</code>, a new keytab entry for that workstation would have to be made, which is really inconvenient.</p>
  
  <p>If not possible, what is the easiest way to manage adding / removing hostnames? How is this done in practice with multi-server deployments to make it manageable?</p>
  
  <p>Any resources answering any of the above are appreciated as well.</p>