Assigns a Kerberos account (used for IIS authentication) to a site.
Syntax
New-CsKerberosAccountAssignment -Identity <XdsIdentity> [-Confirm [<SwitchParameter>]] [-Force <SwitchParameter>] [-InMemory <SwitchParameter>] [-UserAccount <String>] [-WhatIf [<SwitchParameter>]] |
Parameters
| Parameter | Required | Type | Description |
|---|---|---|---|
|
Identity |
Required |
String |
Unique identifier of the site where the Kerberos account was assigned. (This is the Identity of the site, not of the user account.) For example: -Identity "site:Redmond". |
|
UserAccount |
Required |
String |
User principal name of the new account. For example: -UserAccount "kerberostest@litwareinc.com". Note that your command will fail if the specified user account already exists. |
|
InMemory |
Optional |
Switch Parameter |
Creates an object reference without actually committing the object as a permanent change. If the output of the cmdlet is not assigned to a variable, the object will be lost and nothing will be created. |
|
Force |
Optional |
Switch Parameter |
When present, suppresses all error messages except for fatal errors. |
|
WhatIf |
Optional |
Switch Parameter |
Describes what would happen if you executed the command without actually executing the command. |
|
Confirm |
Optional |
Prompts you for confirmation before executing the command. |
Detailed Description
In Office Communications Server 2007 and Office Communications Server 2007 R2, Internet Information Service ran under a standard user account. This has the potential to cause problems: if that password expired (which it would, depending on your enterprise password policies) you might lose your Communications Server Web services, and would definitely have to diagnose the problem and then change the password. To help avoid the problem of expiring passwords, Microsoft Communications Server 2010 enables you to create a computer account (for a computer that doesn’t actually exist) that can serve as the authentication principal for all the computers in a site that are running IIS.
To run your Web servers under this single authentication principal you must first create a computer account (which, again, is not tied to an actual computer) using the New-CsKerberosAccount cmdlet; this account is then assigned to one or more sites. After the assignment has been made, the association is enabled by running the Enable-CsTopology cmdlet; among other things, this creates the required Service Principal Name (SPN) in Active Directory. SPNs provide a way for client applications to locate a particular service. Because these accounts use the Kerberos authentication protocol, the accounts are often referred to as Kerberos accounts and the new authentication process is known as Kerberos Web authentication.
The New-CsKerberosAccountAssignment cmdlet enables you to assign a Kerberos account to a site that is currently not associated with an account. To change the account associated site that is alread associated with a Kerberos account use the Set-CsKerberosAccountAssignment cmdlet instead.
Return Types
New-CsKerberosAccountAssignment creates new instances of the Microsoft.Rtc.Management.WriteableConfig.Settings.KerberosAccount.KerberosAccountAssignment object.
Examples
-------------------------- Example 1 ------------------------
 Copy Code |
|
|---|---|
New-CsKerberosAccountAssignment -UserAccount "kerberostest@litwareinc.com" -Identity "site:Redmond" Enable-CsTopology |
|
The commands shown in Example 1 assign a Kerberos account (kerberostest@litwareinc.com) to the Redmond site, then call Enable-CsTopology in order to enable this assignment. To do this, the first command in the example uses New-CsKerberosAccountAssignment to associate the account kerberostest@litwareinc.com with the Redmond site; the second command then calls Enable-CsTopology in order to create the required Service Principal Name in Active Directory and, at the same time, enable the new assignment.