Task 2: Enable service account for Kerberos constrained delegation

This procedure describes how to enable your Windows service account for Kerberos constrained delegation.

1. Log on to the domain controller as a domain administrator (or any computer with Active Directory Users and Computers installed).

2. Open the Active Directory Users and Computers window.

3. In the navigation panel, select Managed Service Accounts.

   A list of service accounts is displayed.

   

4. Find and double-click the service account for PI Integrator for Esri ArcGIS.

   The service Properties dialog box opens.

   

5. Click the Delegation tab.

   

6. Select Trust this user for delegation to specified services only and click Add to enable constrained delegation.

   Note: Ensure you do not select Trust this user for delegation to any service (Kerberos only). This selection enables non-constrained delegation which is not supported with PI Integrator for Esri ArcGIS.

   The Add Services dialog box displays.

   

7. Click OK.

   Your service account is enabled for Kerberos constrained delegation.

Continue to Task 3: Add Portal for ArcGIS server with the HTTP service type. You will start with the Add Services dialog box.