Prerequisites for configuring

Kerberos

for

BlackBerry Dynamics

apps

Port 88 on the

Active Directory

service must be accessible by all

BlackBerry UEM

servers.

The

Kerberos

environment must include the following components:

Microsoft Active Directory
server: The directory service that authenticates and authorizes all users and computers associated with your
Windows
network.
Kerberos
Key Distribution Center (KDC): The authentication service on the
Active Directory
server that supplies session tickets and keys to users and computers in the
Active Directory
domain.

Create service principal names (SPN) for all HTTP services (including

BlackBerry Enterprise Mobility Server

and other services). You must set an SPN for every target resource you want devices to have access to. For example:

 setspn –S HTTP/SPHOST.FQDN:PORT domain\AppPoolUser