Kerberos test with Meridian
This article describes how Accruent Engineering tested Meridian in an environment with Kerberos security configured.
We do not implement or configure specific Kerberos support in Meridian, because Kerberos is designed to be transparent to applications running under Windows.
Kerberos was configured for Meridian in the following way:
-
Check which service account is used for the Meridian servers.
-
In the Domain Controller, open Active Directory Users and Computers.
-
Click the service account verified in step 1.
The BCM Service Account Properties dialog opens.
-
Click the Account tab.
-
Select the following options:
- This account supports Kerberos AES 128 bit encryption
-
This account supports Kerberos AES 256 bit encryption
If there are multiple service accounts, select these options for all of them.
-
In Meridian Server (EDM Server and Enterprise Server) and Meridian Client (Meridian/PowerWeb IIS applications, Explorer, Publish Nodes) Hosts, open Local Security Policy.
-
In the left panel, under Security Settings expand Local Policies and open Security Options.
-
In Policy, open Network security: Configure encryption types allowed for Kerberos.
-
In the Local Security Setting tab, select all AES encryption types.
-
To verify the setting is applied, open a command (CMD) window and run a klist tickets command to look out for an AES128 encrypted service ticket.
-
Open IIS Manager.
-
In Application Pools, open BCMeridian.
-
On the Actions panel on the right, click Advanced Settings.
The Advanced Settings dialog opens.
-
Choose one of two options:
-
If you are configuring Kerberos for a domain account, under Process Model, add the service account in Identity.
-
If you are configuring Kerberos for a local account, under Process Model, add LocalSystem in Identity.
-
-
Perform steps 12 – 14 also for BCPowerWeb and BCEnterprise.
-
On each site (BCMeridian, BCPowerWeb, and BCEnterprise), open Authentication.
-
Set Windows Authentication to Enabled. Right click Windows Authentication and select Providers.
The Providers dialog opens.
-
In Enabled Providers, add Negotiate:Kerberos. If there are any other providers, remove them.
-
On each site (BCMeridian, BCPowerWeb, and BCEnterprise), open the Configuration Editor. In the Section, enter system.webServer/security/authentication/windowsAuthentication and hit Enter.
-
Choose one of two options:
-
If you are configuring Kerberos for a domain account:
-
Set useAppPoolCredentials to True.
-
Set useKernelMode to False.
-
-
If you are configuring Kerberos for a local account:
-
Set useAppPoolCredentials to False.
- Set useKernelMode to True.
-
-
-
Open CMD and set spn as Setspn –S HTTP/FQDN_OF_IIS_SERVER domain\username.
-
Log in using Meridian Power, Explorer, or Enterprise Server.
To learn more, see the following articles:
