[MSLIT]

Hi,

We have BES Express 5.0.2 for the old Blackberry Bold devices and built a new server for BES 10. The installation went very well with out any errors etc. However when i try to create a Blackberry enabled user i get the following message in the web console
"The BlackBerry® Administration Service was unable to create the required external authenticator for the user"
Any one has any idea what is causing and how to get it fixed please?

Appreciate any help
Cheers

[nobody7290]

Look into the BAS-AS log for errors.
There also is a KB article regarding problems with user creation:
KB32589-Unable to add specific Active Directory users to BlackBerry Device Service 6.2

[smoothadmin]

Originally Posted by MSLIT

Hi,

We have BES Express 5.0.2 for the old Blackberry Bold devices and built a new server for BES 10. The installation went very well with out any errors etc. However when i try to create a Blackberry enabled user i get the following message in the web console
"The BlackBerry® Administration Service was unable to create the required external authenticator for the user"
Any one has any idea what is causing and how to get it fixed please?

Appreciate any help
Cheers

Give your BDSAdmin user Administrators group access.

[MSLIT]

Hello both,

i have got over the issue with your help but hit a new one. I had been told to open Port 80 & 443 for ANY source access on the Firewall (ASA) which i am not happy about it. Is there an IP address that links to the external RIM server where the BES 10 communicates to please? This will be resolve if i get the IP address which i can allow through than ANY source. Any help is much appreciated guys

[smoothadmin]

Originally Posted by MSLIT

Hello both,

i have got over the issue with your help but hit a new one. I had been told to open Port 80 & 443 for ANY source access on the Firewall (ASA) which i am not happy about it. Is there an IP address that links to the external RIM server where the BES 10 communicates to please? This will be resolve if i get the IP address which i can allow through than ANY source. Any help is much appreciated guys

You certainly have to make sure that port 3101 can get out as the server has to be able to talk to BBRY's NOC.

It's suggested that for BDS you don't need your OWA to be on the outside, you will have to test this on your own as I have mine on the outside which btw is safe.

[Claidheamhmor]

Found the issue:

In BDS Admin, user Microsoft Active Directory Integration, Manage Microsoft Active Directory Access, I had to edit Active Directory Configuration.

The "Microsoft Active Directory Access" section requires the BDS Admin account details for the resource domain.

The "Microsoft Active Directory Login" section requires the account details on the account/user domain for an account with (presumably) account operator rights.