Setting up NT Single Sign On

You can configure Crystal Enterprise to allow users to use various Crystal Enterprise applications without being prompted to log on. Users need only to enter their NT user name and password information once at the beginning of the NT session. For instance, if you have set up NT Single Sign On, when you launch the CMC, NT authentication occurs in the background. You are not required to enter any additional information.

Note:    This feature is available if you are using a Microsoft Internet Information Server (IIS) web server and users are using Internet Explorer as their web browser. See the Platforms.txt file included with your product distribution for a complete list of version requirements.

Crystal Enterprise provides its own form of "anonymous Single Sign On," which uses Enterprise authentication, as opposed to Windows NT authentication. Design your own web applications accordingly (or modify the Crystal Enterprise web desktop) if you want to use NT Single Sign On. By default, when a user launches Crystal Enterprise, he or she will be automatically logged on using the Guest account (Enterprise authentication). You can disable this feature—for more information, see Disabling the Sign Up feature. However, even when you disable the Sign Up feature, Crystal Enterprise is designed to display a logon page. With Single Sign On enabled, the user can select Windows NT from the Authentication list and click Log On without entering his or her user name or password. In the developer documentation, refer to the tutorial for an example on creating a web application that uses Single Sign On.

Setting up NT Single Sign On involves two processes:

• Configuring the IIS web server

  Using the documentation included with your IIS server, change the access and authentication settings for the Enterprise virtual directory. Disable the settings for allowing "Anonymous access" and "Basic authentication" options. Ensure that the setting for Windows NT Challenge/Response (also referred to as Integrated Windows authentication) is enabled.

  Note:    Crystal Enterprise does not support the Kerberos protocol.

• Configuring the Web Component Server

  Use the Crystal Configuration Manager (CCM) to configure the Web Component Server.

To configure the Web Component Server using the CCM

1. From the Crystal Enterprise program group, click Crystal Configuration Manager.

   Note:    To use the CCM, you must have NT administrator rights on the local machine. If you are managing servers on a remote machine, you must also have NT administrator rights on the machine you are connecting to. Depending on the configuration of your network, you might be prompted to enter a user name and password.

2. Select the Crystal Web Component Server; then click the Stop button.
3. Either double-click the Crystal Web Component Server or right-click the Crystal Web Component Server and select Properties.
4. Click the Configuration tab.
5. Select the Use Windows NT Integrated security check box.

   

6. Click OK.
7. Restart the Web Component Server by selecting the Crystal Web Component Server and then clicking the Start button.