Microsoft Sharepoint Products and Technologies Resource Kit eBook

Chapter 26: Single Sign-On in SharePoint Portal Server 2003 707
Step 6: Enable the Single Sign-On Service on the Front-End
Web Servers
After you have configured the single sign-on settings on the job server, you need to
enable the single sign-on service of the front-end Web servers. To enable the single
sign-on service on each front-end Web server, follow the instructions given earlier in
step 2, “Enable the Single Sign-On Service on the Job Server.”
Managing Single Sign-On
After you have configured the single sign-on for the first time, you are likely to need
to perform administration tasks at a later stage, including the following:
■ Creating and deleting the application definitions
■ Managing account credentials mapped within the application definitions
■ Regenerating, backing up, and restoring the encryption key
■ Enabling auditing of the encryption key
■ Disabling the SSOSrv service
In this section, we will discuss the single sign-on administration tasks. If you
need to change your single sign-on configuration, make sure you consider the
following:
■ The single sign-on configuration and encryption key management tasks cannot
be done remotely. To configure single sign-on or manage the encryption key,
go to the computer running as the job server and specify the settings locally.
■ If you change the job server to another server, you must reconfigure single
sign-on. After changing the job server, you must delete the entire registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ssosrv\Config on the old job
server.
■ If you reconfigure single sign-on and you want to change the account that you
specified for managing the single sign-on service (the single sign-on administrator
account), the user who reconfigures the single sign-on and the single
sign-on service account must be a member of both the current single sign-on
administrator account that manages the service and the new account that you
want to specify.
Editing an Application Definition
You can edit the display name, the e-mail contact, and the logon fields for an enterprise
application definition. You cannot edit the application definition name or
change the account type.