Skip Navigation

Prerequisites for configuring KCD for
BlackBerry Dynamics
apps

Item
Description
Active Directory
port
Port 88 on the
Active Directory
service must be accessible by all
UEM
servers.
Kerberos
environment
The
Kerberos
environment must include the following components:
  • Microsoft Active Directory
    server: The directory service that authenticates and authorizes all users and computers associated with your
    Windows
    network.
  • Kerberos
    Key Distribution Center (KDC): The authentication service on the
    Active Directory
    server that supplies session tickets and keys to users and computers in the
    Active Directory
    domain.
Service Principal Names (SPN)
Create SPNs for all HTTP services, including the
BlackBerry Enterprise Mobility Server
. You must set an SPN for every target resource you want devices to have access to.
For more information about how to create and modify SPNs, see Register a Service Principal Name for Kerberos Connections.
Multi-realm
Kerberos
environments
  • A minimum of one
    UEM Core
    must be installed in each
    Kerberos
    realm.
    UEM
    must reside in the same
    Kerberos
    realm as the resource because cross-realm resource delegation is not supported.
  • Ensure that single-realm KCD is working before configuring multi-realm KCD.
  • All trusts must be bidirectional, transitive forest trust.
  • Ensure a maximum of 5 ms latency between the
    UEM Core
    instances and the
    Microsoft SQL Server
    database.