[MikeNitsenko]

Summary

Adds a step-by-step PowerShell section to the Kerberos page for Microsoft Entra Domain Services. From a Windows Server machine joined to the managed domain, it creates the keytab account, registers the SPN, generates the keytab with ktpass /pass +rndPass, and uploads it with cube variables set (the same env var the Settings → Power BI upload writes).

Fixes to the existing text, found while testing:

• The generic ktpass example now passes /mapuser CUBE\account. A bare name fails with DsCrackNames returned 0x2 when the account has no display name (e.g., created with New-ADUser).
• ktpass resets the account's password, so each deployment needs its own keytab account; the generic prompt text no longer implies the existing password.
• Windows Server is required: ktpass isn't part of RSAT on Windows 10.
• method=kerberos / method=ntlm log lines only appear with CUBEJS_LOG_LEVEL=trace.

Test plan

• Ran every step end to end on a Windows Server 2019 VM joined to an Entra Domain Services managed domain (RC4 disabled), against a GCP deployment; Power BI Desktop on a domain-joined client connected with Kerberos.
• yarn broken-links reports no new broken links (3 pre-existing ones in api-reference/introduction.mdx and docs.json reproduce without this change).
• Rendered the page with mintlify dev: 6 steps, all code blocks intact.

Merge note

Safe to merge before the CLI release. Until #12395 ships, the Windows cube.exe needs the VC++ runtime, which stock Windows Server doesn't have; the CLI step has a short note with the two commands that install it.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
cubed3	🟢 Ready	View Preview	Oct 23, 2026, 1:19 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[claude]

Claude finished @MikeNitsenko's task in 1m 57s —— View job

---

Ready to merge after the CLI release; one low finding: 0 high, 0 medium, 1 low.

Review details

• Read diff and changed file
• Analyze docs changes
• Resolve/check prior review threads
• Post review

Finding

• Low docs-mintlify/reference/core-data-apis/dax-api/kerberos.mdx:294: the Entra DS walkthrough tells the reader to set the XMLA service account but never creates one. If a synced cloud-only user is used for it, the password-change caveat applies to that account too. Posted inline.

Checked against the repo

• cube variables set <id> KEY=VALUE: matches rust/cube-cli/src/commands/variables.rs. parse_kv splits on the first =, so Base64 = padding in CUBE_XMLA_KRB5_KEYTAB_B64=... is kept.
• cube deployments settings <id> --json: the subcommand exists, and --json is global. The customDomain/autoDomain fields appear in docs-mintlify/api-reference/api.yaml.
• install-cli.ps1 installs to %LOCALAPPDATA%\cube\bin by default, which matches the $env:Path line. It only updates the user PATH for new terminals, so prepending it in the current session is correct.
• cube-keytab-$DeploymentId stays within the 20-character sAMAccountName limit for IDs of up to 8 digits.
• These link targets all exist: /reference/cli#installation, #authentication, /admin/account-billing/api-keys, #cubejs_log_level, and the in-page anchors (#configuration, #obtaining-a-windows-machine, #creating-the-service-accounts, #load-balancer-spn-on-aws, #setting-the-xmla-service-account).
• warn is the documented default for CUBEJS_LOG_LEVEL, so "set it back to warn" is right.
• Secrets: the API key is read with -AsSecureString and kept only in the session's environment. The keytab file is deleted after upload, and the page warns that ktpass prints the keys in hex. I have no concerns here.

Other notes

• User-facing docs requirement: met. This is a docs-only PR.
• Merge order: as the PR body says, wait for a CLI release that includes fix(cube-cli): Link the MSVC runtime statically on Windows #12395. Until then, the "Get the deployment's domain" step fails on a stock Windows Server, which lacks the VC++ runtime.

Review threads

The listing returned 0 of my own threads, so none were resolved or re-affirmed.

[claude]

Claude finished @MikeNitsenko's task in 31s —— View job

---

Ready to merge after the CLI release: 0 high, 0 medium, 0 low.

Review details

• Read diff and changed file
• Analyze docs changes
• Resolve/check prior review threads
• Post review

This round

The last review's only finding was a low one: the walkthrough never said where the XMLA service account comes from. Commit 38f99ae fixes it. docs-mintlify/reference/core-data-apis/dax-api/kerberos.mdx:295 now says to create the account in the same OU or use a synced Entra user. It also extends the password-change caveat to a synced XMLA account. "Same OU" points back to the $OuPath OU created at line 232, and the #creating-the-service-accounts anchor exists.

None of the other checks from the last round changed: CLI commands vs rust/cube-cli, the install path, the sAMAccountName length, link targets and secret handling.

Other notes

• User-facing docs requirement: met, since this is a docs-only PR.
• Merge order: wait for a CLI release that includes fix(cube-cli): Link the MSVC runtime statically on Windows #12395, as the PR body says.

Review threads

The listing returned 0 of my own threads (the last finding was only in the tracking comment), so none were resolved or re-affirmed.

[claude]

Claude finished @MikeNitsenko's task in 1m 1s —— View job

---

Looks good, one wording nit: 0 high, 0 medium, 1 low.

Review details

• Read diff and changed file
• Analyze docs changes
• Resolve/check prior review threads
• Post review

This round

The only new commit is bfa7007, which adds an <Info> about installing the VC++ runtime for older CLI releases on Windows Server.

• Low (docs-mintlify/reference/core-data-apis/dax-api/kerberos.mdx:213): the callout says to check whether cube --version prints nothing, but the block above runs cube deployments list. It also says to "run the commands above again", which reruns the installer and asks for the API key again. Only cube deployments list needs to run again, since the env vars are still set in the session. I posted a suggestion inline.

The vc_redist commands themselves look right: the official aka.ms/vs/17 x64 URL and a silent install with -Wait.

Other notes

• User-facing docs requirement: met, since this is a docs-only PR.
• Merge note: the PR body says to merge only after a CLI release that includes fix(cube-cli): Link the MSVC runtime statically on Windows #12395. The new callout gives readers on older CLI releases a workaround, so the page now works without waiting for that release. Update the merge note if that was the intent.

Review threads

The listing returned 0 of my own threads, so none were resolved or re-affirmed.

[claude]

Claude finished @MikeNitsenko's task in 1m 5s —— View job

---

LGTM: no issues found (0 high, 0 medium, 0 low).

Review details

• Read the diff and the full page
• Check claims against the CLI / settings code
• Review threads
• Post findings

What I checked

• Link targets: /reference/cli#installation and #authentication, /admin/account-billing/api-keys, and /reference/configuration/environment-variables#cubejs_log_level all exist.
• CLI usage:
  • CUBE_API_URL and CUBE_API_KEY match the env vars in docs-mintlify/reference/cli.mdx:940-941.
  • deployments settings and variables set (upsert, so other vars keep their values) are listed in the command reference (cli.mdx:219, cli.mdx:227).
  • install-cli.ps1:20 installs to %LOCALAPPDATA%\cube\bin. It only adds that directory to the user PATH, which a running session doesn't pick up, so prepending it to $env:Path in the same session is needed.
• Consistency with the generic flow:
  • The new /mapuser CUBE\… form matches the setspn example above it.
  • On AWS, pointing to the load balancer SPN without regenerating the keytab agrees with kerberos.mdx:131 (both SPNs share the account key).
  • The per-deployment keytab account warning is consistent with ktpass resetting the password.
• Secrets handling:
  • The API key comes from Read-Host -AsSecureString, so PSReadLine doesn't record it.
  • The keytab travels as $KeytabB64, so history stores the variable name, not the key.
  • The file is removed after upload, and the hex-key warning on the ktpass output is present.
• Comments: # up to 20 characters is load-bearing (sAMAccountName limit; cube-keytab- leaves 8 characters for the ID).
• User-facing docs requirement: not applicable, since this is a docs-only PR.

Minor, not posted inline

• Re-running the walkthrough to rotate the keytab fails at New-ADUser because the account already exists. Steps 4–6 work on their own, so this is self-evident in practice.
• Remove-Item $Keytab runs even if cube variables set fails. That's harmless: re-running ktpass regenerates the keytab.

Review threads

The listing returned 0 of my own threads: no prior threads, none resolved, none re-affirmed.