Configuring the Microsoft Active Directory account todelegate access

Prerequisites: Configuring the Microsoft Active Directory account to

delegate access to an intranet site

• Verify that you configured Integrated Windows authentication for the application server that hosts the intranet site.
• Verify that the application server that hosts the intranet site and the web application that runs on the application server
support Kerberos authentication.
• Verify that you have permission to update the Microsoft Active Directory account in Microsoft Active Directory.
• Verify that you have access to the Windows Server setspn tool that is included with the Windows Server Support Tools.
For more information about the setspn tool, visit http://technet.microsoft.com to read Setspn Overview.
• If you did not configure a Microsoft Active Directory account to delegate access to an intranet site or shared folder, in
Microsoft Active Directory, you must create a Microsoft Active Directory account that should have the following
conditions:
• a password that meets the security requirements of your organization
• the user is not required to change their password the next time that the user logs in
• the user's password never expires
• If you configured a pool of application servers to host the intranet site, and the pool is running on Microsoft IIS and is
located behind a load balancer, specify a user account (also known as the identity) for the pool that hosts the intranet
site. For more information, see http://technet.microsoft.com/en-us/library/cc771170(WS.10).aspx.

Configure the Microsoft Active Directory account to delegate access to an

intranet site

You are required to have only one Microsoft Active Directory account in each Microsoft Active Directory domain that
includes the resources that you want to turn on Integrated Windows authentication for.
For more information about configuring the Microsoft Active Directory account using setspn and Microsoft Active Directory,
visit www.blackberry.com/btsc to read article KB22726.
1. If a pool of application servers host a intranet site and the pool is running on Microsoft IIS and is located behind a
load-balancer, use setspn or ADSI to add the SPNs of the intranet site to the user account (also known as the identity)
of the pool. You must configure the SPNs using the FQDN and the name of the intranet site that users type into their
browsers (for example, if users type http://intranet_site in their browsers, the name of the intranet site is
intranet_site).
Administration Guide Managing how users access enterprise applications and web content
315