User guide

Protecting your organization’s resources
when you configure BlackBerry
Administration Service single sign-on
You can configure the BlackBerry Administration Service so that administrators or BlackBerry Web Desktop Manager users
must log in to the BlackBerry Administration Service console or BlackBerry Web Desktop Manager using Microsoft Active
Directory authentication. If you configure the BlackBerry Administration Service to support Microsoft Active Directory
authentication in BlackBerry Enterprise Server 5.0 SP2, you can also configure single sign-on so that administrators or
users can access the BlackBerry Administration Service console or BlackBerry Web Desktop Manager directly without
logging in.
If you configure single sign-on, the BlackBerry Administration Service uses the Kerberos protocol and constrained
delegation to help protect your organization’s environment and authenticate and authorize administrators and users. The
Kerberos protocol is designed to permit the BlackBerry Administration Service to verify administrator accounts and user
accounts in
Microsoft Active Directory. Constrained delegation is designed to limit the resources that the BlackBerry
Administration Service
can provide authenticated administrators and users access to.
Architecture: BlackBerry Administration Service single
sign-on
Security Technical Overview Protecting communications in your organization's environment
98