DNS for BlackBerry UEM and BlackBerry Connectivity Node in separate domains

The

BlackBerry UEM

server and the

BlackBerry Connectivity Node

server are often installed in the same

Kerberos

domain but they do not have to be. You can install the

BlackBerry Connectivity Node

in a DMZ or "sacrificial" workgroup. If you choose this configuration, you must set up some required network configurations, as detailed below.

BlackBerry Dynamics

operates differently between normal

Kerberos

(or

Kerberos

authentication) and

Kerberos

Constrained Delegation (KCD), which affects the network configuration.

In KCD, the

BlackBerry UEM Core

service requests authentication tickets from the ticketing server (the domain controller) on behalf of the client apps.

Kerberos

without constrained delegation, the client apps make the ticketing requests, and the requests pass through the

BlackBerry Proxy

. This means that the

BlackBerry Proxy

must be able to discover the name of the

Kerberos

domain controller (server). In the domain name system (DNS), you must add an SRV record specifying the

Kerberos

service that enables this discovery. This SRV record must be associated with an A or AAAA record, not a CNAME record. The syntax below is for a

Kerberos

domain controller in an internet domain named example.com:

 _kerberos._tcp.example.com. 86400 IN SRV 0 5 88 kerberos.example.com

This points to a server named kerberos.example.com listening on TCP port 88 for

Kerberos

requests. The priority is 0 and the weight is 5.