Prepare NAV Environment

Configure NAV 2009 Three-Tier Environment

First check the accounts which are running the NAV and SQL services. Make notes of domain account names, machine names, and FQDN (Fully qualified domain name).   For more detailed information about which accounts (Domain User Account or Network Service Account) should be created and when they are used, read the articles on MSDN: Walkthrough: Installing the Three Tiers On Two Computers Walkthrough: Installing the Three Tiers on Three Computers

 setspn -A DynamicsNAV/ServerNameWhereNavServerIsLocated.DomainName:7046 DomainName\UserNameWhoRunsNavServer

setspn -A http/ServerNameWhereNavServerIsLocated.DomainName DomainName\UserNameWhoRunsNavServer

Check Delegation

When running the NAV Service under Domain account, Delegation has to be set up for the account running the NAV service:

The Delegation tab will only be present after adding the SPN to the domain user account. Step 1: Click 'Start', then click 'Run'. Step 2: Type in 'dsa.msc' and click 'OK'. Step 3: Expand the 'Domain' and then click on 'Users'. Step 4: Locate the domain user account you are using, right click and select 'Properties'. Step 5: Under that 'Delegation' tab, select 'Trust this user for delegation to any service (Kerberos only)', then click 'OK'. This is not constrained delegation as mentioned in the Walkthrough, but this makes it a little easier to setup delegation. You can always come back after it is setup and working to implement constrained delegation. For Constrained delegation, select 'Trust this user for delegation to specified services only' and then select the MSSQLSvc SQL service. If you do not have the Kerberos authentication protocol, then select 'Trust this user for delegation to specified services only' and 'Use any authentication protocol'. Then select the MSSQLSvc SQL service. Delegation Step 6: Close the 'Active Directory Users and Computers' window.

When running the NAV Service under NetworkService account, Delegation has to be set up for the machine running the NAV service:

Step 1: Click 'Start', and then click 'Run'. Step 2: Type in 'dsa.msc' and click 'OK'. Step 3: Expand the 'Domain' and then click on 'Computers'. Step 4: Locate the computer name, right click and select 'Properties'. Step 5: Under that 'Delegation' tab, select the 'Trust this machine for delegation to any service (Kerberos only)', then click 'OK'. Step 6: Close the 'Active Directory Users and Computers' window.

OCL is not required if the NAV Server and SQL Server are on the same machine and the NAV service is running under Network Service account.

Step 1: Open Microsoft SQL Server Management Studio.

Step 2: Click 'Security' to expand the tree-view, right-click 'Logins', and then select 'New Login'.
This opens the 'Login - New' dialog box.

Step 3: Add the domain user account in the 'Login' name field, using the following format:

domain\domainUser

Step 4: Click 'OK' to exit the 'Login - New' dialog box.

Step 5: Click 'Databases', 'Demo Database NAV (6-0)' or other database name, and then click 'Security' to expand the tree-view.

Step 6: Under 'Security', right-click 'Users', and then select 'New User'.
This opens the 'Database User - New' dialog box.

Step 7: Add the domain user account in the 'User' name and 'Login' name field, using the following format:

domain\domainUser.

Step 8: Click the 'Securables' page.

Step 9: Click 'Add', click 'OK', click 'Object Types', check 'Tables' and then click 'OK'. Click 'Browse', check the '[dbo].[Object Tracking]', click 'OK', click 'OK' again.
In the 'Explicit permissions' check 'Grant' on the 'Select permission'.

Step 10: Click 'OK' to exit the 'Database User - New' dialog box.

Step 11: Close Microsoft SQL Server Management Studio. 

If the NAV server and SQL Server are on different machines and the Network Service account is running the NAV Service, then the Login and OCL must be set up using the same steps but for the machine account rather than the domain user. Use the steps described earlier, but replace the domain account with the machine account in the following form: <domain>\<computername>$.

Step 1: Change the 'ClientUserSettings.config' on the computer running the RTC, under the current user's profile, to define that a domain user account is to be used when connecting to the NAV Service tier.

On Windows Vista or Windows Server 2008, the default location is:

X:\Users\\AppData\Local\Microsoft\Microsoft Dynamics NAV

On Windows XP or Windows Server 2003, the default location is:

X:\Documents and Settings\\Local Settings\Application Data\Microsoft\Microsoft Dynamics NAV

Step 2: Add the following key to the file:

<add key="DelegationInfo" value="DomainUser"></add>

There are two possible values: 'NetworkService' and 'DomainUser'. To enable delegation, set the parameter to 'DomainUser'.

 

After confirming all items above and making the necessary changes, be sure to stop and start the NAV Server service before you attempt to reconnect using the RTC. If you still encounter the error message, remember that Kerberos tickets last for ten hours, so if you add/change the SPN, you may either have to wait for any existing tickets to expire or download KerbTray and attempt to expire any existing tickets. This is found in the Windows Server 2003 Resource Kit, which can be downloaded from here.

• ServiceClass: This identifies the general class of service. This is always MSSQLSvc for SQL Server.
• Host: This is the fully qualified domain name DNS of the computer that is running SQL Server.
• Port: This is the port number that the service is listening on.
• yourDomain\yourUser: This is the user which runs the service.

setspn -A MSSQLSvc/ServerNameWhereSqlServerIsLocated.DomainName:1433 DomainName\UserNameWhoRunsSqlServer