You will need to create as many computer accounts as you have instances of EasySSO running in Atlassian applications for NTLMv2 to work. 

Due to changes introduced by Microsoft in March 2015 with security patch MS15-027/KB3002657 there is now no way to avoid it.

Each EasySSO instance is seen by the domain controllers as a computer on the network. Domain Controllers track messages per computer account (via counters). 

When two EasySSO instances use the same computer account the messages may be deemed by Domain Controller as being replayed or clashing, so sporadic failures and seemingly random login prompts to enter AD credentials via an in-browser popup may be observed while SSO works perfectly fine for the most users.

If you are running a Data Center edition of the base Atlassian application, with multiple nodes, you will require multiple computer accounts (one per node) to have NTLMv2 work in this case, via a computer account specific to the node (they get automatically distributed/assigned on startup).

For Kerberos, the SPN has to be assigned to the first (from the top) computer account as visible in EasySSO UI, as Kerberos is always done through the first account.


EasySSO articles

Try for free

EasySSO for Jira, Confluence, Bamboo, Bitbucket and Fisheye/Crucible

Try for free