BusinessObjects Enterprise Administrator's Guide

Configuring the databases for single sign-on

This section provides information that is specific to setting up single sign-on to SQL Server databases.

See the Platforms.txt file included with your product distribution for a complete list of tested database software and version requirements. For general information and for information about single sign-on to other supported databases, refer to the database vendors support documentation.

Configuring SQL Server for single sign-on

In order for Kerberos single sign-on to work, the machines running SQL Server database must be trusted for delegation. How to set up security delegation varies, depending on whether SQL Server has been configured to run under the LocalSystem account or under a service account:

• If SQL Server is running under the LocalSystem account, no additional configuration is required. SQL Server registers itself when it starts and the system registers the SPN. When SQL Server shuts down, the system automatically un-registers the SPNs for the LocalSystem account.
• If SQL Server is running under a service account, you have to configure to be trusted for delegation.

To run SQL Server under a service account

1. In Active Directory, set up the SQL Server service account for security delegation:
1. Select Start > Programs > Administrative Tools > Active Directory Users and Computers.
2. Right-click the domain account and select Properties.
3. On the Accounts tab, make sure the following options are selected:
• In Windows 2000, ensure that the Account is trusted for delegation option has been selected for the account.
• In Windows 2003, ensure that the following two options have been selected for the account: Trust this user for delegation to specified service only and Use Kerberos only.

  If you are using Windows 2003, you may have to first add a service principal name (SPN) for the domain account.

2. Set the machine running SQL Server as follows:
• Computer is trusted for delegation
1. Click Apply, and then click OK.
3. Add an SPN for the service account of the SQL Server:

setspn -A MSSQLSvc/host:port serviceaccount

Where host:port is the name of the machine running SQL Server and the port that, and serviceaccount is the name of the SQL Server service account.