26 providers. Every one implemented.
Twenty service providers and six audit providers. Each row of providers.json drives the same sense, plan, test, execute-or-hand-off pipeline. Filter by platform, by whether the far side holds a keytab, and by whether the provider writes to AD or audits and hands off.
SpnWrite
The provider can register the SPN itself when the caller has AD write rights, behind -WhatIf and -Confirm. Six providers: SQL Engine, SSAS, SSRS, IIS, ADFS, SharePoint. Each has a proof oracle that reads the negotiated mechanism back.
AuditOnly
The provider detects drift between the expected SPN set and AD, then generates a hand-off. Windows auto-registered services (RDP, SMB, WinRM, DNS, Print, Exchange, AD CS, DFS) audit because Windows owns those SPNs. Keytab families audit because the fix is not in AD.
Far side holds a keytab
Java, Linux, Oracle, SAP, appliances, and the keytab-drift audit. Writing the AD-side SPN without regenerating the far-side keytab at the matching KVNO leaves the service broken. These providers emit an operator runbook and never touch a secret. Safety model →