Prerequisites

Port 88 on the

Active Directory

service must be accessible by all

BlackBerry UEM

servers.

The

Kerberos

environment must include the following components:

Microsoft Active Directory

server: The directory service that authenticates and authorizes all users and computers associated with your

Windows

network

Kerberos

Key Distribution Center (KDC): The authentication service on the

Active Directory

server that supplies session tickets and keys to users and computers in the

Active Directory

domain

Create service principal names (SPN) for all HTTP services (including

BlackBerry Enterprise Mobility Server

and other services). You must set an SPN for every target resource you want devices to have access to. For example:

 setspn –S HTTP/SPHOST.FQDN:PORT domain\AppPoolUser

For more information on how to create and modify SPNs, see docs.microsoft.com to read "Register a Service Principal Name for Kerberos Connections". SPNs should be configured by the owners of the app servers or the

Active Directory

server.

For multi-realm

Kerberos

environments:

A minimum of one

BlackBerry UEM Core

server must be installed in each

Kerberos

realm.

BlackBerry UEM

must reside in the same

Kerberos

realm as the resource because cross-realm resource delegation is not supported.

Ensure that single-realm KCD is working before configuring multi-realm KCD.

All trusts must be bidirectional, transitive forest trust.

Ensure a maximum of 5 ms latency between the

BlackBerry UEM Core

servers and the

Microsoft SQL Server

database. For more information see the BlackBerry UEM hardware requirements.

Section:

Configuring Kerberos for BlackBerry Dynamics apps