Setting up the Windows service for Domino®

To enable a Domino® server to participate in Windows single sign-on for Web clients, an Active Directory administrator must use the Active Directory setspn utility to assign at least one service principal name (SPN) for the server to an Active Directory account. SPNs correspond to DNS names in server URLs (for example, www.renovations.com) that Web clients use to connect to the Domino® server.

About this task

An SPN is a required part of the Domino® server's identity in the Active Directory domain and is formatted as follows:

HTTP/<DNS_name>@<Active_Directory_Kerberos_realm>

For example:

HTTP/www.renovations.com@AD.EAST.RENOVATIONS.COM

When you assign an SPN, you are telling the Windows Kerberos Key Distribution Center (KDC) that Kerberos service tickets can be issued to Domino®. On behalf of the Web user, a Web browser client can then send a Kerberos service ticket to Domino® which is used to authenticate the Web user.

You must assign an SPN for each DNS name found in a URL used to connect to a Domino® server. The following steps demonstrate how an SPN is used during the process of authenticating a Web user in a Windows single sign-on environment:

Procedure

  1. A Web user enters a URL in a browser to connect to a Domino® server participating in Windows single sign-on.

    For example, the user enters the following URL:

    http://www.renovations.com/names.nsf
  2. The Web browser extracts the DNS name contained in the URL and constructs an SPN from it.

    For example, the browser constructs the following SPN:

    HTTP/www.renovations.com@AD.EAST.RENOVATIONS.COM 

    The DNS name is www.renovations.com

    The Active Directory domain that the Domino® server machine belongs to is AD.EAST.RENOVATIONS.COM

  3. The Web browser requests a service ticket for the SPN from Active Directory.
  4. The Web browser receives the service ticket and sends it to the Domino® server.
  5. The Domino® server accepts the service ticket and authenticates the user.

Steps to set up the Windows service for Domino® server

Procedure

  1. Decide which Active Directory account to assign the SPNs to.
  2. Optional: Assign the SPNs to the account. Optionally use the domspnego.cmd utility provided with Domino® to help with this step.
  3. Verify that the Domino® server Windows service is logged on under the account.