In PPS 2007, per-user authentication was configured
per deployment. In PPS 2010, this setting is configured at a data source
level, so it is possible to mix per-user data sources with data sources
that use the Unattended Service Account.
Kerberos is a protocol
used for authentication. It is used when there is a need for a server
resource, such as PPS, to access another server resource, such as a
database, on behalf of the user. In other words, the server needs to
impersonate and pass along the identity of the calling user.
Before you start
configuring Kerberos, be aware that you need to access the Active
Directory domain controller for some configuration tasks. Therefore, you
might need to involve other people to complete the setup. Make sure
that you have access to all resources necessary before starting the
configuration.
Also, consider configuring
Kerberos in a test or demo environment before doing so in a production
environment. Doing so allows you to get comfortable with the process.
There are several steps involved, as described in the TechNet article
referenced earlier, and if you configure a resource improperly, you risk impacting other non-SharePoint-related resources that are also using Kerberos.
Caution
Windows 2008 has some
issues with Kerberos where it will periodically drop connections with
Analysis Services. To avoid this problem, put Analysis Services on
Windows 2003 or a Windows 2008 R2 machine or apply the hotfix from
Microsoft KB article 969083.
As mentioned
earlier, Kerberos has to be configured properly for per-user
authentication to work properly. The following three steps need to be
performed in this order for per-user authentication to work properly in
farm scenarios:
1. | Create service principal names (SPNs) for the farm and data sources.
|
2. | Enable constrained delegation for computers and service accounts.
|
3. | Configure and start the Claims to Windows Token service.
|
Note
If you have a farm installation, you need to configure Kerberos even if
all components, SharePoint 2010, and data sources are installed on the
same machine. The only scenario in which the default authentication
scheme, NTLM, will work for per-user identity is if you do a standalone
installation.
