Caché Installation Guide - InterSystems Documentation

Preparing for Caché Advanced Security
2. In the Caché Server Manager dialog for adding a new preferred server, choose Kerberos. The name
populated in the Caché Service Name field should match the name in use. If there are multiple
Caché instances on the server machine, you may need to edit the contents of this field.
For detailed information on configuring remote server connections, see the “Connecting to Remote
Servers” chapter of the Caché System Administration Guide.
Names that are Any Unique String
For a name that uses any unique string, the procedure is:
1. Choose a name for the service principal.
2. In the Caché Server Manager dialog for adding a new preferred server, choose Kerberos. Specify
the selected name for the service principal in the Caché Service Name field.
If you decide not to follow Kerberos conventions, a suggested naming convention for each account
representing a Caché server instance is “cacheHOST” , which is the literal, cache, followed by the
host computer name in uppercase. For example, if you are running a Caché server on a Windows
machine called WINSRVR, name the domain account cacheWINSRVR.
If you have multiple Caché server instances on one machine, since the service account name must be
unique, you may want to follow the default Caché practice of naming instances and use this instance
name in place of the cache literal. For example, if you install two Caché server instances on the
WINSRVR machine and use the default instance names (cache and cache2), name the two service
accounts cacheWINSRVR and cache2WINSRVR.
For more information on configuring remote server connections, see the “Connecting to Remote
Servers” chapter of the Caché System Administration Guide for the detailed procedure.
D.1.5 Create Service Accounts for Non-Windows Caché Servers
Before you install Caché in a Windows domain, the Windows domain administrator must create a
service account for each Caché server on a non-Windows machine that uses the Windows domain
controller. Create one service account for each machine, regardless of the number of Caché server
instances on that machine.
A suggested naming convention for these accounts is “cacheHOST,” which is the literal, cache,
followed by the host computer name in uppercase. For example, if you run a Caché server on a non-
Windows machine called UNIXSRVR, name the domain account cacheUNIXSRVR. For Caché servers
on non-Windows platforms, this is the account that maps to the Kerberos service principal.
When you create this account on the Windows domain controller, Caché requires that the account have
the following characteristics:
• Set the Password never expires property.
• Set the Use DES encryption types for this account property
114 Caché Installation Guide