Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.21
  3. UEM Configuration Guide
  4. Configuring network communication and properties for BlackBerry Dynamics apps
  5. Configuring Kerberos authentication for BlackBerry Dynamics apps
  6. Prerequisites for configuring KCD for BlackBerry Dynamics apps

Prerequisites for configuring KCD for
BlackBerry Dynamics
 apps

Item
Description
Active Directory
 port
Port 88 on the
Active Directory
 service must be accessible by all
UEM
 servers.
Kerberos
 environment
The
Kerberos
 environment must include the following components:
  • Microsoft Active Directory
     server: The directory service that authenticates and authorizes all users and computers associated with your
    Windows
     network.
  • Kerberos
     Key Distribution Center (KDC): The authentication service on the
    Active Directory
     server that supplies session tickets and keys to users and computers in the
    Active Directory
     domain.
  • To use KCD with
    Microsoft 365
     resources, the on-premises
    Active Directory
     domain must be integrated with
    Entra
    . For more information, see the Microsoft article "Integrate on-premises AD with Entra".
krb5.conf file
Your
UEM
 environment requires a krb5.conf file with values specific to your KDC. It must include the following minimum settings:
RC4 encryption:
[libdefaults]
    allow_weak_crypto = true
    forwardable = true
AES Keytab file:
[libdefaults]
    forwardable = true
If you use an AES Keytab file, you must create the file with an AES flag of
/crypto AES256-SHA1
:
ktpass /out outfilename.keytab /mapuser kerberos_account@REALM_IN_ALL_CAPS /princ kerberos_account@REALM_IN_ALL_CAPS /pass kerberos_account_password /ptype KRB5_NT_PRINCIPAL /crypto AES256-SHA1
You must specify the location of the krb5.conf file in Settings > BlackBerry Dynamics > Properties (see Configure KCD for BlackBerry Dynamics apps). For more information about constructing a krb5.conf file, see the MIT Kerberos Documentation.
Service Principal Names (SPN)
Create SPNs for all HTTP services, including the
BlackBerry Enterprise Mobility Server
. You must set an SPN for every target resource you want devices to have access to.
For more information about how to create and modify SPNs, see Register a Service Principal Name for Kerberos Connections.
Multi-realm
Kerberos
 environments
  • A minimum of one
    UEM Core
     must be installed in each
    Kerberos
     realm.
    UEM
     must reside in the same
    Kerberos
     realm as the resource because cross-realm resource delegation is not supported.
  • Ensure that single-realm KCD is working before configuring multi-realm KCD.
  • All trusts must be bidirectional, transitive forest trust.
  • Ensure a maximum of 5 ms latency between the
    UEM Core
     instances and the
    Microsoft SQL Server
     database.
If you upgrade from
UEM
 version 12.19 or earlier to
UEM
 12.20 or later, you must do the following:
  1. Generate a new
    Kerberos
     keytab file and copy it to each
    UEM
     server (see step 2 in Configure KCD for BlackBerry Dynamics apps).
  2. In Settings > BlackBerry Dynamics > Properties, in the Service account name under which KCD service is running (gc.krb5.principal.name) field, specify the following: 
    GCSvc/<UEM_Core_host_machine>