Updating the Windows Domain Configuration
To configure FME Server to use single sign-on authentication, the Windows domain must recognize FME Server as a domain service. Three steps are required:
Note: Complete these steps on the Domain Controller.
- Represent FME Server as a domain service by assigning it a service principal name (SPN).
- Register the SPN (or SPNs) to the service account.
-
Ensure that the service account requires Kerberos pre-authentication.
Assigning a Service Principal Name
An SPN has the form: <service>/<host>, where:
<service> is the service type. In the context of FME Server, this is http.
<host> is the name of the machine hosting FME Server's web application server. To provide flexibility, we suggest assigning both the unqualified and fully-qualified versions of the host name.
To obtain the unqualified and fully-qualified versions of the host name:
- From the domain controller, click the Start menu, right-click 'Computer' or 'My Computer' and select 'Properties'.
- For the unqualified host name, refer to 'Computer name'.
- For the fully-qualified host name, refer to 'Full computer name'.
For example, if the unqualified host name is 'fmeserver' and the fully-qualified host name is 'fmeserver.domain.net', the SPNs are:
- http/fmeserver
- http/fmeserver.domain.net
To register an SPN to a service account:
- From the domain controller, open a command prompt (cmd.exe) via the Start menu.
- Type setspn -S <spn> <account> to register the SPN to the service account.
- Ensure that the command succeeded with the message 'Updated object'. If the message 'Unable to locate account ...' appears, the account name is incorrectly specified.
- Repeat until all SPNs are added.
For example, using the SPNs in the previous example, and supposing the service account is 'fmeserveradmin', the following commands would be entered:
setspn -S http/fmeserver fmeserveradmin
setspn -S http/fmeserver.domain.net fmeserveradmin
To ensure that the service account requires Kerberos pre-authentication:
- From the domain controller, open 'Active Directory Users and Computers' via the Start menu.
- In the console tree, navigate to the service account.
- Right-click the service account, and select Properties.
- Select the Account tab.
- Under Account Options, scroll to the bottom and ensure that 'Do not require Kerberos preauthentication' is unchecked.
- Click Ok.