Configure delegation settings for the domain account under which the PI AF Application Service runs

Follow these steps to configure delegation settings for the domain account under which the AF Server service runs:

1. Ensure you are logged into the domain to which the PI AF Application Service's domain account belongs.

2. From the Start menu, type dsa.msc in the Search box and press Enter.

   The Active Directory Users and Computers snap-in opens in the Microsoft Management Console window.

3. Locate and expand the container in which the computer account for the PI AF Application Service resides.

4. Right-click the account, and then click Properties.

   The user account's Properties window opens with the General tab selected.

5. For General Delegation, select the Trust this computer for delegation to any service (Kerberos only) option and click OK to close the window.

6. For Constrained Delegation, select the Trust this computer for delegation to specified services only option.

   1. Select the Use Kerberos only option.

   2. Click the Add button.

      The Add Services window opens.

   3. Click the Users or Computers button.

      The Select Users or Computers window opens.

   4. Enter the name of the domain account under which the service that allows for access to the external data runs and click OK to return to the Add Services window.

      For example, if the external data resides in a SQL Server table, enter the name of the domain account under which the SQL Server runs.

      A list is shown with the Service Type(s)/User or Computer combinations for the specified domain account.

   5. Select each of the combinations that you want to allow constrained delegation to occur with the user account being edited and click OK to return to the computer's Properties window.

      The selected combinations are shown in the Services to which this account can present delegated credentials list.

   6. Click OK to return to the Active Directory Users and Computers snap-in.

7. Repeat these steps if the PI AF Application Service needs to access any other external data sources using delegated authentication.