Windows authentication for Enterprise Manager

[tjestr]

Is it possible to use Windows passthrough authentication for the Enterprise Manager to eliminate the need to enter credentials?

[Gostev]

Falko, impersonation (which is what you are talking about) only works within the same server, however we are also using the entered credentials to determine whether the user is allowed to manage the jobs on specific server, but impersonation does not work remotely. Such check is performed each time when you try to Start/Stop/Retry the job in the web UI.

It is still possible to make the latter work, by only by leveraging "delegation", but this would require some changes to default IIS security settings, as well as updating some security-sensitive attributes on computer accounts in AD (TrustedForDelegation). This is not kind of changes we can do silently in setup, and instead we would have to require all users to do this. Which would in turn complicate the setup, and much fewer people would be able to make everything work and see the web UI. While our main task have been making everything as simple as possible.

Based on all of thesу factors, we have decided to go with the current implementation. We can still implement support for delegation down the road, and provide some guide you could use to enable the required settings manually, if your security guys will be OK about this of course (if you even have those)

[MortenDall]

I am in a situtation where I need to change the Enterprise Manager IIS Authentication method, to do AD lookup without being on the domain (Digest Authentication eg.)
Does anyone have guidance, please?

[foggy]

For Windows authentication to work, Enterprise Manager should reside in the same domain with the account (or at least in the trusted domain).