I'm having an issue with Kerberos authentication to Oracle database. I was able to get the authentication working for one server. But when I had our SysOps create a new keytab for the second server, it incremented the KVNO value thus invalidating the keytab for the first server. Even after having them force the KVNO with the ‘-kvno’ flag, it is still incrementing KVNO. Oracle Support told me that it is ‘best practice’ to have a unique AD service principal for every single Oracle database server. I find that hard to believe. What have other people done? AI suggestions have been to use ‘setspn’ for all the servers and then use just one AD service principal user, and use the ‘-in’, ‘-out’, and ‘-mapop’ flags for the ktpass command to create one keytab file for all of the servers to use. Does that sound reasonable?