W H I T E P A P E R : T E C H N I C A L. Enterprise Vault 8.0 Security Model for Microsoft SharePoint Archiving

Transcription

1 W H I T E P A P E R : T E C H N I C A L Enterprise Vault 8.0 Security Model for Microsoft SharePoint Archiving Rob Forgione Technical Field Enablement March 2009

2 White Paper: Symantec Technical Contents Purpose... 3 Enterprise Vault Services and Tasks... 3 Sharepoint Security... 4 Client Access... 5 Archive Search Web Part... 5 Archived Version History link... 5 Archive Explorer Web Part... 5 Conclusion... 5 If you have any comments on this Whitepaper please EV-TFE-Feedback@Symantec.com

3 Enterprise Vault 8.0 Security Model for Microsoft SharePoint Archiving Purpose The purpose of this document is to detail how Enterprise Vault: Can securely access data to be archived Provides security surrounding end-user access Provides a means for administrators to securely manage SharePoint data This document will give readers a better understanding of how the Enterprise Vault (EV) solution integrates with security features already built into Active Directory and SharePoint as well as provide insight as to how to change some of the settings to be configured in line with organizational preferences. This whitepaper assumes the reader has already read the Security Model for Enterprise Vault 8.0 and SQL server whitepaper and is familiar with the security concepts of Enterprise Vault. The Security Model series consists of: Security Model Enterprise Vault 8.0 and SQL server Enterprise Vault 8.0 Security Model for Microsoft Exchange Archiving Enterprise Vault 8.0 Security Model for Lotus Domino Archiving Enterprise Vault 8.0 Security Model for File System Archiving Enterprise Vault 8.0 Security Model for Microsoft SharePoint Archiving Enterprise Vault 8.0 Security Model for SMTP Archiving Security Model for Discovery Accelerator 8.0 Security Model for Compliance Accelerator 8.0 Enterprise Vault 8.0 Security Model for Automatic Classification Engine 8.0 Enterprise Vault 8.0 Security Model for Secure Messaging 8.0 This whitepaper is intended to train the reader the concepts behind Enterprise Vault 8.0 security for Microsoft SharePoint. Enterprise Vault Services and Tasks Enterprise Vault s SharePoint archiving solution uses the following Enterprise Vault Tasks: SharePoint Task SharePoint archiving tasks are run within the context of the VSA by default. If required, the SharePoint task can be configured to run using a different account. The account used must have full access to target site collections and their content. When archiving from SharePoint 3.0 sites, the account must have site collection administrator permissions on the target SharePoint site collections. Additionally, the chosen account must have the following permissions: Act as part of the operating system Log on locally Log on as a service Replace a process level token 3

4 Enterprise Vault 8.0 Security Model for Microsoft SharePoint Archiving SharePoint Security Organizations can use Enterprise Vault to archive documents from servers running: Microsoft Windows SharePoint Services 2.0 SP1 Microsoft Windows SharePoint Services 3.0 (WSS 3.0) Microsoft SharePoint Portal Server 2003 SP1 Microsoft Office SharePoint Server 2007 (MOSS 2007) Ensure that the Vault Service account is either a member of the SharePoint administration group for the SharePoint virtual servers or has local administrator privileges on the SharePoint computer. The account under which the Enterprise Vault SharePoint task runs (typically the Vault Service account) must have full access to target site collections and their content. When archiving from WSS 3.0 sites, the account must have Site Collection Administrator privileges on the target SharePoint site collections. The Enterprise Vault servers and SharePoint Servers should always be added to each others local intranet sites in Internet Explorer. This ensures all computers running Enterprise Vault tasks and services and any standalone Enterprise Vault Administration Consoles can access the SharePoint servers. The certificate used by the SharePoint virtual server must have the same name as the virtual server. For example, if the Sharepoint URL is then the name of the certificate used when issuing a certificate request must be OurSharepoint. If the names do not match, Enterprise Vault will not be able to validate the SharePoint site when administrators try to configure it in the Administration Console. The SharePoint configuration wizard asks for details of the VSA and configures the Enterprise Vault Sharepoint archiving task to log on using this account. Figure 1 illustrates a typical SharePoint archiving configuration. Figure 1 - SharePoint archiving configuration Enterprise Vault securely archives from SharePoint via the Enterprise Vault Microsoft SharePoint component. This needs to be installed and configured on the SharePoint server. The Enterprise Vault Admin Service will be installed automatically along with the Enterprise Vault Microsoft SharePoint component. 4

5 Enterprise Vault 8.0 Security Model for Microsoft SharePoint Archiving Client Access Access to items archived via SharePoint is similar to that of mailbox archiving in which users click shortcuts or links from SharePoint pages or results in search pages. Administrators can choose to install Web-parts such as the Archive Search Web Part, Archived Version History link, and the Archive Explorer Web Part. Only SharePoint site owners or administrators can modify SharePoint site pages and add Web Parts. In sites and document libraries, users will only be able to see archived documents that they have permission to access. To avoid users having to enter credentials every time they access the SharePoint server or Enterprise Vault SharePoint archive, the Enterprise Vault server and SharePoint Server can be added to local intranet sites in Internet Explorer. Archive Search Web Part The Archive Search Web Part enables users to search for archived documents that they have permission to access. From the search results page, users can view documents and restore archived documents or document versions to the SharePoint server. Archived Version History link Using the "Show archived versions for this document" link users can access versions of a document that are in the archive and also replace the current version of a document on the SharePoint server with a version in the archive. Archive Explorer Web Part The Archive Explorer Web Part enables users to browse and search SharePoint archives that they have permission to access. Archived documents can be viewed but not restored using Archive Explorer. Conclusion In this whitepaper we have discussed the security aspects of archiving from Sharepoint with Enterprise Vault 8.0. We have discussed permissions required on SharePoint servers as well as their requirements in IIS. We also discussed the client access methods such as links and Web-parts. Below is a list of the other Security Model topics in this series that may be of interest. Enterprise Vault 8.0 Security Model for Microsoft Exchange Archiving Enterprise Vault 8.0 Security Model for Lotus Domino Archiving Enterprise Vault 8.0 Security Model for File System Archiving Enterprise Vault 8.0 Security Model for SMTP Archiving Security Model for Discovery Accelerator 8.0 Security Model for Compliance Accelerator 8.0 Enterprise Vault 8.0 Security Model for Automatic Classification Engine 8.0 Enterprise Vault 8.0 Security Model for Secure Messaging 8.0 5

6 About Symantec Symantec is a global leader in providing security, storage and systems management solutions to help businesses and consumers secure and manage their information. Headquartered in Cupertino, Calif., Symantec has operations in 40 countries. More information is available at For specific country offices and contact numbers, please visit our Web site. For product information in the U.S., call toll-free 1 (800) Symantec Corporation World Headquarters Stevens Creek Boulevard Cupertino, CA USA +1 (408) (800) Copyright 2009 Symantec Corporation. All rights reserved. Symantec and the Symantec logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.