BusinessObjects Enterprise Administrator's Guide

Setting up a service account

To configure BusinessObjects Enterprise for end-to-end single sign-on using Kerberos and Windows AD authentication, you require a service account. This must be a domain account that has been trusted for delegation. You can either create a new domain account or use an existing domain account. The service account will be used to run the BusinessObjects Enterprise servers.

Note:    Instead of a service account, you could use a user or computer domain account. However, it is recommended you use a service account.

To set up the service account

On the domain controller, set up the domain service account. For detailed instructions, refer to http://msdn.microsoft.com.

Note:    The procedure for setting up a domain service account varies, depending on whether you are using Windows 2000 or Windows 2003:

• In Windows 2000, ensure that the Account is trusted for delegation option has been selected for the account.
• In Windows 2003, ensure that the following two options have been selected for the account:
  • Trust this user for delegation to specified service only
  • Use Kerberos only

    If you are using Windows 2003, you may have to first add a service principal name (SPN) for the domain account.