When the RoleTailored client, Microsoft Dynamics NAV Server, and SQL Server are all installed on separate computers, the client interacts with the database through an intermediate computer, which is running Microsoft Dynamics NAV Server. The server is performing actions on the client's behalf. This process is known as impersonation.
Delegation is when a front-end service forwards a client request to a back-end service so that the back-end service can also impersonate the client. Impersonation is typically used to check whether a client is authorized to perform a particular action, while delegation is a way of flowing impersonation capabilities, along with the client’s identity, to a back-end service. You can use delegation as a Windows domain feature with Kerberos-based authentication.
As a domain administrator, you must perform the following tasks to enable delegation within the three-tier RoleTailored architecture for configurations where the RoleTailored client, Microsoft Dynamics NAV Server, and SQL Server are all on separate computers:
-
Creating service principal names
-
Delegating access to the SQL Server service
Creating Service Principal Names
The first step in setting up delegation is to create any necessary service principal names (SPNs). To make delegation more secure, Active Directory uses Kerberos to authenticate services. An SPN is the name by which a client uniquely identifies an instance of a service, using the account under which the service runs. To make delegation work, you must explicitly create an SPN when either the Microsoft Dynamics NAV Server service or the SQL Server service is running under a dedicated domain user account. We recommend using this configuration for the highest security. If both services are running under dedicated domain user accounts or under the same dedicated domain user account, you must create one SPN for each service.
.gif) Note |
|---|
|
You must have the setspn command-line tool installed on your server. In Windows Server 2008, the setspn tool is included if you have installed the Active Directory Domain Services server role. In Windows Server 2003, you must download the Windows Server 2003 Service Pack 2 32-bit Support Tools to get the setspn tool.
|
To create a service principal name
-
Open an elevated command prompt. Click Start, and in the search window, type Command Prompt.
-
Right-click Command Prompt, and then click Run as administrator.
-
At the command prompt, create the SPN. The syntax is:
setspn -A InstanceName/FullyQualifiedDomainNameOfServer:Port Domain \User
See Walkthrough: Installing the Three Tiers on Three Computers for an example of how to create SPNs when deploying Microsoft Dynamics NAV.
Delegating Access to the SQL Server Service
Configuring delegation means explicitly configuring the Microsoft Dynamics NAV Server service to delegate its access to the database server on behalf of the RoleTailored client. To make the access more secure, you specify delegation to a specific service on a specific server.
To delegate access to the SQL Server service
-
On any server computer in the domain, click Start, and then click Run.
-
In the Open field, type dsa.msc.
This opens the Active Directory Users and Computers utility.
-
For you to configure delegation, the functional level for the domain must be Windows Server 2003 or higher. To verify the domain functional level, right-click the node for the domain where you have installed Microsoft Dynamics NAV, and then click Raise Domain Functional Level. If the level is not at least Windows Server 2003, then raise it to that level.
-
Right-click the node for the domain where you have installed Microsoft Dynamics NAV, and then click Find.
-
In the Find Users, Contacts, and Group dialog box, type the name of the domain user in the Name field, and then press ENTER.
-
In the Search results area, right-click the domain user, and then click Properties.
-
On the Delegation tab, click Trust this user for delegation to specified services only, and then click Use Kerberos only.
-
Click Add to open the Add Services dialog box.
-
In the Add Services window, click Users or Computers, and then type the name of the domain user.
-
In the list of services for the domain user, click MSSQLSvc, which is the name of the SQL Server service.
-
Click OK to exit the Add Services dialog box.
-
Click OK to close all open dialog boxes.
See Also