Administration Guide

Local Navigation

Configuring Microsoft Active Directory authentication in an environment that includes a resource forest

If your organization's environment includes a resource forest that is dedicated to running Microsoft® Exchange, you can configure the BlackBerry® Administration Service to use Microsoft® Active Directory® authentication to log in BlackBerry device users that have user accounts that are located in trusted account forests. The BlackBerry Administration Service can use Microsoft Active Directory authentication to log users into the BlackBerry Administration Service console and the BlackBerry® Web Desktop Manager.

You must install the BlackBerry® Enterprise Server Express in the resource forest if a resource forest exists in your organization's environment. In the resource forest, you create a mailbox for each user account and associate the mailboxes with the user accounts that are located in the account forests. When you associate the mailboxes in the resource forest with the user accounts in the account forests, the user accounts obtain full access to the mailboxes and the user accounts in the account forests are connected to the Microsoft Exchange server.

To authenticate users who log in to the BlackBerry Administration Service or BlackBerry Web Desktop Manager, the BlackBerry Administration Service must read the user information that is stored in the global catalog servers that are part of the resource forest. To configure the BlackBerry Administration Service to authenticate user accounts that are associated with mailboxes in the resource forest, you must create a Microsoft Active Directory account for the BlackBerry Administration Service that is located in a Windows® domain that is part of the resource forest. During the BlackBerry Enterprise Server Express installation process, you provide the Windows domain, user name, and password for the Microsoft Active Directory account, and, if required, the names of the global catalog servers that the BlackBerry Administration Service can use. You can change the Windows domain, user name, and password for the Microsoft Active Directory account and global catalog servers after the installation process completes.

For more information, visit technet.microsoft.com to read Using a Dedicated Exchange forest.

Change the information for Microsoft Active Directory authentication

Before you begin:
  • Create a Microsoft® Active Directory® account for the BlackBerry® Administration Service that is located in a Windows® domain that is a part of the resource forest. When you create the account, specify a password that meets the security requirements of your organization and configure the following password settings:
    • the user is not required to change the password at next login
    • the user's password never expires
  1. In the BlackBerry Administration Service, expand BlackBerry solution topology > BlackBerry Domain > Component view.
  2. Click BlackBerry Administration Service.
  3. On the Microsoft® Active Directory® authentication tab, click Edit component.
  4. In the User name field, type the name for the Microsoft Active Directory account that has permission to access the user containers and read the user objects that are stored in the global catalog servers that are located in the resource forest.
  5. In the Password field and Confirm Password field, type the password for the Microsoft Active Directory account.
  6. In the User domain field, type the name of the Windows domain that is a part of the resource forest.
  7. In the Global Catalog search base field, perform one of the following actions:
    • To permit the BlackBerry Administration Service to search the global catalog, leave the Global Catalog search base field blank.
    • To control which user accounts the BlackBerry Administration Service can authenticate with, type the distinguished name of the user container (for example, OU=sales,DC=example,DC=com).
  8. If you want the BlackBerry Administration Service to find all of the global catalog servers in the resource forest automatically, in the Global Catalog server discovery drop-down list, click Automatic.
  9. If you want to configure which global catalog servers the BlackBerry Administration Service can access, in the Global Catalog server discovery drop-down list, click Select server from the list below and perform the following actions:
    1. In the Global Catalog server section, type the FQDN of the global catalog server that you want the BlackBerry Administration Service to access (for example, globalcatalog01.example.com). You must type the FQDN of a global catalog server that is located in the Windows domain that the Microsoft Active Directory account located in.
    2. Click the Add icon.
    3. Perform this step for each global catalog server that you want the BlackBerry Administration Service to access.
  10. Click Save All.
The BlackBerry Administration Service validates the information for Microsoft Active Directory authentication. If the information is valid, the BlackBerry Administration Service implements the changes immediately and you do not need to restart the BlackBerry Administration Service services. If the information is invalid, the BlackBerry Administration Service prompts you to specify correct information.

Was this information helpful? Send us your comments.