SECURITY

Setting up the Windows service for Domino
To enable an IBM® Lotus® Domino® server to participate in Windows® single sign-on for Web clients, an Active Directory administrator must use the Active Directory setspn utility to assign at least one service principal name (SPN) for the server to an Active Directory account. SPNs correspond to DNS names in server URLs (for example, www.renovations.com) that Web clients use to connect to the Domino server.

An SPN is a required part of the Domino server's identity in the Active Directory domain and is formatted as follows:

HTTP/<DNS_name>@<Active_Directory_Kerberos_realm>

For example:

HTTP/www.renovations.com@AD.EAST.RENOVATIONS.COM

When you assign an SPN, you are telling the Windows Kerberos Key Distribution Center (KDC) that Kerberos service tickets can be issued to Domino. On behalf of the Web user, a Web browser client can then send a Kerberos service ticket to Domino which is used to authenticate the Web user.

You must assign an SPN for each DNS name found in a URL used to connect to a Domino server. The following steps demonstrate how an SPN is used during the process of authenticating a Web user in a Windows single sign-on environment:

1. A Web user enters a URL in a browser to connect to a Domino server participating in Windows single sign-on.


2. The Web browser extracts the DNS name contained in the URL and constructs an SPN from it.
3. The Web browser requests a service ticket for the SPN from Active Directory.

4. The Web browser receives the service ticket and sends it to the Domino server.

5. The Domino server accepts the service ticket and authenticates the user.

Steps to set up the Windows service for Domino server

1. Decide which Active Directory account to assign the SPNs to.

2. Assign the SPNs to the account. Optionally use the domspnego.cmd utility provided with Domino to help with this step.

3. Verify that the Domino server Windows service is logged on under the account.

Related topics