Caché Installation Guide - InterSystems Documentation

Preparing for Caché Advanced Security
is in most cases cache (except when more than one Caché server instance is on one Windows
machine). For example, the service principal names for the service accounts created in the
previous examples become:
cache/WINSRVR.testdomain.com
cache2/WINSRVR.testdomain.com
When you add a remote server connection to the preferred server list on the Caché Cube, the
Caché Server Manager pre-fills the service principal name if you choose Kerberos. Therefore,
if you do not use these recommended naming conventions, take special care to enter the
appropriate name in the Service Principal Name field. See the “Connecting to Remote Servers”
chapter of the Caché System Administration Guide for the detailed procedure.
Note:
For detailed information on the setspn tool, see the Microsoft Setspn.exe page for
Windows 2000 or the Setspn Overview page for Windows 2003.
C.1.2 Create Service Accounts for Non-Windows Caché Servers
with a Windows Domain Controller
Before you install Caché in a Windows domain, the Windows domain administrator must
create a service account for each Caché server on a non-Windows machine that uses the
Windows domain controller. Create one service account for each machine, regardless of the
number of Caché server instances on that machine.
A suggested naming convention for these accounts is “cacheHOST,” which is the literal,
cache, followed by the host computer name in uppercase. For example, if you run a Caché
server on a non-Windows machine called UNIXSRVR, name the domain account
cacheUNIXSRVR. For Caché servers on non-Windows platforms, this is the account that maps
to the Kerberos service principal.
When you create this account on the Windows domain controller, Caché requires that the
account have the following characteristics:
• Set the Password never expires property.
• Set the Use DES encryption types for this account property
To set up a non-Windows Caché server in the Windows domain, it must have a keytab file
from the Windows domain. A keytab file is a file containing the service name for the Caché
server and its key.
To accomplish this, map the Windows service account (cacheUNIXSRVR, in this example)
to a service principal on the Caché server and extract the key from the account using the
90 Caché Installation Guide