Blackberry PRD-10459-003 Administration Guide - Page 232

Administration Guide Configuring single sign-on authentication for the BlackBerry Administration Service and BlackBerry Web Desktop Manager 4. In the Microsoft Active Directory account properties, on the Delegation tab, add BASPLUGIN111/ to the list of services. After you finish: For more information about configuring constrained delegation for the Microsoft Active Directory account so you can access the BlackBerry Administration Service, visit www.blackberry.com/btsc to read article KB22717. Turn on single sign-on authentication for the BlackBerry Administration Service 1. In the BlackBerry® Administration Service, on the Servers and components menu, expand BlackBerry Solution topology > BlackBerry Domain > Component view. 2. Click BlackBerry Administration Service. 3. On the Microsoft® Active Directory® authentication tab, click Edit component. 4. In the Login domain section, in the Single sign-on authentication for BlackBerry Administration Service turned on drop-down list, click Yes. 5. To configure the Microsoft® Active Directory® account for each forest, in the Account forest name section, type the user domain name, user name, and password for the Microsoft Active Directory account. 6. Click Save all. 7. In the Windows® Services, restart all of the BlackBerry® Enterprise Server services. 8. Instruct all administrators and device users to add the web addresses for the BlackBerry Administration Service and BlackBerry® Web Desktop Manager to the list of web sites in the local intranet zone and install the certificate for the BlackBerry Administration Service or BlackBerry Web Desktop Manager in the certificate store of their computers. BlackBerry Administration Service web addresses and BlackBerry Web Desktop Manager web addresses that support BlackBerry Administration Service single sign-on If you configure BlackBerry® Administration Service single sign-on, you must instruct administrators and BlackBerry® Web Desktop Manager users to access the BlackBerry Administration Service console and BlackBerry Web Desktop Manager using the following web addresses: • https:///webconsole/login • https:///webdesktop/login Single-sign authentication takes precedence over other authentication methods that permit administrators and users to log in to the BlackBerry Administration Service console or BlackBerry Web Desktop Manager. If the security policies in your organization require that administrators or users use another authentication method, you must instruct administrators or users to access the BlackBerry Administration Service console or BlackBerry Web Desktop Manager using the following web addresses: • https:///webconsole/app • https:///webdesktop/app 230