> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-single-sign-on-settin.md). # Set up Active Directory single sign-on Enable Active Directory Single Sign-On and configure Service Principal Name permissions. AD Single Sign-On lets **operators log into Command Centre with their Active Directory (Windows) credentials** instead of a separate CC logon. Enabling it makes Command Centre register the **`GGLCCSvc` Service Principal Name (SPN)** for the FT Command Centre Service, so Kerberos can authenticate operators. It requires the **`ADSingleSignOn`** licence feature. This is an operator authentication feature. It is separate from, but used by, the sync integrations: the AD Sync and Entra ID Sync v1.0 configuration UIs rely on AD SSO to authorize the operator who launches them. ## Step 1 — Verify the licence feature In Server Properties **> Licensing > Features**, confirm **`ADSingleSignOn`** is listed and **Enabled**. If not, contact your Regional Support Team to request activation. ## Step 2 — Enable SSO in Operator Defaults In Server Properties **> Operator Defaults**, tick **Enable Active Directory single sign-on**. When enabled, the account used by the **FT Command Centre Service** attempts to register the **`GGLCCSvc`** SPN. ## Permissions required Coordinate with the site's IS team. On the **domain service account** (or the host machine's Computer object, if the service runs as Local System / Network Service), under **Security**, set both **Read public information** and **Write public information** to **Allow**. ![AD Users and Computers — the domain service account's Security tab with Read/Write public information set to Allow](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-a8bbf48d3f38c8888c64ed35b1a38c1f38837898%2FSECHUB-AD-SSO-01-rw-public-info-domain-service-account.png?alt=media) If the Command Centre service runs as **Local System / Network Service**, apply the same Read/Write public information permissions on the **Computer object** instead: ![The Command Centre server Computer object properties, Security tab, with Read/Write public information allowed](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-c1c859b111691b1e7ec7f14d1acb6f7e1a23e3fe%2FSECHUB-AD-SSO-02-rw-public-info-computer-object.png?alt=media) Microsoft reference: [Service Principal Names (SPNs) overview](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731241\(v=ws.11\)). ## How the SPN works An SPN is a unique identifier of a service instance, used by Kerberos to associate a service instance with its logon account. When **Enable Active Directory single sign-on** is turned on, Command Centre automatically adds **`GGLCCSvc`** as an SPN of the Command Centre server's **Computer account**. This works when the FT Command Centre Service runs as **Local System**. > ⚠️ If the FT Command Centre Service "Log on as" account is changed from **Local System account** to **This account**, SSO can fail unless the SPN is valid. `GGLCCSvc` must then be registered against the **service account** used on the service's Log On tab, **and removed from the Computer account**. If it remains on both there is a duplicate and SSO fails. Registration under a service account normally requires domain-admin privileges (standard accounts cannot register SPNs). Two things to remember: * Disabling then re-enabling SSO makes Command Centre add `GGLCCSvc` back against the Computer account, re-creating a duplicate. * SPN changes do not take effect immediately. **Reboot** after deleting or adding SPNs. *** 🔗 **Related** * [Single Sign-On - Troubleshooting](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-single-sign-on-troubl.md). Managing SPNs with `setspn`. * [Single Sign-On - Common Fault and Scenarios](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-single-sign-on-common.md). The frequent failures. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-single-sign-on-settin.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.