Edit

Configuring Delegation for Business Central Web Server

  • Article

When the client device, Business Central Web Server, and Business Central Server are on separate computers, the client device interacts with Business Central Server through the computer that is running Business Central Web Server. Business Central Web Server is performing actions on the client device's behalf. This process is known as impersonation. Impersonation cannot be used across multiple computers, so you must set up delegation from Business Central Web Server to Business Central Server. Delegation occurs when Business Central Web Server forwards a request from a device request to the Business Central Server service so that the Business Central Server service can impersonate the device.

Delegating Access from the Web Server to Business Central Server

Configuring delegation means explicitly configuring the computer that is running Business Central Web Server components to delegate its access to the Business Central Server on behalf of the device that is trying to connect to Business Central. To make the access more secure, you specify delegation to a specific service on a specific server. This is known as constrained delegation.

Note

You must run the following procedure on a domain controller computer or on a computer that is installed with Active Directory Domain Services tools.

Delegate access to Business Central Server

  1. On the domain controller computer for your network, or on a computer that is installed with Active Directory Domain Services tools, choose Start, and then choose Run.

  2. In the Open field, type dsa.msc.

    This opens the Active Directory Users and Computers utility.

  3. Expand the node for the domain where you have installed the Business Central. For this example, the domain is Corp.

  4. Select the Computers node. Right-click the computer that is running the Business Central Web Server, and then choose Properties.

  5. On the Delegation tab, choose Trust this user for delegation to specified services only, and then choose Use Kerberos only.

    Note

    The Use Kerberos Only option does not work for some network configurations with Business Central. If you get a server error when you try open the Business Central Web Server, then disable the Use Kerberos Only option and see whether this fixes the error. For more information about this error, see Troubleshooting: A server error occurred and the content cannot be displayed.

  6. You must add the following service entries for the computer that is running Business Central Server, where BCSERVER indicates the name of the computer that is running Business Central Server. The service entries depend on your Business Central version.

    Version 21 and later:

    Service type User or computer Port
    http BCSERVER

    Version 20 and earlier:

    Service type User or computer Port
    DynamicsNAV BCSERVER 7046
    HOST BCSERVER

  7. In the Add Services window, choose Users or Computers.

  8. In the Enter the object names to select box, type the name of the computer that is running Business Central Server, in this case BCSERVER, and then choose the OK button.

  9. In the list of available services, select HOST, and then choose the OK button.

  10. To add the DynamicsNAV service, select Expanded, and then choose Add.

  11. In the Enter the object names to select box, type the name of the user that is running the Business Central Server, and then choose the OK button.

  12. Choose the OK button to close the dialog box.

Configuring Kernel Mode Authentication on the Business Central Web Server

By default, Windows authentication on the Business Central Web Server site on IIS is set to use kernel mode authentication. Kernel-mode authentication improves authentication performance. However, when you are using delegation with Kerberos, you must either disable kernel mode or configure it to use the credentials of the application pool of Business Central Web Server; otherwise, authentication will fail and Business Central Web Server will not be able to connect to Business Central Server. This is because kernel mode authentication runs under the machine account of the computer that is running IIS and the Business Central Web Server, while the Business Central Web Server runs under the user account of the user trying to access Business Central.

As a best practice, you should configure kernel mode authentication to use the application pool credentials, as described in option 1 that follows.

  1. On the computer that you installed Business Central Web Server, open the applicationHost.config file for Internet Information Services in a text editor, such as Notepad. By default, the file is located in c:\Windows\System32\inetsrv\config.

  2. Locate the <location path="Microsoft Dynamics 365 Business Central Web Client"> element.

  3. Change the <windowsAuthentication enabled="true"> element to the following.

    <windowsAuthentication enabled="true" useAppPoolCredentials="true" />

  4. Save the file.

  5. Restart IIS. To restart IIS in a command prompt, do the following:

    1. On the Start menu, choose Run.

    2. In the Open box, type cmd, and then choose the OK button.

    3. At the command prompt, type iisreset, and then select Enter.

    Tip

    You can also restart IIS using Internet Information Services Manager, if you have it installed.

Option 2: Disable configure Kernel Mode Authentication

  1. Open Internet Information Services Manager.

    On the Start menu, in the Search Programs and Files box, type inetmgr, and then select Enter.

  2. In the Connections pane, expand Sites, and then select Dynamics 365 Business Central Web client.

  3. In the IIS section, double-click Authentication.

  4. In the Authentication pane, choose Windows Authentication, and then choose Advanced Settings.

  5. Clear the Enable Kernel-mode authentication box, and then choose the OK button.

Registering Service Principal Names for Business Central Server

Note

This section only applies to Business Central 2022 release wave 1 (version 20) and earlier. SPNs aren't supported in later versions.

When Business Central Server is using a dedicated domain user account as its logon account, then you must register service principal names (SPN) for the Business Central Server on the domain user account to make delegation work. An SPN is the name by which a client uniquely identifies an instance of a service, using the account under which the service runs. To register SPNs, you used the setspn command-line tool that is available in Windows Server 2008 and Windows 7.

Note

You do not have to perform this task if the domain user account has permissions to register SPNs. In this case, SPNs for Business Central Server will be automatically registered when Business Central Server instance starts and then unregistered when the Business Central Server instance stops. For information about how to configure the service account to register SPNs, see Provisioning the Service Account.

Create a service principal name

  1. Using any computer in the network, open a command prompt as an administrator. To do this, choose Start, and then in the search window, type Command Prompt. Right-click Command Prompt, and then choose Run as administrator.

  2. To view the registered SPNs for Business Central Server on the domain account, type the following command.

    setspn -l domain\username

    To view the registered SPNs for a specific computer, type the following command.

    setspn -l domain\computername$

  3. At the command prompt, create an SPN for the Business Central Server service using the following syntax.

    setspn -A DynamicsNAV/FullyQualifiedDomainNameOfServer:Port Domain\User

    Replace FullyQualifiedDomainNameOfServer, Port, and Domain\ServiceAccountUserName with the appropriate values.

    For example, if BCSERVER is the name of the computer that is running Business Central Server, the actual command has the following format.

    setspn -A DynamicsNAV/BCSERVER.corp:7046 corp\bcdomainuser

See Also

Business Central Web Server Overview
Installing Business Central in a Two Computer Environment
Installing Business Central in a Three Computer Environment