Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry Enterprise Mobility Server 3.8
  3. Configuring the BlackBerry Docs service
  4. Steps to configure the Docs service in an on-premises environment
  5. Configure the Docs network and security settings
  6. Configuring resource-based Kerberos constrained delegation for the Docs service
  7. Configure resource based Kerberos constrained delegation

Configure resource based
Kerberos
 constrained delegation

You can configure the
Docs
 service with resource-based Kerberos constrained delegation (KCD) to allows users to access resources in the same domain and between domains and forests.
  • Verify that each domain in your environment has one or more Domain Controllers on a computer that is running an operating system that supports
    BEMS
    . For more information, see the BEMS compatibility Matrix.
  • Verify that the account that is used to administer
    Kerberos
     is a member of the local Administrators group and has the Act as part of the Operating System privilege.
  • If you configure resource-based KCD for
    Microsoft SharePoint
    , verify that the
    Microsoft SharePoint
     server uses Integrated Windows Authentication – Negotiate (
    Kerberos
    ) for the authentication provider.
  • Identify the file share servers and
    Microsoft SharePoint
     servers that the
    Docs
     service requires access to.
  1. On the Domain Controller or another computer in your environment, run
    Windows PowerShell
     as an administrator and set up delegation.
    1. To import the ServerManager module, type
      Import-Module ServerManager
      . Press
      Enter
      .
    2. To install the
      Microsoft Active Directory
       module for
      Windows PowerShell
       and the
      Microsoft Active Directory
       Services, type
      Add-WindowsFeature RSAT-AD-PowerShell
      . Press
      Enter
      .
    3. To import the
      Microsoft Active Directory
       module, type
      import-module activedirectory
      . Press
      Enter
      .
  2. In
    Microsoft Internet Information Services
     Manager, on the
    Application Pools
     screen, record the application pool identity for the
    Microsoft SharePoint
     servers in your environment.
  3. If the
    Microsoft SharePoint
     web application is running on a non-default port (the default ports are 80 and 443) or is not running under the network service, create SPNs. Complete one or more of the following tasks:
    If you have multiple
    Microsoft SharePoint
     web applications, you must create an SPN for each web application that is available in the scenarios below.
    Task
    Steps
    Create SPNs for a
    Microsoft SharePoint
     web application running on a non-default port and as a specific user.
    1. Type
      setspn -S HTTP/<
      Sharepoint server name
      >:<
      Sharepoint app port
      > <
      Sharepoint domain
      >\<
      Sharepoint app user
      >
      . Press
      Enter
      .
      • Where <
        Sharepoint server name
        > is the name of the computer hosting the
        Microsoft SharePoint
         web application.
      • Where <
        Sharepoint app port
        > is the port number of the
        Microsoft SharePoint
         web application server.
      • Where <
        Sharepoint domain
        > is the domain where the
        Microsoft SharePoint
         web application server is located. For example, www.example.com.
      • Where <
        Sharepoint app user
        > is the user or service account that is listed in the Identity column in step 2. If the service is set to run as a user, the identity column displays <
        web application server name
        >/<
        username
        >. If the service is set to run as a network, you will see Network service.
    2. Type
      setspn -S HTTP/<
      Sharepoint server FQDN
      >:<
      Sharepoint app port
      > <
      Sharepoint domain
      >\<
      Sharepoint app user
      >
      . Press
      Enter
      .
      Where
      Sharepoint server FQDN
       is the FQDN of the computer hosting the
      Microsoft SharePoint
       web application server.
    Create SPNs for a
    Microsoft SharePoint
     web application running on a default port (80 or 443) and as a specific user.
    1. Type
      setspn -S HTTP/<
      Sharepoint server name
      > <
      Sharepoint domain
      >\<
      Sharepoint app user
      >
      . Press
      Enter
      .
    2. Type
      setspn -S HTTP/<
      Sharepoint server FQDN
      > <
      Sharepoint domain
      >\<
      Sharepoint app user
      >
      . Press
      Enter
      .
    Create SPNs for a
    Microsoft SharePoint
     web application running on a non-default port and under a network service.
    1. Type
      setspn -S HTTP/<
      Sharepoint server name
      >:<
      Sharepoint app port
      > <
      Sharepoint domain
      >\<
      Sharepoint server name
      >
      . Press
      Enter
      .
    2. Type
      setspn -S HTTP/<
      Sharepoint server FQDN
      >:<
      Sharepoint app port
      > <
      Sharepoint domain
      >\<
      Sharepoint server name
      >
      . Press
      Enter
      .
  4. Add the delegation to each file share server in your environment.
    Task
    Steps
    Add the delegation for one computer hosting
    BEMS
    .
    1. Type
      $gems1 = Get-ADComputer -Identity <
      GEMS-SERVER-NAME
      >
      . Press
      Enter
      .
    2. Type
      Set-ADComputer <
      File server name
      > -PrincipalsAllowedToDelegateToAccount $gems
      1. Press
      Enter
      .
    Add the delegation for multiple computers hosting
    BEMS
    .
    1. Type
      $gems1 = Get-ADComputer -Identity <
      GEMS-SERVER1-NAME
      >
      . Press
      Enter
      .
    2. Type
      $gems2 = Get-ADComputer -Identity <
      GEMS-SERVER2-NAME
      >
      . Press
      Enter
      .
      For each additonal
      BEMS
      , increment the $gems
      #
       by one.
    3. Type
      Set-ADComputer <
      File server name
      > -PrincipalsAllowedToDelegateToAccount $gems1,$gems2
      . Press
      Enter
      .
      For each additional
      BEMS
      , add a comma and $gems
      #
       incrementing the # by one.
  5. If you configure the delegation for file share servers in a DFS configuration, add delegations to the name server and the file server. For domain-based DFS, this requires adding delegations for all of the Domain Controllers in the domain. Type
    Set-ADComputer <
    DC-SERVER-NAME
    > -PrincipalsAllowedToDelegateToAccount $gems1
    . Press
    Enter
    .
    • Where <
      DC-SERVER-NAME
      > is the name of the computer hosting the domain controller.
    • Where $gems1 is created in step 4 above.
  6. Add delegation to the
    Microsoft SharePoint
     servers in your environment. Complete one of the following actions:
    • If the application pool identity for
      Microsoft SharePoint
       application is Network Service, type
      Get-ADComputer <
      Sharepoint server name
      > -Properties PrincipalsAllowedToDelegateToAccount
      .
    • If the application pool identity for
      Microsoft SharePoint
       application is a specific domain user, type
      Get-ADUser <
      Sharepoint app user
      > -Properties PrincipalsAllowedToDelegateToAccount
      .
      Where <
      Sharepoint app user
      > is the user name that is listed in the Identity column in step 2.
  7. Press
    Enter
    .
  • To verify the delegation is configured correctly, on the Domain controller or another computer in your environment, run
    Windows PowerShell
     as an administrator and run one of the following commands:
    • If the delegation was set on the server name, type
      Get-ADComputer <
      server_name
      > -Properties PrincipalsAllowedToDelegateToAccount
      .
    • If the delegation was set on the username, type
      Get-ADUser <
      user_name
      > -Properties PrincipalsAllowedToDelegateToAccount
      .
  • To remove the delegation, on the Domain controller or another computer in your environment, run
    Windows PowerShell
     as an administrator and run one of the following commands:
    • To remove the delegation from a server, type
      Set-ADComputer <
      server_name
      > -PrincipalsAllowedToDelegateToAccount $null
      .
      If you have multiple file share or
      Microsoft SharePoint
       servers in your environment, complete this step for each server.
    • To remove the delegation from a user, type
      Set-ADUser <
      user_name
      > -PrincipalsAllowedToDelegateToAccount $null
      .
      If you use different usernames for the
      Microsoft SharePoint
       and file share servers, complete this step for each username.