Blackberry PRD-10459-016 User Guide - Page 315

Administration Guide Managing how users access enterprise applications and web content Configuring the Microsoft Active Directory account to delegate access Prerequisites: Configuring the Microsoft Active Directory account to delegate access to an intranet site • Verify that you configured Integrated Windows authentication for the application server that hosts the intranet site. • Verify that the application server that hosts the intranet site and the web application that runs on the application server support Kerberos authentication. • Verify that you have permission to update the Microsoft Active Directory account in Microsoft Active Directory. • Verify that you have access to the Windows Server setspn tool that is included with the Windows Server Support Tools. For more information about the setspn tool, visit http://technet.microsoft.com to read Setspn Overview. • If you did not configure a Microsoft Active Directory account to delegate access to an intranet site or shared folder, in Microsoft Active Directory, you must create a Microsoft Active Directory account that should have the following conditions: • a password that meets the security requirements of your organization • the user is not required to change their password the next time that the user logs in • the user's password never expires • If you configured a pool of application servers to host the intranet site, and the pool is running on Microsoft IIS and is located behind a load balancer, specify a user account (also known as the identity) for the pool that hosts the intranet site. For more information, see http://technet.microsoft.com/en-us/library/cc771170(WS.10).aspx. Configure the Microsoft Active Directory account to delegate access to an intranet site You are required to have only one Microsoft Active Directory account in each Microsoft Active Directory domain that includes the resources that you want to turn on Integrated Windows authentication for. For more information about configuring the Microsoft Active Directory account using setspn and Microsoft Active Directory, visit www.blackberry.com/btsc to read article KB22726. 1. If a pool of application servers host a intranet site and the pool is running on Microsoft IIS and is located behind a load-balancer, use setspn or ADSI to add the SPNs of the intranet site to the user account (also known as the identity) of the pool. You must configure the SPNs using the FQDN and the name of the intranet site that users type into their browsers (for example, if users type http://intranet_site in their browsers, the name of the intranet site is intranet_site). 315