
Access Control 38
Set up SPN for Power Center service in all involved AD domain controllers. In
the example, three domains are involved: dcm.dell.com, east.dcm.dell.com
and west.dcm.dell.com. Repeat the following steps on each domain.
1
Log into the AD domain controller as an Administrator.
2
Open a command console.
3
Add two SPNs for Power Center:
• If it is on the Default Realm (configured in Step 1), the user account
associated with the service SPN must be the Power Center server’s
domain account for Kerberos SSO configured in Step 1. For example,
setspn -a HTTP/server1.east.dcm.dell.com Jerry
setspn -a HTTP/server1 Jerry
• If it is not on the Default Realm, for example, it is on dcm.dell.com,
the user account associated with the service SPN must be a domain
user account in the current domain. For example, Jack is a domain
user in dcm.dell.com. Use the following commands to create service
SPN on the dcm.dell.com domain controller.
setspn -a HTTP/server1.east.dcm.dell.com Jack
setspn -a HTTP/server1 Jack
Step 3. Configure Web browser
You must configure your Web browser to support SSO. For more information
on the configuration, see step 3 of "Single Domain Environment" in this
chapter.
Windows NT LAN Manager (NTLM) Authentication Limitation
Power Center supports Kerberos SSO for Windows domain user
authentication. To enable this feature, Power Center is configured to support
the Windows integrated authentication option which includes two
authentication mechanisms: Kerberos and NTLM .
NTLM is not supported in Power Center. If the client’s Web browser uses
NTLM to authenticate domain users for Power Center, there are some
limitations.
OpenManagePowerCenter_User_Guide.book Page 38 Friday, March 2, 2012 10:33 AM
Comentarios a estos manuales