Blackberry PRD-10459-003 Administration Guide - Page 270

Administration Guide Configuring Integrated Windows authentication so that users can access resources on your organization's network 6. Select the HTTP service type for the user account or application server that you specified. 7. Repeat steps 1 to 6 for each intranet site that you want to turn on integrated Windows authentication for. After you finish: • If required, configure BlackBerry® MDS Connection Service to use a Microsoft Active Directory account when the messaging server is in a remote Microsoft Active Directory domain. • Turn on Integrated Windows authentication when users access resources on your organization's network. Prerequisites: Configuring the Microsoft Active Directory account to delegate access to a shared folder • Verify that you configured Integrated Windows® authentication for the file server that hosts the shared folders. • Verify that you have permission to update the Microsoft® Active Directory® account in Microsoft Active Directory. • Verify that you have access to the Windows Server® setspn tool that is included with the Windows Server Support Tools. For more information about the setspn tool, visit http://technet.microsoft.com to read Setspn Overview. • If you did not configure a Microsoft Active Directory account to delegate access to an intranet site or shared folder, in Microsoft Active Directory, you must create a Microsoft Active Directory account that should have the following conditions: • the password meets the security requirements of your organization • the user is not required to change their password the next time that the user logs in • the user's password never expires Configure the Microsoft Active Directory account to delegate access to a shared folder You are required to have only one Microsoft® Active Directory® account in each Microsoft Active Directory domain that includes the resources that you want to turn on Integrated Windows® authentication for. For more information about configuring the Microsoft Active Directory account using setspn and Microsoft Active Directory, visit www.blackberry.com/btsc to read article KB22726. 1. In Microsoft Active Directory, in the Microsoft Active Directory account properties, if the Delegation tab does not display, update the default HOST SPN registrations for the Microsoft Active Directory account. 2. In the Microsoft Active Directory account properties, on the Delegation tab, configure the following settings: • trust this user for delegation to specified services only • use any authentication protocol 3. Click Add. 4. Select the the file server that hosts the shared folder. 5. Select the CIFS service type for the file server that you specified. 6. Repeat steps 3 to 5 for each shared folder that you want to turn on Integrated Windows authentication for. After you finish: 268