<head><style> .chartjs-size-monitor { display: none !important; height: 0 !important; overflow: hidden !important; }p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style></head><body><p data-pasted="true"><strong><span style="font-size: 14pt;">Using Windows NT Integrated Authentication</span></strong></p><p>There are two options we can use for our connection string between the Halo WebApp and the Halo Database. We recommend using SQL Authentication in the initial deployment session and for when the instance is live since this is much easier to setup and is more efficient.</p><p>However, you may want to use your Windows credentials to authorise the connection between the Halo database and the Webapp. This is possible but requires some extra steps and is not as fast performance wise.</p><p><br></p><p><br></p><p data-pasted="true"><strong><span style="font-size: 14pt;">Pre-Requisites</span></strong></p><p><strong><span style="font-size: 12pt;">Application server</span></strong></p><ul><li>If the application and database are hosted on different servers the servers must be joined to the same active directory domain.</li><li>If the application and database are hosted on different servers, you must have a domain service account for Halo to run as. This can be a standard service account or a gMSA (group managed service account). If using a gMSA, it must be created in AD with the application server allowed to retrieve its password, then installed and tested on the application server. If the application and database are on the same server, a local Windows account can be used instead and no domain is needed.<ul><li>Give the Halo service account Modify permissions on the C:\Halo folder, alongside IUSR.</li></ul></li></ul><p><br></p><p><strong><span style="font-size: 12pt;">Database Server</span></strong></p><ul><li>Windows authentication mode must be selected. Mixed Mode is only needed for SQL authentication. Click 'Add Current User' so the installing account is a SQL administrator.</li></ul><p><br></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><strong><span style="font-size: 14pt;">Setup</span></strong></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Create a New Login in SSMS:</p><ul style="box-sizing: inherit; margin-bottom: 1rem; margin-top: 0px; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><li style="box-sizing: inherit;">Use Windows Authentication to connect to a Windows user account (rather than SQL authentication).</li><li style="box-sizing: inherit;">Click 'Search' and select the Halo service account. No password is set. The format depends on the account type, for example:<ul><li>Domain account: DOMAIN\accountname</li><li>gMSA: DOMAIN\accountname$ (note the $)</li><li>Local account (single server only): SERVERNAME\accountname</li></ul></li><li style="box-sizing: inherit;">Ensure the account has the relevant permissions as outlined in other guides.</li></ul><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><img data-fr-image-pasted="true" src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjdiZmQ3OWFhLTY2NjktNDk5MS1hYjIyLTYxMWE3OGI3OGRlMiJ9._Sg9HzBWmrD8J5TvmblSwwe_VqEwE6rh1ruLZkEBY8g" alt="image" style="box-sizing: inherit; border-style: none;" class="fr-fic fr-dii"></p><p style="box-sizing: inherit; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><strong><span style="font-size: 10pt;">Fig 1. New Login in SSMS</span></strong></p><ul><li style="box-sizing: inherit; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">User Mapping is unchanged: tick the Halo database and give it db_owner.</li></ul><p><br></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Configure IIS Application Pools:</p><ul style="box-sizing: inherit; margin-bottom: 1rem; margin-top: 0px; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><li style="box-sizing: inherit;">The Windows user account must be used to validate and run the application pool for the Halo webapp.</li><li style="box-sizing: inherit;">Add the Windows user domain name as the identity for the following IIS application pools:<ul style="box-sizing: inherit; margin-bottom: 0px; margin-top: 0px;"><li style="box-sizing: inherit;">HaloAPI</li><li style="box-sizing: inherit;">Halo</li></ul></li><li style="box-sizing: inherit;">This can be done by selecting Advanced Settings in IIS and setting the identity field to match the exact domain\username of the Windows user created in SSMS. For example:<ul><li>Domain account: DOMAIN\accountname and its password</li><li>gMSA: DOMAIN\accountname$ with the password left blank</li><li>Local account: .\accountname and its password</li></ul></li></ul><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><img data-fr-image-pasted="true" src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjIzZWYxY2NiLTlmYzktNDFmMy1hMDVmLWY3MGEyZTc0Mjg3ZSJ9.SuONNqJKRSOECBeN0ep_LIEixCNUmrk_x3MhMkCvmaY" alt="image" style="box-sizing: inherit; border-style: none;" class="fr-fic fr-dii"></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><strong><span style="font-size: 10pt;">Fig 2. New Application Pool</span></strong></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><img data-fr-image-pasted="true" src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjU4OTgzNjI5LWMyYWItNDEyZi1hZTMyLTFiM2QyMjkyMjhkNSJ9.02nm7L4c6qDg9VCu9FkkF4TamQ7sEmrZ2Ab2cIGxSIE" alt="image" style="box-sizing: inherit; border-style: none;" class="fr-fic fr-dii"></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><strong><span style="font-size: 10pt;">Fig 3. ISS Application Pool Advanced Settings</span></strong></p><ul><li data-pasted="true">Also set Load User Profile to True on both pools.</li></ul><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><br></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Edit the WebApp Configuration:</p><ul style="box-sizing: inherit; margin-bottom: 1rem; margin-top: 0px; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><li style="box-sizing: inherit;">Update the config.exe file within the WebApp.</li><li style="box-sizing: inherit;">“Use Windows NT Integrated security” instead of entering a username and password. Test Connection runs as the logged-in user, not the service account, so a successful test doesn’t confirm the service account has access.</li><li style="box-sizing: inherit;">This will link IIS and SSMS to the Windows user account.</li></ul><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><img data-fr-image-pasted="true" src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijc4NTllZWFkLTgzMWMtNGQyOC1hOGRhLTcxZGY0ZDY5N2NlMiJ9.BJt3jvld6DLq04ROXyg7hp6edjUErepwyvNio1WXFVA" alt="image" style="box-sizing: inherit; border-style: none;" class="fr-fic fr-dii"></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><strong><span style="font-size: 10pt;">Fig 4. Edit WebApp configuration </span></strong></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><img data-fr-image-pasted="true" src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjAyNGFjNmM3LTM3ZjQtNGMzOC05MDBmLTlmMDk0MmRhMGE4MCJ9.ui4HkN7RruA6asIBgygJSRziQiF0tkJi9jkjRf9uCyo" alt="image" style="box-sizing: inherit; border-style: none;" class="fr-fic fr-dii"></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><strong><span style="font-size: 10pt;">Fig 5. Set WebApp to use Windows NT integrated security </span></strong></p><p style="box-sizing: inherit; margin: 0px 0px 10px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><em style="box-sizing: inherit;">The Server Name would not be an IP Address</em></p><p style="box-sizing: inherit; margin: 0px; line-height: 1.4285em; color: rgb(0, 0, 0); font-family: Poppins, sans-serif, Roboto; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Once configured, you can test the connection to confirm Windows Authentication is now working for the On-Prem instance of Halo.</p></body>
