Extranet User Manager

Transcription

1 Extranet User Manager Prerequisite Guide v3.1 March 11, 2015 Envision IT 7145 West Credit Avenue Suite 100, Building 3 Mississauga, ON L5N 6J7

2 Table of Contents ENVISION IT EXTRANET USER MANAGER... 1 VERSION 3 PREREQUISITES: EUM Installation Server Requirements: Microsoft SQL Server: Active Directory or SQL ASPNETDB: SSL Certificates: DNS & Hostname Setup: SMTP Server: Server Access and Required Accounts: Download and Extract EUM Installation Files: Authenticating Internal Users EUM Version 3 Checklist:...13 VERSION 2 PREREQUISITES: EUM Installation Server Requirements: Microsoft SQL Server: AD FBA, SQL FBA or WA SSL Certificates: DNS & Hostname Setup: SMTP Server: Server Access and Required Accounts: Download and Extract EUM Installation Files: EUM Version 2 Checklist:...27

3 Envision IT Extranet User Manager 1 Envision IT Extranet User Manager Version 3 Prerequisites: 1. EUM Installation Server Requirements: You must select a target server to install EUM and its underlying Identity Server against. With EUM Version 3, the target installation server no longer has to be a server in the SharePoint Farm. The SharePoint dependencies that existed in EUM Version 2 are no longer applicable. EUM can now run as its own stand-alone server. EUM requires that the target installation server has the following configuration: 1.1. Windows Server: Version 2008 or higher (2012/2012 R2 recommended) 64 bit 1.2. Microsoft.NET Framework 4.5: o The Microsoft.NET Framework 4.5 can be installed directly from the Server Manager which is available in Windows Server 2012/R2. Alternatively, a direct download link to the Microsoft website can be found here 1.3. Microsoft ASP.NET 4.5: o ASP.NET 4.5 is installed by default when installing the Microsoft.NET Framework SQLSysClrTypes: o A copy of the SQLSysClrTypes.msi can be found within the EUM installation folder 1.5. SharedManagementObjects: o A copy of the SharedManagementObjects.MSI can be found within the EUM installation folder 1.6. Disable Loopback check (optional): o If you want to have the ability to authenticate to EUM via the local machine (EUM Identity Server), you will need to disable the lookback check. This is easily achieved via PowerShell: o New-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name "DisableLoopbackCheck" -Value "1" -PropertyType dword o Alternatively, there are other methods available in the following Microsoft Knowledge Base Article

4 2 Envision IT Extranet User Manager To help confirm that all of your prerequisites have been installed, please compare your Web Server (IIS) Roles in Server Manager to the following configuration:

5 Envision IT Extranet User Manager 3 To help confirm that all of your prerequisites have been installed, please compare your.net Framework Features in Server Manager to the following configuration:

6 4 Envision IT Extranet User Manager 2. Microsoft SQL Server: EUM requires its own application database to store additional data, information and configuration settings. Therefore, the EUM Identity Server must have network connectivity to a desired SQL Server Microsoft SQL Server: o Version 2008 or higher is recommended o The selected admin account that will be used to install EUM needs a minimum of DBCreator SQL permissions in order to create the EUM application database. The SQL Server Admin role is recommended which can then be revoked once the EUM installation is complete. o Once EUM is installed, the App Pool Account running the Identity Server will need a minimum of SQL Read/Write permissions. The App Pool SQL permissions are automatically set to read/write on the EUM Application database during EUM installation. o Currently, the EUM installer only supports Integrated Windows Authentication and not SQL Authentication. However, Integrated Windows Authentication can be used for initial EUM setup then converted to SQL Authentication afterwards with manual configuration to the underlying web.configs

7 Envision IT Extranet User Manager 5 3. Active Directory or SQL ASPNETDB: With EUM, you have the ability to either store your Extranet users/groups in Active Directory or SQL. Some clients have a limited number of Active Directory licenses in which case leveraging SQL as the Extranet user/group store would be ideal. Both the Active Directory and SQL options are equally secure with no change to the end-user s experience Active Directory: A new or existing Active Directory (AD) instance can be used to store your Extranet users/groups as long as the server hosting EUM has network connectivity to it. A new Organizational Unit (OU) or Container (CN) should be created somewhere within the domain that will act as the repository for all your EUM users and groups. Although EUM can be configured to authenticate (read) all users within the underlying domain, it can only write EUM users/groups to one central location; OU or CN. Once the EUM OU/CN is created, you must delegate control to a desired account along with the default Network Service account to that particular OU/CN. This gives EUM the ability to: Create, delete and manage user accounts Reset user passwords and force password change at next logon Read all user information Create, delete and manage groups Modify the membership of a group In most scenarios, the Application Pool Account running EUM is delegated control to the Extranet OU/CN. However, there are instances where the Application Pool Account cannot be given rights into Active Directory due to the network architecture or personal preference. In this scenario, a separate set of credentials can be provided during installation. These credentials will then need to be delegated control to the EUM OU/CN instead of the Application Pool account. Create EUM OU/CN: o Proceed with creating an OU or CN within your AD to store your Extranet users and groups o Have the LDAP string ready that points to the recently created Extranet OU/CN. This will be an input parameter during EUM installation. Delete Access in Active Directory: o These instructions have been provided in Appendix B Delegate Access in Active Directory of the Extranet User Manager Deployment and Configuration Guide o Either the Application Pool Account running EUM or a separate account (specified during installation) should be delegated control to the EUM OU/CN as per the steps outlined in the above guide. In either scenario, the Network Service account must also be delegated control.

8 6 Envision IT Extranet User Manager 3.2. SQL Database: If SQL is selected as the identity store for Extranet users/groups there is no longer an Active Directory dependency and we no longer have to be concerned about delegating access to an AD OU or CN. Rather, we now rely on SQL Server to store the Extranet user and group information. EUM leverages Microsoft s ASPNETDB as the underlying Extranet identity store. This database i s automatically created during EUM installation. We recommend using the SQL Server that is hosting the EUM application database. If preferred, the EUM application database and ASPNETDB can still be segregated onto different SQL servers. The EUM server must also have network connectivity to the SQL Server hosting the ASPNETDB. ASPNETDB Access: o The selected admin account that will be used to install EUM needs a minimum of DBCreator SQL permissions in order to create the ASPNETDB database. Server Admin is recommended which can then be revoked once the EUM installation is complete. o Once EUM is installed, the App Pool Account running the Identity Server will need a minimum of SQL Read/Write permissions. The App Pool SQL permissions are automatically set to read/write on the ASPNETDB database during installation. o Currently, the EUM installer only supports Integrated Windows Authentication and not SQL Authentication. However, Integrated Windows Authentication can be used for initial EUM setup then converted to SQL Authentication afterwards with manual configuration to the underlying web.configs

9 Envision IT Extranet User Manager 7 4. SSL Certificates: EUM Version 3 takes advantage of federation by utilizing the features and capabilities of Security Assertion Markup Language (SAML). This federation model removes the requirement of having to open ports in your firewall to allow your internal domain users to authenticate. This sort of federation model requires all website traffic to be encrypted. Prior to installing EUM, an IIS Login Site needs to be created in which EUM and the Identity Server will be installed underneath. Therefore, the IIS Login Site must be on the HTTPS protocol with valid SSL certificates. Wildcard certificates are acceptable. Self-signed certificates are also acceptable as a temporary measure during setup although you will receive a warning message when attempting to access the site. Ultimately, valid certificates should be used SSL Certificates: Ensure the SSL certificates have been created and are available on the EUM Server for when the IIS Login Site is created

10 8 Envision IT Extranet User Manager 5. DNS & Hostname Setup: As mentioned in the previous step (SSL Certificates), an IIS Login Site will need to be created that EUM will be installed against. DNS should be setup for the Login Site beforehand. The name and URL for the Login Site is completely arbitrary and based on personal preference. The predefined DNS entries should be added as the desired Hostname for the Login Site.

11 Envision IT Extranet User Manager 9 6. SMTP Server: EUM requires an SMTP server to be able to send system s. These s are used for new registration notifications and forgot password resets. The EUM Identity Server should have network connectivity to the pre-existing SMTP server to have the ability to send s. EUM requires the SMTP server to be setup using Anonymous Authentication, not Authenticated SMTP Server Relay Restrictions: Ensure the EUM Identity Server s IP address has been added to the accessible Relay Restrictions list within the IIS SMTP configuration settings. This will allow the EUM Identity Server to be able to send s. Note: In EUM Version 3, you have the ability to skip this step during installation and setup afterwards.

12 10 Envision IT Extranet User Manager 7. Server Access and Required Accounts: 7.1. The administrator account installing EUM must have the following permissions: Local Administrator Minimum of DBCreator access to target SQL Server for EUM Application Database 7.2. The administrator account installing EUM cannot be the same identity you re planning to specify as the Application Pool Account that will be running the EUM site If Active Directory has been selected for the Extranet User/Group Store and you do not wish to use the Application Pool Account of the EUM Identity Server Site, you must have credentials for a domain account has been delegated access to the AD OU/CN for your Extranet users/groups If SQL has been selected for the Extranet User/Group Store, ensure the user account you re installing EUM with has a minimum of DBCreator access to target SQL Server for the ASPNETDB database.

13 Envision IT Extranet User Manager Download and Extract EUM Installation Files: 8.1. Download a copy of EUM Version 3 from the Envision IT website 8.2. Extract the compressed installation package to a desired server that will host EUM and its underlying identity server Note: With EUM Version 3, the target installation server no longer has to be a Web front end or Application server within the SharePoint Farm. The SharePoint dependencies that existed in EUM Version 2 are no longer applicable.

14 12 Envision IT Extranet User Manager 9. Authenticating Internal Users ADFS integration is required to authenticate Internal users in EUM These are the attributes in Active Directory that needs to be mapped to the outgoing claim LDAP Attribute -Addresses User-Principal-Name Display-Name SAM-Account-Name Token-Groups Qualified by Domain Outgoing Claim Type Addresses UPN Common Name Name Role

15 Envision IT Extranet User Manager EUM Version 3 Checklist: Prerequisite Value Completed 1. EUM Installation Server Requirements N/A Windows Server 2008 or higher N/A Microsoft.NET Framework 4.5 Installed N/A Microsoft ASP.NET 4.5 Installed N/A SQLSysClrTypes Installed N/A SharedManagementObjects Installed N/A 2. Microsoft SQL Server 2008 or higher N/A Database Server Name: MySQLDatabase EUM Application Database Name EUM_ManageUsers 3. Active Directory or SQL ASPNETDB N/A Active Directory Requirements: N/A Extranet User/Group LDAP Path: LDAP://my.domain.com/OU=eumusers,DC=my,DC=domain,DC=com App Pool Account Name: MyDomain/MyAppPoolAccount

16 14 Envision IT Extranet User Manager Account Deleted Control to AD: MyDomain/MyAppPoolAccount or MyDomain/MyOtherDesiredAccount SQL ASPNETDB Requirements: N/A SQL ASPNETDB Server Name: MySQLDatabase SQL ASPNETDB Database Name: EUM_ManageUsers_ASPNETDB 4. SSL Certificates N/A SSL Certificates for Login Site Created N/A 5. DNS & Hostname Setup N/A DNS setup for Login Site N/A DNS/Hostname selected for Login Site: 6. SMTP Server N/A EUM Server can access SMTP Server N/A 7. Server Access and Required Accounts N/A EUM Installer account is local admin N/A EUM Installer account has SQL rights N/A EUM Installer account: MyDomain/MyEUMInstallerAccount 8. Download and Extract EUM Install Files N/A

17 Envision IT Extranet User Manager 15 EUM Install files on target server N/A

18 16 Envision IT Extranet User Manager Version 2 Prerequisites: 1. EUM Installation Server Requirements: EUM Version 2 is installed directly against the Web Front End(s) and Application Server(s) within your SharePoint Farm. EUM will be installed under the root IIS site of your SharePoint Web Application. EUM requires that the target installation server has the following configuration: 1.1. Windows Server: Version 2008 or higher 64 bit 1.2. Microsoft.NET Framework 3.5 (SharePoint 2010): o The Microsoft.NET Framework 3.5 can be installed directly from the Server Manager which is available in Windows Server 2008/R2. Alternatively, a direct download link to the Microsoft website can be found here o The Microsoft.NET Framework 3.5 is only a requirement for SharePoint Microsoft ASP.NET 3.5 (SharePoint 2010): o ASP.NET 3.5 is installed by default when installing the Microsoft.NET Framework 3.5 o The ASP.NET 3.5 is only a requirement for SharePoint Microsoft.NET Framework 4.5 (SharePoint 2013): o The Microsoft.NET Framework 4.5 can be installed directly from the Server Manager which is available in Windows Server 2012/R2. Alternatively, a direct download link to the Microsoft website can be found here o The Microsoft.NET Framework 4.5 is only a requirement for SharePoint Microsoft ASP.NET 4.5 (SharePoint 2013): o ASP.NET 4.5 is installed by default when installing the Microsoft.NET Framework 4.5 o The ASP.NET 4.5 is only a requirement for SharePoint SQLSysClrTypes: o A copy of the SQLSysClrTypes.msi can be found within the EUM installation folder 1.7. SharedManagementObjects: o A copy of the SharedManagementObjects.MSI can be found within the EUM installation folder 1.8. Disable Loopback check (optional):

19 Envision IT Extranet User Manager 17 o If you want to have the ability to authenticate to EUM via the local machine, you will need to disable the lookback check. This is easily achieved via PowerShell: o New-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name "DisableLoopbackCheck" -Value "1" -PropertyType dword o Alternatively, there are other methods available in the following Microsoft Knowledge Base Article

20 18 Envision IT Extranet User Manager 2. Microsoft SQL Server: EUM requires its own application database to store additional data, information and configuration settings. Therefore, the EUM must have network connectivity to a desired SQL Server. Typically the existing SharePoint Farm SQL Server is leveraged Microsoft SQL Server: o Version 2008 or higher is recommended o The selected admin account that will be used to install EUM needs a minimum of DBCreator SQL permissions in order to create the EUM application database. The SQL Server Admin role is recommended which can then be revoked once the EUM installation is complete. o Once EUM is installed, the App Pool Account running the Extranet SharePoint Web Application will need a minimum of SQL Read/Write permissions. The App Pool SQL permissions are automatically set to read/write on the EUM Application database during EUM installation. o Currently, the EUM installer only supports Integrated Windows Authentication and not SQL Authentication. However, Integrated Windows Authentication can be used for initial EUM setup then converted to SQL Authentication afterwards with manual configuration to the underlying web.configs

21 Envision IT Extranet User Manager AD FBA, SQL FBA or WA With EUM Version 2, you have the ability to install EUM in one of the three available authentication types: 1) Active Directory Forms Based Authenticated (AD FBA): a. Extranet users/groups are stored in Active Directory: i. It s generally recommended that a separate domain is setup to store your Extranet users/groups. A typical network architecture diagram would depict this Extranet AD within a DMZ. However, a separate OU/CN within your internal domain is also acceptable. b. The AD FBA authentication type provides a friendly EZ-Login form for Extranet users. c. Internal users within the corporate domain are automatically logged into EUM without having to enter their credentials. i. In order to access the internal Active Directory, a number of firewall ports need to be opened between the DMZ and the internal network. The ports required are: LDAP 389 LDAPS 636 SMB 445 d. Users are authenticated using Claims Authentication: i. Requires a SharePoint web application configured with Claims Authentication, not Classic. 2) SQL Forms Based Authentication (SQL FBA): a. Extranet users/groups are stored in a SQL ASPNETDB. b. The AD FBA authentication type provides a friendly EZ-Login form for Extranet users. c. Internal users within the corporate domain are automatically logged into EUM without having to enter their credentials. i. In order to access the internal Active Directory, a number of firewall ports need to be opened between the DMZ and the internal network. The ports required are: LDAP 389 LDAPS 636 SMB 445 d. Users are authenticated using Claims Authentication: i. Requires a SharePoint web application configured with Claims Authentication, not Classic.

22 20 Envision IT Extranet User Manager 3) Windows Authentication (WA): a. Extranet users/groups are stored in Active Directory b. The WA authentication type does not provide a friendly EZ-Login form for Extranet users: i. The WA authentication type is normally used when you have a gateway device such as Forefront Threat Management Gateway or Forefront Unified Access Gateway in front of the Extranet. In these cases, these devices provide a rich HTML single sign-on experience. c. Users are authenticated using Windows Authentication i. The SharePoint web application can be configured in either Classic or Claims Authentication 3.1. Active Directory: This section pertains to the AD FBA and WA available authentication types mentioned above. A new or existing Active Directory (AD) Domain can be used to store your Extranet users/groups as long as the server hosting EUM has network connectivity to it. A new Organizational Unit (OU) or Container (CN) should be created somewhere within the domain that will act as the repository for all your EUM users and groups. Although EUM can be configured to authenticate (read) all users within the underlying domain, it can only write EUM users/groups to one central location; OU or CN. Once the EUM OU/CN is created, you must delegate control to a desired account to that particular OU/CN. This gives EUM the ability to: Create, delete and manage user accounts Reset user passwords and force password change at next logon Read all user information Create, delete and manage groups Modify the membership of a group In most scenarios, the Application Pool Account running EUM is delegated control to the Extranet OU/CN. However, there are instances where the Application Pool Account cannot be given rights into Active Directory due to the network architecture or personal preference. In this scenario, a separate set of credentials can be provided during installation. These credentials will then need to be delegated control to the EUM OU/CN instead of the Application Pool account. Create EUM OU/CN: o Proceed with creating an OU or CN within your AD to store your Extranet users and groups

23 Envision IT Extranet User Manager 21 o Have the LDAP string ready that points to the recently created Extranet OU/CN. This will be an input parameter during EUM installation. Delete Access in Active Directory: o These instructions have been provided in Appendix B Delegate Access in Active Directory of the Extranet User Manager Deployment and Configuration Guide o Either the Application Pool Account running EUM or a separate account (specified during installation) should be delegated control to the EUM OU/CN as per the steps outlined in the above guide SQL Database: This section pertains to the SQL FBA authentication type mentioned above. If SQL is selected as the identity store for Extranet users/groups there is no longer an Active Directory dependency and we no longer have to be concerned about delegating access to an AD OU or CN. Rather, we now rely on SQL Server to store the Extranet user and group information. EUM leverages Microsoft s ASPNETDB as the underlying Extranet identity store. This database is automatically created during EUM installation. We recommend using the SQL Server that is hosting the EUM application database. If preferred, the EUM application database and ASPNETDB can still be segregated onto different SQL servers. The EUM server must also have network connectivity to the SQL Server hosting the ASPNETDB. ASPNETDB Access: o The selected admin account that will be used to install EUM needs a minimum of DBCreator SQL permissions in order to create the ASPNETDB database. Server Admin is recommended which can then be revoked once the EUM installation is complete. o Once EUM is installed, the App Pool Account running the SharePoint web application EUM was installed against will need a minimum of SQL Read/Write permissions. The App Pool SQL permissions are automatically set to read/write on the ASPNETDB database during installation. o Currently, the EUM installer only supports Integrated Windows Authentication and not SQL Authentication. However, Integrated Windows Authentication can be used for initial EUM setup then converted to SQL Authentication afterwards with manual configuration to the underlying web.configs

24 22 Envision IT Extranet User Manager 4. SSL Certificates: Although it is generally recommended that your SharePoint site is using SSL on the HTTPS protocol, it is not a requirement for EUM Version 2. However, the following message will display on the EZ-Login page by default when using a non-ssl site: Warning: this page is not encrypted for secure communication. User names, passwords, and any other information will be sent in clear text. For more information, contact your administrator.

25 Envision IT Extranet User Manager DNS & Hostname Setup: Proceed with creating a SharePoint web application that will become the target site EUM will be installed against. If you re planning to proceed with an AD FBA or SQL FBA authentication install type, EUM will require the SharePoint web application to be created using Claims authentication. It is generally recommended that your DNS and hostname configuration is setup prior to installing EUM. This strictly pertains to your selected SharePoint web application. This will reduce the likihood that additional EUM configuration is needed post-install. We also recommend not having any alternate access mappings (AAM) or extending your SharePoint web application outside the default zone. Have a single URL for all internal and external users is the preferred approach to help mitigate the likelihood of broken links.

26 24 Envision IT Extranet User Manager 6. SMTP Server: EUM requires an SMTP server to be able to send system s. These s are used for new registration notifications and forgot password resets. The SharePoint Farm should have network connectivity to a pre-existing SMTP server. EUM requires the SMTP server to be setup using Anonymous Authentication, not Authenticated SMTP Server Relay Restrictions: Ensure all SharePoint Web Front Ends and Application servers have been added to the accessible Relay Restrictions list within the IIS SMTP configuration settings. This will allow these nodes to be able to send s. SMTP server accessibility is required during EUM installation.

27 Envision IT Extranet User Manager Server Access and Required Accounts: The administrator account installing EUM must have the following permissions: Local Administrator SharePoint Farm Administrator Minimum of DBCreator access to target SQL Server for EUM Application Database The administrator account installing EUM cannot be: The same identity specified as the Application Pool Account that is running your SharePoint Extranet Web Application. The same identity specified as the Application Pool Account that is running your Central Administrator If Active Directory has been selected for the Extranet User/Group Store and you do not wish to use the Application Pool Account of the SharePoint web application, you must have credentials for a domain account has been delegated access to the AD OU/CN for your Extranet users/groups If SQL has been selected for the Extranet User/Group Store, ensure the user account you re installing EUM with has a minimum of DBCreator access to target SQL Server for the ASPNETDB database.

28 26 Envision IT Extranet User Manager 12. Download and Extract EUM Installation Files: Download a copy of EUM Version 2 from the Envision IT website Extract the compressed installation package to each Web Front End and Application server within the SharePoint Farm.

29 Envision IT Extranet User Manager EUM Version 2 Checklist: Prerequisite Value Completed 1. EUM Installation Server Requirements N/A Windows Server 2008 or higher N/A Microsoft.NET Framework 3.5 Installed N/A Microsoft ASP.NET 3.5 Installed N/A Microsoft.NET Framework 4.5 Installed N/A Microsoft ASP.NET 4.5 Installed N/A SQLSysClrTypes Installed N/A SharedManagementObjects Installed N/A 2. Microsoft SQL Server 2008 or higher N/A Database Server Name: MySQLDatabase EUM Application Database Name EUM_ManageUsers 3. AD FBA, SQL FBA or WA AD FBA Active Directory Requirements: N/A Extranet User/Group LDAP Path: LDAP://my.domain.com/OU=eumusers,DC=my,DC=domain,DC=com

30 28 Envision IT Extranet User Manager App Pool Account Name: MyDomain/MyAppPoolAccount Account Deleted Control to AD: MyDomain/MyAppPoolAccount or MyDomain/MyOtherDesiredAccount SQL ASPNETDB Requirements: N/A SQL ASPNETDB Server Name: MySQLDatabase SQL ASPNETDB Database Name: EUM_ManageUsers_ASPNETDB Ports opened for internal authentication N/A 4. SSL Certificates (optional) N/A SSL Certificates for Login Site Created N/A 5. DNS & Hostname Setup N/A SharePoint Web Application Created N/A DNS/Hostname for SharePoint Web App 6. SMTP Server N/A EUM Server can access SMTP Server N/A 7. Server Access and Required Accounts N/A EUM Installer account is local admin N/A EUM Installer account is SharePoint Farm admin N/A

31 Envision IT Extranet User Manager 29 EUM Installer account has SQL rights N/A EUM Installer account: MyDomain/MyEUMInstallerAccount 8. Download and Extract EUM Install Files N/A EUM Install files on target server N/A

32 30 Envision IT Extranet User Manager