FIM Service Account
On a domain cotnroller where the FIM Solution is installed, open an administrative command-prompt by right clicking on command prompt and selecting Run As Administrator Type: setspn -S FIMService/<alias> <Domain Name>\<FIM Service Account Name> ( e.g. setspn -s FIMService/myfimservicemachine DOMAINA\svcFimService ) <alias>: This is what you entered during the installation of the FIM Service and Portal to reference the FIM Web Service Name of the machine running the FIM Service DNS: CNAME DNS: Host (A) Record Network Load Balancing (NLB): The name of the cluster <Domain Name>: NETBIOS name of the domain that the FIM Solution has been installed <FIM Service Account Name>: sAMAccountName of the FIM Service Account (*NOTE: Remember, the FIM Service Account needs to be a domain name.) If you are using several different names - for instance, fully qualifiedd domain names (FQDN) and NETBIOS names - to contact the server, repeat Step 2 for every name.
If you are using several different names - for instance, fully qualifiedd domain names (FQDN) and NETBIOS names - to contact the server, repeat Step 2 for every name.
FIM SHAREPOINT SERVICE ACCOUNT ( For the FIM Portal Server )
If the address that the clients use to contact the FIM Portal is not the same as the server address, you have to establish an SPN for HTTP. That is, if you use a CNAME resource record in DNS, have a SharePoint farm, or use NLB, this address must be registered or Internet Explorer cannot use the Kerberos protocol when it contacts the portal. Run the following command:
*NOTE: If the account running the SharePoint - 80 Application Pool account is Network Service, then the SharePoint Service Account should be the computer account that SharePoint Services 3.0 and the FIM Portal are running. If you are using several different names - for instance, fully qualifiedd domain names (FQDN) and NETBIOS names - to contact the server, repeat Step 2 for every name.
*NOTE: If the account running the SharePoint - 80 Application Pool account is Network Service, then the SharePoint Service Account should be the computer account that SharePoint Services 3.0 and the FIM Portal are running.
ENSURING SPNs LOOK CORRECT
Here, our goal is to validate that the SPNs entered for the FIM Solution have been entered correctly. We will be utilizing the SETSPN.EXE utility to be able to view this information. On a domain cotnroller where the FIM Solution is installed, open an administrative command-prompt by right clicking on command prompt and selecting Run As Administrator Type: setspn -l <domain name>\<FIM Service Account Name> and press the ENTER key ( e.g. setspn -l DOMAINA\myfimserviceaccount ) Type: setspn -l <domain name>\<SharePoint Service Account> and press the ENTER key ( e.g. setspn -l DOMAINA\mysharepointserviceaccount ) *NOTE: If the account running the SharePoint - 80 Application Pool account is Network Service, then the SharePoint Service Account should be the computer account that SharePoint Services 3.0 and the FIM Portal are running.
Here, our goal is to validate that the SPNs entered for the FIM Solution have been entered correctly. We will be utilizing the SETSPN.EXE utility to be able to view this information.
On a domain cotnroller where the FIM Solution is installed, open an administrative command-prompt by right clicking on command prompt and selecting Run As Administrator
CHECKING FOR DUPLICATE SPNs
Here, our goal is to validate that we do not have a duplicate SPN concerning the SPNs entered for the FIM Solution. We will be utilizing the SETSPN.EXE utility ( view the Parameters section ) to be able to view this information. On a domain cotnroller where the FIM Solution is installed, open an administrative command-prompt by right clicking on command prompt and selecting Run As Administrator Type: setspn -x and then press the ENTER key
Here, our goal is to validate that we do not have a duplicate SPN concerning the SPNs entered for the FIM Solution. We will be utilizing the SETSPN.EXE utility ( view the Parameters section ) to be able to view this information.
Fernando Lugão Veltem edited Original. Comment: added bold in title