Nik Patel's SharePoint World

An adventure in SharePoint and Microsoft in general.

Archive for the ‘Admin General’ Category

« Previous Entries

Checklist for Designing and Implementing SharePoint 2010 Extranets – High Level Items to Consider

Posted by nikspatel on March 11, 2012

I have been designing SharePoint extranets since MOSS 2007 days and it’s been amazing to see that even though on surface each extranet projects are approached same way, each and every extranet projects provides different architectural challenges. Recently I have attended Jeremy Thake’s webinar on what items needs to consider while designing extranet systems – Governing your Extranet for a better user experience and I was surprised to learn many new facet of SharePoint 2010 extranet design.

His webinar motivated to write detailed article on my experience and high level items needs to be considered while designing and implementing SharePoint 2010 extranets. Hopefully this article would provide general checklist & guidelines require to design SharePoint 2010 extranets.

Understand Extranet Type based on Business Requirements & Usage Scenarios

  • Define the User Personas - Employees, Partners, Vendors/Customers
  • Externally Available Intranets or Collaborative Sites for Employees without requiring logging into VPN or Corporate Network – Extranets for Remote Employees
  • Typically extranets are platform shared with external users such as partners, vendors, and customers
    • Shared Collaborative environment with Partners or Customers – External facing Team Sites (e.g. Customer Portal, Partner Portal)
    • Internet facing read only documents, wiki sites, or shared collaboration environment – Publishing Feature (e.g. Marketing Sites, School Portal, Blogs & Discussion Forums)

Typical Extranet Project/Implementation Team

  • Part-time involvement from IT Teams – Infrastructure Team, Security Team, Network Team
  • Ideal Full-time Project Team – Product Owner, Business Analyst/Project Manager, SharePoint Architect, SharePoint Administrator, More than 1 SharePoint Developer, SharePoint Quality Assurance, User Experience Architect

Infrastructure Considerations

  • Core SharePoint Infrastructure & Network Topology – UAG, Firewalls, DMZ, Servers, Network, DNS, Databases, SAN
  • Extranet Network Topology
    • Typically decides where would be SharePoint Servers located – In corporate network or DMZ
    • Typically decides high level SharePoint Server Topology and SharePoint Architecture
    • Topologies to Consider – Edge Firewall Topology, Back-to-Back Firewall Topology, or Split Back-to-Back Firewall Topology – e.g. Configure UAG in DMG to protect extranet farm hosted in corporate farm using Edge Firewall Topology
  • Server and Farm Topology
    • Single Farm vs. Multiple Farms
      • Do you really require separate farm? – Impact on licensing, hardware, security, physical data separation etc.
      • Options are Single farm with same sites serving both intranet and extranet (e.g. Same Web Application serving both intranet/extranet in Single Farm), different sites for intranet or extranet environment (e.g. Multiple Web Applications in serving both intranet/extranet in Single Farm), or Multiple farms for physical separation (e.g. Multiple Web Applications serving intranet and extranet in different Farm)
    • SharePoint Farm Architecture – Web Front Ends, App Servers, DB Servers
      • Hardware vs. Software Load Balancer for Web Front Ends
      • Install SSL certificate on SharePoint web application
    • Cross-Farm Infrastructure for Multiple Farms
      • Shared SharePoint Services – User Profiles Service, Search Service, Managed Metadata Service etc.
    • Virtualization, High Availability,  Backup-Restore Approach, and Disaster Recovery
    • Global Availability and Latency – WAN Acceleration with Central Farm vs. Global Farms in Multiple Locations with Data/Documents Replications

Security and Identity Management Considerations

  • Identity Management System
    • Internal and External Accounts should be in separate identity management system.
    • Understand Types of Users
      • Internal Users – in most cases, it’s AD
      • Extranet System Managed Users – AD, ADLDS, SQL, LADAP
      • Extranet System Federated Users – ADFS
      • Extranet System Open ID or Social System Users – Live ID, Google, Facebook, Twitter, LinkedIn etc.
    • Sample Configurations
      • Single AD with Same OU or Multiple OU for both Internal and External Accounts – Windows Authentication is sufficient
      • Multiple AD with Two-way Trust for both internal and External Accounts – Windows Authentication is sufficient
      • Multiple AD with Single-way Trust for both internal and External Accounts  – Requires Claims & LDAP FBA
      • AD for Internal Users and ADLDS FBA for external Accounts  -  Requires Claims based authentication
      • AD for Internal Users and SQL/ASP.NET FBA for external Accounts  – Requires Claims based authentication
      • AD for Internal Users and ADFS (Web based SSO federation) for external Accounts – Requires Claims based authentication
      • AD for Internal Users and Windows Live ID for external Accounts – Requires Claims based authentication
  • Authentication – Account/Identity Management
    • It is important to note that SharePoint doesn’t perform Authentication
    • Decide whether to use Classic (Windows – NTLM or Kerberos with Internal AD) or Claims (LDAP/SQL/FBA/ADFS/ADLDS etc.) based Authentication.
    • It is important to note that regardless of what Authentication Source or Authentication Type is, SharePoint treats all users as SPUser object. SPUser object would contain user token based on authentication type or authentication source.
    • Does Kerberos need to be  enabled to pass credentials to the internal systems? Claims are built to avoid Kerberos delegation to pass Claims without concerns of multiple-hops.
  • Login Experience
    • Classics Authentication – Mixed-Mode Authentication - MOSS 2007 way
      • When to use? Different protocols like HTTP or HTTPS for internal vs. external users, separate environments or URLs for internal and external users, Single Sign on for internal users in corporate network
    • Claims Authentication – Multi-Mode Authentication – New in SharePoint 2010, Provides option to Choose Authentication Type before Login Prompt
      • When to use? Single URL for both internal & external users (There is exception – if both internal & external users are in same AD or multiple AD with two-way trust with windows authentication can have single URL), Must be used for Live ID, Must be used to federate between two organizations,
    • Custom Login Page
      • Most customer facing application requires custom branded login page. Requires custom development for branded login page. Out of box login options may not be sufficient for externally facing portals.
      • Optionally use Third-Party SharePoint Protection & Reverse-Proxy lookup Tools like UAG as long as these tools supports authenticate logic for all configured identity management systems.
  • Authorization – Site Membership
    • Unlike Authentication, SharePoint performs Authorization by assigning SPUser object to SharePoint Security Groups
    • Two Kind of Authorizations driven by Site Taxonomy
      • Shared Sites/Pages like Yahoo and Dedicated Sites for customers
      • Driven by Customer SLA & Sites Hierarchy – Separate/Dedicated Site Collection for each Customer Site or Single/Shared Site Collection for Multiple Customers
    • Protecting Content
      • Driven by User Personas, User Types, and Site Hierarchy
      • Site Level Permissions Inheritance – Inherit Security or Break Security
      • Site Security Groups -Use Out of box Security Groups or Create New Security Groups based on Out of box Permissions
    • Site Membership
      • Consider Automated Security Group and Site Membership Provisioning and Cleanup Process
      • Either Assign Users or Groups to the SharePoint Security Groups
        • Assign AD or ADLDS Groups to the SharePoint Site Security Groups, AD Groups are recommended for account maintenance if users are in AD. Map these AD groups to SharePoint Security Group for ease of Site Membership management
        • Assign individual users to the SharePoint Site Security Groups – This may require for ADFS
      • Define process to delegate site membership, Make business users/site owners to manage site membership
      • If external users or customers are managing site membership, Use People Picker filtering mechanism to restrict external users visibility in internal directories. Use stsadm -Peoplepicker-searchadcustomquery for AD. Implement custom filtering in Find methods of FBA/ASP.NET Membership Providers
  • User Life Cycle Process
    • In most cases, extranet environments are controlled environment which doesn’t require user registration process. User registration typically requires for public facing internet sites.
    • Needs to define process for User Provisioning & Decommissioning
      • Define business process to request provisioning new users – both in bulk & individual
      • Define needs for Shared User Accounts or Dedicated User Account
      • Consider Auto User Provisioning Process  and Decommissioning Process
    • Self-Service User Management – Needs to define self-service or IT managed User management process - how user would reset their passwords, how users would request access to the sites, how users would be given access to the sites etc.
    • User Monitoring & Auditing – It’s a process challenge, external users not sneaking in from back door – Proper User Validation, Expiration, and De-Provisioning  (e.g. Verify users once a 3 months), Either build custom tools or use third-party ISV products for Identity Management

Information Architecture Considerations

  • Logical Architecture, Site Hierarchy, Site Taxonomy
    • Web Application, DNS, Host Header, and Application Pool
      • Single or Multiple  SharePoint Web Apps
      • When would you require Single SharePoint Application? – Single URL
      • When would you require Separate SharePoint Application? – different URLs or Authentication Settings
    • Site Collection vs. Sites – Extranet Sites Hierarchy and Number of Sites based on Taxonomy
      • In most cases, SLAs, Security Isolation & Data Protection drives this design. Use Site Collection if Security is boundary and users will have full control. If dedicated content database is important, use site collection as well.
      • Use Sites for Shared Access scenario where multiple customers will have read-only access to the content or contribute access to shared data. As long as customers can’t manage security, you are OK having this model.
      • Plan to use dedicated Site Collection for customer/partner centric portals. You can use SharePoint Multi-Tenancy framework as well for host named site collections. This is how Office 365 or Hosted/Cloud environments work.
    • Single Site to serve All Customers or Dedicated Sites for Each Customer
      • Review business requirements to see if there are needs for dedicated collaborative environments like document libraries, calendars, contacts, SharePoint lists etc. This will require Multiple Site Hierarchy.
      • If business requirements drive design for personalized web parts, data views, dashboards driven by user identity, it may require Single Site or Few Sites based on site types.
  • Navigation – Cross Site  Navigation and Cross Site-Collection Navigation
  • Site Life Cycle Management
    • Needs to define process for  New Site Provisioning and Site Decommissioning
      • How does site would be provisioned? IT managed; User Managed through IT defined workflow, User Managed through browser based site templates etc.
      • Define business process to request provisioning new sites – both in bulk & individual
        • Site Decommissioning Process – Consider archiving site, instead of deleting it
        • Consider Auto Site Provisioning and Decommissioning Process
    • Needs to define process of extending or maintaining existing sites with new features
    • Site Auditing – Build tools to audit site provisioning, site membership, site maintenance, and  site decommissioning
    • Multiple ways to define site templates in SharePoint – Site Definitions,  Feature Stapling, Web Templates, Coded Site Templates based on blank site templates and activating/maintaining features programmatically
      • One way to speed up initial site design – Use out of box site templates (e.g. team site or blank site) with browser based customizations to speed up initial site template design working with business owners, Save site as template, and import saved site template wsps into Visual Studio to create base Site Template. This process would work only for non-publishing sites. Publishing feature disables save as site template.

Content – Site and Page Contents Considerations

  • Page Design – Page Templates – Content Pages
    • Site Pages vs. Application Pages vs. Page Layouts
      • Site Pages – If users are expected to add/remove web parts, personalize page, or requires web parts
      • Application Pages – Administrative Pages
      • Page Layouts – If users are expected to manage contents on page or users are expected to create pages based on pre-defined formats.
    • For the publishing driven sites, needs to define content approval process, content authoring process, and content deployment strategies
  • Collaborative Content
    • Collaboration with Customers – Document Libraries, Annoucements, Calendar, Contacts, Team Sites
    • Rich Media – Audios and Videos, should define Digital Asset Management strategies
  • Rollup Views
    • Content Query Web Part – within site collection
    • Lightning Conductor Third-party web parts – cross site collection
    • Custom Search Based API - cross site collection
  • Data – Integration with other systems within organization
    • Define systems to integrate – SAP, CRM, Lotus Notes, Other SharePoint Farms (e.g. IT Intranet, Document Warehouses), and Third Party Systems
    • Each System would provide its own challenge to access data from SharePoint, May require developing custom web services interface or BCS for platform Integration
    • Does external users requires data interactivity – Reporting, KPIs, Scorecards, Dashboards etc.? Do external user’s credentials pass through to the Business intelligence systems? – This may require SSRS, Excel Services, Performance Point Services, Visio Services, BCS or other mechanisms with Kerberos or Claims enabled authentication
    • Data Security – Define process to expose internal data securely to the customers
      • Would customer credentials  pass through to the internal systems? – this would require Kerberos enabled on the SharePoint
      • Access Internal Systems based on User/Site Metadata/Personalization and Service Accounts instead of passing user credentials to the data source systems, requires proper metadata governance, metatada mapping, and metadata sync process
  • Search
    • Decide to use Fast Search vs. Enterprise Search capability vs. Custom Search Driven Components
    • Searching data from multiple internal systems may require BCS/LOB connectivity for platform integration with metadata targeted custom search API
    • Allows you to target information to customer by external user expertise and based on user profiles

Other Major Considerations

  • User Personalization and Preferences
    • Define User Personalization Data Store – SharePoint User Profiles vs. SQL Server Users DB vs. Custom Tools
    • Use User Metadata to target specific contents and implement personalization
    • May require tools to Sync User Metadata with Source Systems
    • May require tools to manage User Maintained Metadata and Preferences
  • Metadata
    • Application Metadata – Store in web.config, web application configuration store etc.
    • Site Metadata – Store in SharePoint site property bag properties
    • User Metadata – Store in User Profiles, SQL Servers, and AD/ADLDS properties etc.
  • Licensing
    • Work with your Microsoft reps for licencing impact, Each organization would affect different way
    • Per User CAL – Internal vs. External Facing
  • Social Integration
    • Any Social Integration – Twitter, Facebook, LinkedIn, Google+ etc.
  • Mobility Access
    • Target Platform – Blackberry, IPhone, Android, Windows Mobile
    • Any support for Mobile Device Access, HTML 5, MAC OS, iOS for cross-platforms and cross-device support.
    • Plant to integrate open standards like Jquery, Avoid Plugins like Adobe Flash or Silverlight for UI which not supported on iOS as of now
  • Cross-Browser Support
    • Define Browser Support Standards for IE, Chrome, Firefox – Checkout SharePoint 2010 Level 1 and Level 2 browser support and see if any custom tools needs to incorporated
    • Do you really need to use Silverlight or Adobe Flash? May be HTML 5, CSS 3 for industry standards
    • Target Standard Screen Resolution – 1024×768 vs. 1280×1024
  • Look and Feel – Branding
    • Custom Master Pages, CSS, Images, JavaScript, jQuery files etc.
    • UX Experience – AJAX vs. Jquery vs. Silverlight vs. HTML5 vs. JavaScript
    • Concept Design to Wireframes – Design Wireframes for pages, sub sites, and content pages
    • Style Guide – Microsoft Metro look & feel vs. Corporate Style Guide
  • Custom Development - Methodology and Environments
    • Build out Multiple Environments – Individual Developer VMs, Integration, Staging, Authoring, Production
    • Implement Coding Guidelines and Adhere Standards
    • Plan to standardize Code Organization in Visual Studio – Many Codeplex tools available to enable RAD
    • Plan to Use Source Code Control Management like TFS
    • Plan to perform Unit Testing, Automated Build Management, and Continuous Integration for Proper Release Management.
    • Plan to standardize Code Deployment using PowerShell Scripts vs. Manual PS Commands – Packaging using Features & Solutions Framework
  • Production Diagnosis – Logging and Auditing
    • Review out of box diagnostics and logging options – ULS, Event Logs, Developer Dashboards
    • Plan to build IT Support and Monitoring Framework – Error Handling, Logging
  • Performance
    • Caching – ASP.NET Caching vs. Page Output Caching vs. Custom Caching Components
    • Browser Optimizations – CSS Optimizations
    • Plan to perform Load Testing
  • Anti-Virus
    • Plan to use SharePoint specific Anti-Virus product to scan external user uploaded documents.
    • Consider blocking Infected Documents
  • Localization – Global Platform
    • Decide to use Different UI experience for different regions or  Consistent UI experience at all regions
    • Multi- Lingual Sites vs. MUI vs. Both vs. ASP.NET Custom Globalization Resource Files
      • Variations and Content Translation Tools
      • Sites in specific language and currency
  • Web Analytics
    •  SharePoint Out of box Web Analytics or Custom ISV tools
    • SharePoint Web Analytics not useful – Per Site Collection or Per Site, Instead Integrate with Web Trend or Google Analytics or ISV tools
  • End-User Training and Adoption
    • Plan to have proper documentation, online help, and system adoption plans
    • Plan to have proper communication and notifications for updates or new features rollout
    • Plan to have initial Pilot program, product roadshow, or adoption programs
  • IT Support and Monitoring
    • Plan to have feedback forums for external users to submit incidents and general system help
    • Plan to have dedicated IT support team to respond user incidents in timely manner

Posted in Admin General | Leave a Comment »

Decision Time – Deactivate SharePoint Foundation Web Application Service on Central Admin or Deploy Custom Solutions from Central Admin

Posted by nikspatel on February 24, 2012

Note: This article only applies to central admin server used for Application Tier in SharePoint Farm.

I recently came across very interesting error while deploying solutions and activating features using powershell on one of our farm’s central admin server. What surprised me that we were using same approach to deploy our code from central admin server since last couple of months and suddenly it’s stopped working while activating features and throwing error.

Enable-SPFeature : The Feature is not a Farm Level Feature and is not found in a Site level defined by the Url. At D:\Deploy\SPSolutionDeploymentScript.ps1:287 char:22 + Enable-SPFeature <<<<  –identity $webFeatureName -URL $spWeb.url -Confirm:$false + CategoryInfo: InvalidData: (Microsoft.Share…etEnableFeature:SPCmdletEnableFeature) [Enable-SPFeature], SPCmdletException + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletEnableFeature

Looking at the error, it was clear that PowerShell wasn’t able to find SharePoint Features and Solutions framework API on the server. What I didn’t know was what would or which SharePoint Service application would enable this framework on the server. My first guess was to reach out to our SharePoint admin to see if he is aware of any recent changes on the central admin server configuration. Additionally, I tried to deploy and activate features through one of the WFE servers and it worked fine. As I was waiting for admin response, I have reached out to greater SharePoint community via twitter. My good friends from SharePoint Twitter communities, both Dan Usher (@usher) and Clayton Cobb (@warrtalon) came to rescue right away and first clue was SharePoint Foundation Web Application Service may not be running. While I was trying to confirm whether this service was running earlier and stopped recently causing feature activation issues, I received response from Admin that this service was indeed stopped and he may have stopped recently.

Well, problem is solved and resolution is clear. We just needed to activate the SharePoint Foundation Web Application Service to resolve the issue. But, as we were exchanging information on twitter, I have realized that this could be major SharePoint release management decision. As an Admin, we would like to disable the SharePoint Foundation Web Application Service on the central admin server. Disabling SharePoint Foundation Web Application Service on central admin server seems one of the best practices since it isn’t used to serve pages to the end-users and disabling this service would conserve server memory for other dedicated SharePoint application tier services enabled on Central Admin/Application Server.

In General, here are the guidelines I have came to conclusion whenever I come across similar situation in future.

  • It is still best approach to deploy code and activate features from central admin. This would allow central admin server as a main administrative consoles for both configurations and custom deployment.
  • It is still best practice to disable the SharePoint Foundation Web Application Service on the Central Admin Server to avoid additional performance overhead by running less SharePoint Web Application IIS worker processes
  • Since you have to activate SharePoint Foundation Web Application Service on the Central Admin Server to deploy code from the Central Admin Server, It would be great practice to enable the Service during deployment process and disable during normal runtime. It would be nice to have a deployment tasks to enable the service, deploy custom solutions, and disable the service.
  • One last point, there is nothing written on stone or as a best practice to deploy code from central admin, it is just my preferred method to centralize administrative tasks in one place. If your situation is different and able to deploy custom solutions from the WFE servers running SharePoint Foundation Web Application Service, you are covered.

Here is another great article recommendaed by Dan Usher and it provides same architectural insights faced by SharePoint Architects and IT Pros in real world – http://blogs.technet.com/b/speschka/archive/2010/11/27/beware-of-default-solution-deployments-for-custom-claims-providers-in-sharepoint-2010.aspx

Posted in Admin General | Leave a Comment »

Best Practices to Change App Pool Account for SharePoint Web Application

Posted by nikspatel on January 25, 2012

Updating SharePoint Web Application Pool is one of the most common actions for SharePoint administration. I have repeatedly seen many SharePoint administrators and my fellow colleagues updating their SharePoint web application pool in the IIS and later realizing that their SharePoint content application is inaccessible and throws “Cannot connect to the configuration database” error.

The real reason behind this is when you create web application either through PowerShell or central admin, SharePoint configures application pool information at many different locations including machine level permissions, IIS, and database permissions. If you ever want to manually change the application pool, you must be aware of what really happens under the hood and visit all the different locations to change application pool manually. As you may think, manually changing all these machine level settings is tedious, error-prone, and requires better option. Luckily Microsoft has provided better option as manage service accounts page on the central administration site. It is best practice to change content web application pool or even service web application pool from the central administration to ensure SharePoint Content Web application runs smoothly.

You can use following step by step guide to change application pool for the given SharePoint web application. Additionally, it would walk you through what really happens under the hood and where SharePoint makes necessary changes to ensure Application Pool is configured properly.

Pre-requisites

  • New AppPool account must be Domain User Account (e.g. Niks\SPAppPool)
  • New AppPool account must register as SharePoint Managed Account

Changing Application Pool from the Central Administration

Visit Manage Service Accounts page on the central administration to change the application pool.

Run the IISReset after updating application pool to ensure all the configuration settings has been updated to access SharePoint Web Application correctly.

What really happens under the hood?

After you change the application pool through central administration, SharePoint automates various configuration settings changes at the machine level, IIS, and SQL Server.

  • SharePoint Web Application App Pool in IIS

  

  • Machine-level Permissions
    • New AppPool account added as Member in the WSS_WPG, AD Group
    • New AppPool account added as Member in the built-in IIS_IUSRS, AD Group

               

  • SQL Server and database permissions
    • SharePoint will create new SQL Server Login for AppPool Account in the Database if it doesn’t exists
    • New AppPool account is assigned to the db_owner role for the Web application content databases.

    • New AppPool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the farm configuration database.

    • New AppPool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the SharePoint_Admin content database.

    • New AppPool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the StateService database.

    • New AppPool account will be assigned to the db_owner role for the associated user profile service application databases (e.g. Profile DB, Social DB, and Sync DB)

There you go. Regardless of what you do and where you manually change application pool account info, you still have to change application pool through manage security accounts screen. So, why not just change only at 1 place on manage security accounts screen and let SharePoint does it’s magic to update all the required places. Hopefully this will help. !!!!!

Posted in Admin General | Leave a Comment »

Step by Step Guide to Configure SharePoint 2010 Forms Based Authentication with SQL

Posted by nikspatel on December 22, 2011

It is very common to use SQL Server database to store external users and roles in extranet environments for physical separation of the internal and external users. Typically external identity systems require specific schema changes and AD administrators don’t allow applications to store their users in the main organization domain directory for security concerns.

I have recently wrote an article on step by step guide to configure SharePoint 2010 FBA with ADLDS. This article follows same pattern to configure SharePoint FBA with SQL Server. As you may notice, most of the steps are same and web configuration file changes are similar. This article describes 5-Steps guide to configure SQL Users and Roles in Single-Server SharePoint 2010 environment on Windows 2008 R2 server for Forms Based Authentication.

Note: If you are looking for detailed step by step guide with lots of screenshots, you can download 35-pages step by step PDF guide demonstrating same steps discussed in this article.

 Step 1 – Create SQL Server Database to host FBA Accounts

  • Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe to create the SQL DB – aspnetdb
  • Verify that Niks\Administrator is running Application Pools for the Content and Central Admin Web Application and it’s added as dbowner role on the aspnetdb database.

Step 2 – Add SQL Users and Roles for FBA

  • Download the MembershipSeeder to load users for form-based authentication – http://cks.codeplex.com/releases/view/7450
  • How to use MembershipSeeder tool?
    • Open the  \Bin\Release\MembershipSeeder.exe and Update the SQL Server Name by clicking “Configure” button and close the tool
    • Reopen the tool and use following guidelines to add users.
      • Add 1 user at a time from membership section using “create” button
      • Add 1 role at a time from roles section using “create” button
      • Add 1 user to the role at a time from roles section using “Add to Role” button

  • Add SQL Roles and Users as following
    • Roles – sqlowners, sqlcontributors, sqlreaders
    • Users – sqlowner, sqlcontributor, sqlreader and add them to specific groups

Step 3 – Create New Web Application with Forms Based Authentication

  • Add DNS entries for the host headers – sqlportal.niks.local
  • Create New Web Application with Claims Based Authentication
    • Specify Port-80 and Host Header – sqlportal.niks.local
    • Select Windows Authentication and Forms Based Authentication
      • Specify Membership Provider – SqlMember and Role Provider – SqlRole
    • Specify proper content database name and leave everything else as it is
    • Create New Site Collection and specify Niks\Administrator as Site Collection Admin
    • Verify the Windows Authentication by logging to http:\\sqlportal.niks.local as Using Niks\Administrator

Step 4 – Update the Web Config Files for FBA – Content Web App, Central Admin Web App, and STS


  <connectionStrings>
     <clear />
     <add name="AspNetSqlMembershipProvider" connectionString="data source=SP2010VM;Integrated Security=SSPI;Initial Catalog=aspnetdb"  providerName="System.Data.SqlClient" />
  </connectionStrings>

    • Replace the  <PeoplePickerWildcards> entry with following XML

  <PeoplePickerWildcards>
   <clear />
   <add key="AspNetSqlMembershipProvider" value="%" />
   <add key="SqlMember" value="%"/>
   <add key="SqlRole" value="%"/>
  </PeoplePickerWildcards>

    • Locate the <membership> entry and Replace everything from <membership> to </membership> with the following XML

   <membership defaultProvider="i">
      <providers>
        <clear />
        <add connectionStringName="AspNetSqlMemberShipProvider"
           enablePasswordRetrieval="false"
           enablePasswordReset="true"
           requiresQuestionAndAnswer="true"
           passwordAttemptWindow="10"
           applicationName="/"
           requiresUniqueEmail="false"
           passwordFormat="Hashed"
           name="SqlMember"
           type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0,
  Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
        <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
     </providers>
    </membership>

    • Locate the <roleManager> entry and Replace everything from <roleManager> to </roleManager> with the following XML

   <roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">
      <providers>
          <clear />
           <add connectionStringName="AspNetSqlMemberShipProvider"
              applicationName="/"
              name="SqlRole"
              type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0,
  Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
           <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider,
  Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
     </providers>
  </roleManager>

  • Central Admin Web Application 
    • Update Central Admin Web Application web.config file (to find central admin web.config – go to the IIS, select central admin, and click Explore to find contents)
    • Find the </configSections> entry and add following XML directly below it

    <connectionStrings>
     <clear />
     <add name="AspNetSqlMembershipProvider" connectionString="data source=SP2010VM;Integrated Security=SSPI;Initial Catalog=aspnetdb"  providerName="System.Data.SqlClient" />
  </connectionStrings>
    • Replace the  <PeoplePickerWildcards> entry with following XML

<PeoplePickerWildcards>
   <clear />
   <add key="AspNetSqlMembershipProvider" value="%" />
   <add key="SqlMember" value="%"/>
   <add key="SqlRole" value="%"/>
</PeoplePickerWildcards>

    • Find the <system.web> entry and add the following XML directly below it. By default, there should be 1 blank Membership or RoleManager entry. Double check whether the <membership> and <rolemanager> entries only exist ones. Delete any double entries.

  <membership defaultProvider="i">     
    <providers>
        <clear />
        <add connectionStringName="AspNetSqlMembershipProvider"
           enablePasswordRetrieval="false"
           enablePasswordReset="true"
           requiresQuestionAndAnswer="true"
           passwordAttemptWindow="10"
           applicationName="/"
           requiresUniqueEmail="false"
           passwordFormat="Hashed"
           name="SqlMember"
           type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
        <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
   </providers>
 </membership>
      
 <roleManager defaultProvider="AspNetWindowsTokenRoleProvider" enabled="true" cacheRolesInCookie="false">
    <providers>
        <clear />
        <add connectionStringName="AspNetSqlMembershipProvider"
           applicationName="/"
           name="SqlRole"
           type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
        <add applicationName="/"
           name="AspNetWindowsTokenRoleProvider"
           type="System.Web.Security.WindowsTokenRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
    </providers>

 </roleManager>

  • Modify STS web.config file 
    • From the IIS, select the SecurityTokenServiceApplication under SharePoint Web Services and click Explore – it should take you to the C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\WebServices\SecurityToken
    • Find the </system.net> entry and add the following XML directly below it

  <connectionStrings>
     <clear />     
     <add name="AspNetSqlMembershipProvider" connectionString="data source=SP2010VM;Integrated Security=SSPI;Initial Catalog=aspnetdb"  providerName="System.Data.SqlClient" />
  </connectionStrings>   
  <system.web>
    <membership defaultProvider="i">
     <providers>
        <clear />
       <add connectionStringName="AspNetSqlMembershipProvider"
          enablePasswordRetrieval="false"
          enablePasswordReset="true"
          requiresQuestionAndAnswer="true"
          passwordAttemptWindow="10"
          applicationName="/"
          requiresUniqueEmail="false"
          passwordFormat="Hashed"
          name="SqlMember"
          type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0,
  Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
      <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
     </providers>
   </membership>
  
   <roleManager defaultProvider="c" enabled="true">
     <providers>
     <clear />
        <add connectionStringName="AspNetSqlMembershipProvider"         applicationName="/"
           name="SqlRole"
           type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
        <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
     </providers>
   </roleManager>
  </system.web>   

Step 5 – Configure the SharePoint Authorization and Verify the Access for the both AD (Windows) and SQL(Forms Based) Users

  • Verify AD Groups and Users are available to test
    • Sample Global Security Groups – adowners,adcontributors,adreaders
    • Sample Users – adowner,adcontributor,adreader
    • Add AD Groups and SQL Roles as SharePoint Security Groups – Readers, Contributors, and Owners
  • Verify that central admin and content web application people picker finds both AD groups/users and SQL roles/users – Please note that SQL Roles can be searched with the full role name while SQL user names can be searched via wildcard

  • Add AD users and SQL users into SharePoint Security Groups via AD Groups/SQL Roles and verify proper access – read-only, contribute, full control

Following screenshot demonstrate that I was able to successfully login as SQL User – SQLOwner

More Resources

Posted in Admin General | Leave a Comment »

Step by Step Guide to Configure SharePoint 2010 Forms Based Authentication with ADLDS

Posted by nikspatel on December 12, 2011

It is very common to use Active Directory Lightweight Directory Services – ADLDS in Windows 2008 environments (ADAM in Windows 2003 environments) to store external users in extranet environments for physical separation of the internal and external users. Typically external identity systems require specific schema changes and AD administrators don’t allow applications to store their users in the main organization domain directory for security concerns.

Recently I was able to successfully configure SharePoint 2010 Claims based authentication for the ADLDS using Forms based authentication. This article describes 5-Steps guide to configure ADLDS in Single-Server SharePoint 2010 environment on Windows 2008 R2 server for Forms Based Authentication in non-SSL environment. You can easily adopt this guide to use in SSL environment.

Note: If you are looking for detailed step by step guide with lots of screenshots, you can download 55-pages step by step PDF guide demonstrating same steps discussed in this article.

Step 1 – Configure ADLDS Environment

 Step 2 – Create New Web Application with Forms Based Authentication

  • Add DNS entries for the host headers (e.g. adldsportal.niks.local)
  • Create New Web Application with Claims Based Authentication
    • Specify Port-80 and Host Header (e.g. adldsportal.niks.local)
    • Select Windows Authentication and Forms Based Authentication
      • Specify Membership Provider – LdapMember and Role Provider – LdapRole
    • Specify proper content database name and leave everything else as it is
    • Create New Site Collection and specify Niks\Administrator as Site Collection Admin
    • Verify the Windows Authentication by logging to http:\\adldsportal.niks.local as Using Niks\Administrator

Step 3 – Grant “Application Pool” accounts READ Permission on ADLDS instance

  • Add Content SharePoint Web Application “Application Pool”, Central Administration Web Application “Application Pool”, and Security Token Service “Application Pool”  accounts READERS Roles on ADLDS instance. This would allow SharePoint to browse ADLDS store in least privileged scenario.
  • In My Sandbox, both ADLDS Administrators and SharePoint Application Pool accounts are same so, there is no need for explicit setting of permissions but in real world least privileged environment, these application pool accounts will be different and must be granted permission on the ADLDS. Failure of granting permissions for STS application Pool account may cause login failure issues. Failure of granting permissions for Web Application Pool accounts may cause people picker failure.

Step 4 – Update the Web Config Files for FBA – Content Web App, Central Admin Web App, and STS

  • Follow Mirjam’s blog, it works – http://sharepointchick.com/archive/2010/05/06/configuring-claims-and-forms-based-authentication-for-use-with-an.aspx
  • Before you make any changes, Please make sure to have a copy of all the original web.config files before making changes.
  • Please note that these web.config entries would work for ADLDS Containers, ADLDS Group Objects, and ADLDS Users Objects. If you are using either OUs, Persons, or other ADLDS objects, please modify the LDAP membership and roles providers entries as needed.
  • Content Web App Configuration
    • Update adldsportal.niks.local web application web.config – C:\inetpub\wwwroot\wss\VirtualDirectories\adldsportal.niks.local80\web.config
    • Replace the  <PeoplePickerWildcards> entry with following XML

      <PeoplePickerWildcards>
        <clear />
        <add key="AspNetSqlMembershipProvider" value="%" />
        <add key="LdapMember" value="*" />
        <add key="LdapRole" value="*" />
      </PeoplePickerWildcards>

  • Locate the <membership> entry and Replace everything from <membership> to </membership> with the following XML

      <membership defaultProvider="i">
        <providers>
          <clear />
          <add name="LdapMember" type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="SP2010VM.niks.local" port="52983" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="userPrincipalName" userContainer="CN=WPSCN,O=NIKSADLDS,C=LOCAL" userObjectClass="user" userFilter="(ObjectClass=user)" scope="Subtree" otherRequiredUserAttributes="cn" />
          <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
        </providers>
      </membership>

  • Locate the <roleManager> entry and Replace everything from <roleManager> to </roleManager> with the following XML

      <roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">
        <providers>
          <clear />
          <add name="LdapRole" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="SP2010VM.niks.local" port="52983" useSSL="false" groupContainer="CN=WPSCN,O=NIKSADLDS,C=LOCAL" groupNameAttribute="cn" groupMemberAttribute="member" dnAttribute="distinguishedName" userNameAttribute="userPrincipalName" groupFilter="(ObjectClass=group)" userFilter="(ObjectClass=user)" scope="Subtree" />
          <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
        </providers>
      </roleManager>

  • Central Admin Web Application
    • Update Central Admin Web Application web.config file (to find central admin web.config – go to the IIS, select central admin, and click Explore to find contents)
    • Replace the  <PeoplePickerWildcards> entry with following XML

      <PeoplePickerWildcards>
        <clear />
        <add key="AspNetSqlMembershipProvider" value="%" />
        <add key="LdapMember" value="*" />
        <add key="LdapRole" value="*" />
      </PeoplePickerWildcards>

  • Find the <system.web> entry and add the following XML directly below it. By default, there should be 1 blank Membership or RoleManager entry. Double check whether the <membership> and <rolemanager> entries only exist ones. Delete any double entries.

    <membership defaultProvider="i">
      <providers>
        <clear />
        <add name="LdapMember"
   type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
   server="SP2010VM.niks.local"
   port="52983"
   useSSL="false"
   userDNAttribute="distinguishedName"
   userNameAttribute="userPrincipalName"
   userContainer="CN=WPSCN,O=NIKSADLDS,C=LOCAL"
   userObjectClass="user"
   userFilter="(ObjectClass=user)"
   scope="Subtree"
   otherRequiredUserAttributes="cn" />
        <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
     </providers>
    </membership>
  
  <roleManager defaultProvider="AspNetWindowsTokenRoleProvider" enabled="true" cacheRolesInCookie="false">
        <providers>
          <clear />
         <add name="LdapRole"
   type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
   server="SP2010VM.niks.local"
   port="52983"
   useSSL="false"
   groupContainer="CN=WPSCN,O=NIKSADLDS,C=LOCAL"
   groupNameAttribute="cn"
   groupMemberAttribute="member"
   dnAttribute="distinguishedName"
   userNameAttribute="userPrincipalName"
   groupFilter="(ObjectClass=group)"
   userFilter="(ObjectClass=user)"
   scope="Subtree" />
        <add applicationName="/"
           name="AspNetWindowsTokenRoleProvider"
           type="System.Web.Security.WindowsTokenRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
       </providers>
  </roleManager>

  • Modify STS web.config file
    • From the IIS, select the SecurityTokenServiceApplication under SharePoint Web Services and click Explore – it should take you to the C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\WebServices\SecurityToken
    • Find the </system.net> entry and add the following XML directly below it

<system.web> 
   <membership defaultProvider="i">
      <providers>
         <clear />
         <add name="LdapMember"
    type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="SP2010VM.niks.local"
    port="52983"
    useSSL="false"
    userDNAttribute="distinguishedName"
    userNameAttribute="userPrincipalName"
    userContainer="CN=WPSCN,O=NIKSADLDS,C=LOCAL"
    userObjectClass="user"
    userFilter="(ObjectClass=user)"
    scope="Subtree"
    otherRequiredUserAttributes="cn" />
       <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
      </providers>
   </membership>
   
   <roleManager defaultProvider="c" enabled="true">
      <providers>
    <clear />
    <add name="LdapRole"
     type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
     server="SP2010VM.niks.local"
     port="52983"
     useSSL="false"
     groupContainer="CN=WPSCN,O=NIKSADLDS,C=LOCAL"
     groupNameAttribute="cn"
     groupMemberAttribute="member"
     dnAttribute="distinguishedName"
     userNameAttribute="userPrincipalName"
     groupFilter="(ObjectClass=group)"
     userFilter="(ObjectClass=user)"
     scope="Subtree" />
         <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
      </providers>
   </roleManager>
</system.web>

Step 5 – Configure the SharePoint Authorization and Verify the Access for the both AD (Windows) and ADLDS (Forms Based) Users

  • Verify ADLDS Users and Groups are available to test
    • Sample Roles – adldsowners, adldscontributors,adldsreaders
    • Sample Users – adldsowner,adldscontributor,adldsreader and add them to specific groups
  • Verify AD Groups and Users are available to test
    • Sample Global Security Groups – adowners,adcontributors,adreaders
    • Sample Users – adowner,adcontributor,adreader
  • Verify that central admin people picker finds for both AD groups/users and ADLDS roles/users – Please note that ADLDS roles can be searched with the full role name while ADLDS user names can be searched via wildcard
  • Configure AD Groups/Users and ADLDS Roles/Users Membership to the SharePoint Security Groups – Readers, Contributors, and Owners
  • Verify that AD users and ADLDS users added in SharePoint Security Groups via AD Groups/ADLDS Roles have proper access – read-only, contribute, full control

Following screenshot demonstrate that I was able to successfully login as ADLDS User – WPSCNAdminUser

More Resources

Posted in Admin General | Leave a Comment »

SharePoint 2010 Service Applications Quick Reference

Posted by nikspatel on July 1, 2011

SharePoint 2010 Service Application infrastructure is beast. Because Microsoft has built SharePoint Service Application architecture as pluggable, many of the out of the box service applications has been built for different needs with different configurations. Some of the key service applications components like service accounts, backend database, whether it’s available in SharePoint foundation or server product, whether it’s multi-tenant enabled, whether it’s cross-farm enabled are key to understand and will take you long way while designing service applications architecture during initial/ongoing farm configuration.

Additional References

  • Microsoft Press – SharePoint 2010 Administrator’s Pocket Consultant Book, Chapter 2, Table 2-1
  • Wrox’s Professional SharePoint 2010 Administration Book, Chapter 7, Table 7-1
  • Technet Poster – Topologies for SharePoint Server 2010 – http://go.microsoft.com/fwlink/p/?LinkID=167089

I have put together a high level grid to map all the major components of service applications for quick reference. I would encourage you to take this reference table and map it to your specific farm infrastructure. Enjoy.

Service Application SKU Recommended Location of Server Stores Data? If Yes, Provide DB Name  Cross Farm Capable?Publish-able? Windows Service? Multi-Tenant Aware? Is IIS Web Application Associated?  Is IIS WCF Service Application Associated?Managed from Central Admin?
Access Service Enterprise Application Cache No No  No No Yes
Application Registry Service Foundation Application DB (Application Registry) No No Yes (only deployed using PowerShell or FCW)
Business Data Connectivity Service Foundation Application DB(BDC) Yes No Yes No Yes
Central Administration Foundation Application DB(SharePoint_AdminContent) N/A No N/A Web App, SharePoint Central Administration v4, Runs as Farm Admin account N/A
Claims to Windows Token Service Foundation Application No No C2WTS, Installed as part of WIF. Disabled by default. Enabled by this Service. Runs as the local system user. No No
Document Conversions Launcher Service Application No No
Document Conversions Load Balancer Service Application No No
Excel Service Enterprise Application Cache No No  No No Yes
Lotus Notes Connector Application (Index) No Yes (Search)
Managed Metadata Service Standard Application DB (Managed Metadata) Yes No  Yes No Yes
Microsoft SharePoint Foundation Incoming Email Foundation Web or Application No No
Microsoft SharePoint Foundation Subscriptions Settings Service Foundation Web or Application DB (Subscription Settings) No Yes (PowerShell Only) No Yes (only deployed using PowerShell)
Microsoft SharePoint Foundation User Code Service Foundation Web or Application No SPUserCodeV4 – Runs under SP Service Account No No
Microsoft SharePoint Foundation Web Application Foundation All Web Servers, Stop on Application Servers No No No
Microsoft SharePoint Foundation Workflow Timer Service Foundation Web No No No
PerformancePoint Service Enterprise Application DB (Performance Point) Yes No  No No Yes
PowerPoint Service Office Web Apps Application Cache No No No No Yes
Search Query and Site Settings Service Standard Application (All Query Servers), Load balances queries across all Query servers  Yes No Yes (Search)
Secure Store Service Standard Application DB (Secure Store) Yes No  Yes No Yes
SharePoint Foundation Help Search Service Foundation On Foundation Farm, Search Server.On Server Farm, Application, Start this Service only on one computer. DB (Help) No SPSearch4 – Runs Under Local Service user No No
SharePoint Server Search Standard Automatically Configured to run on Appropriate Servers in the farm.This Service can’t be started or stopped from the Central Admin.  Search components are provisioned from the Search Admin Page. DB (Search Admin, Crawl, Property) Yes OSearch14 – Runs under SP Service Account Yes No Yes (Search)
State Service Standard Application DB (State) No No  No No Yes (only deployed using PowerShell or FCW)
Usage and Health Data Collection Service Foundation Application DB (WSS_Logging) No No No No Yes (only deployed using PowerShell or FCW)
User Profile Standard Application DB (Profile, Social Tagging, Synchronization) Yes, Requires both farms to be in trusted AD domain. No Yes No Yes
User Profile Synchronization Service Standard Application No No FIMService FIMSynchronizationService Windows Services are provisioned by the User Profile Sync Service. Runs as the Farm Admin account.  ?? No No
Visio Graphic Enterprise Application Blob Cache No No No No Yes
Web Analytics Data Processing Service and Web Analytics Web Service Enterprise Application DB (Reporting, Staging) Yes WebAnalyticsService -Runs under SP Service Account  No No Yes (Web Analytics)
Word Automation Standard Application DB (Word Automation) No No  Yes No Yes
Word Viewing Office Web Apps Application Cache No No No No Yes

Posted in Admin General | Leave a Comment »

Why you shouldn’t use the Farm Configuration Wizard to configure Production SharePoint 2010 Farm?

Posted by nikspatel on June 23, 2011

Well, it’s been well known in SharePoint Community that you shouldn’t use the Farm Configuration Wizard (aka. FCW) in the production farm, even if you can. At first FCW feels like bliss but its devil under the cloak. I am sure you have heard this phrase but it would be nice to know why you shouldn’t be using the FCW.

For the novice, in MOSS 2007 days, one of the biggest complaint was SharePoint takes too many steps to configure after initial installation. Microsoft answered that question in SharePoint 2010 by providing FCW which would configure all the service applications, initial content web application, and initial site collection to enable administrators to configure the SharePoint by walking through simple steps.

To access the Farm Configuration Wizard, please visit the central administration site and click on the “Farm Configuration Wizard” on the home page. As shown below, I have specified the “Niks\Administrator” as service accounts to configure all the services and initial farm using FCW.

To configure the SharePoint 2010 using FCW makes sense in the development or sandbox environments but it must be avoided by all means in the production environment. To understand why you shouldn’t be setting up SharePoint environment using FCW, it would be nice to know what really happens behind the screens and how it avoids the best practices required for the real production farms.

Reason 1 – FCW configures to run all the services under same service account.

Typically best practices are to have dedicated service accounts for each service applications for security isolation. Although you can change the service accounts later, it would be really cumbersome process to go through all the service applications to run under specific service accounts. Instead, create the service applications from the manage service applications page and specify dedicated service accounts as needed.

As shown below, “Niks\Administrator” service account was configured to run all the services by the FCW.


Reason 2 – FCW doesn’t have option to specify Service Application database names.

Whenever FCW configures the service applications, it creates underlying databases with GUID. You don’t have much control over GUIDs on the database names whenever service applications are configured using FCW. Having cryptic GUIDs in the database names has big issues including database backup/restore and database maintenance plans. Instead create the service applications from the manage service applications page and specify the human readable database names.

As shown below, database names are configured with GUIDs by the FCW.

Reason 3 – User Profile Service application configures the My Site Host on the default web application.

At first  having My Site host configured on the default web application may not be a big issue but in the medium to large farm deployment scenarios, you would like to configure the My Site host on the dedicated web application. This would allow organizations to configure the My Sites taxonomy, topology, security, and storage allocations on the dedicated web application running in its own IIS application pool under dedicated service account.

As shown below, FCW creates the default web application “SharePoint-80” on the http://sp2010vm, port-80 and My Site Host is configured on the default web application by FCW.

Hope this will help you to avoid the FCW in the production farm.

Posted in Admin General | Leave a Comment »

SharePoint_Config Database Suspect Mode – Cannot Connect to the Configuration Database Error

Posted by nikspatel on March 2, 2011

If your SQL Server ever crashes or hard rebooted then you may come across corrupted SharePoint_Config database. Recently while doing a SharePoint 2010 development on my VM, I had to hard reboot my personal VM, and I had received dreaded cannot connect to the configuration database error while accessing my content web application.

Having seen this error many times before, I have tried all the usual suspects – http://support.microsoft.com/kb/823287 – IIS Web Site availability, IIS Application Pool Availability. IIS Application Pool Identity, and SQL Server availability. After carefully walking through all the diagnostic steps, I had noticed that “SharePoint_Config” database was in suspect mode.

I had never seen SQL Server database in suspect mode. Quick Google took me following links to fix this issue.

http://ahmershahid.wordpress.com/2009/05/25/moss-2007-config-db-in-suspect-mode/
http://www.aarat.com/sharepoint-config-database-suspect/

As it turned out, it’s not a SharePoint issue. Any SQL Server databases can be corrupted and gets in the suspect mode. Following steps would fix the suspect database mode issues. I am adding these steps on my blog for reference only. Real credit goes to above blogs. To fix SQL Server database suspect mode, we need to use the SQL Server’s emergency mode which allows you repair the database by reparing to last normal state.

After running following script on the Master database, SharePoint_Config database suspect mode was fixed and I was able to access the content web application.


-- Use the Master database
Use Master

-- Verify that database has issues
EXEC sp_resetstatus 'SharePoint_Config'

-- Put the database in emergency mode
ALTER DATABASE SharePoint_Config SET EMERGENCY
DBCC checkdb('SharePoint_Config')

-- Set the database in single user mode
ALTER DATABASE SharePoint_Config SET SINGLE_USER WITH ROLLBACK IMMEDIATE

-- Repair the database with data loss
DBCC CheckDB ('SharePoint_Config', REPAIR_ALLOW_DATA_LOSS)

-- Set the database in multi-user mode
ALTER DATABASE SharePoint_Config SET MULTI_USER

-- Verify that database is reset
EXEC sp_resetstatus 'SharePoint_Config'

Posted in Admin General | Leave a Comment »

MOSS 2007 to SharePoint 2010 Upgrade Assessment Questionnaires

Posted by nikspatel on January 7, 2011

If you are at the client upgrading existing MOSS 2007 environment to new SharePoint 2010 installation, use this questionnaire to understand the existing SharePoint 2007 environment for SharePoint 2010 SharePoint Migration and Upgrade. This can be during pre-sales process to assess the client environment. I am planning to update this over time.

  • Basic Information
    • Do you have any existing SharePoint 2007 environment? If you do, which version of SharePoint is configured – WSS 3.0 or MOSS 2007 standard edition or MOSS 2007 Enterprise Edition? If you do and planning to upgrade to the SharePoint 2010, please provide following information.
    • How many users are currently using the site?
    • What is the current usage profile?  Light, Typical, Heavy, and Extreme.
  • Upgrade and Migration Needs
    • Do you have test environment where you can perform the trail upgrade and migration?
    • Do we have any communication plan for planned upgrade and downtime from SharePoint 2007 to SharePoint 2010?
    • Do we have any user adoption policy for SharePoint 2010 and end-user training plans?
    • Do we have any governance plans to support the ongoing growth of the SharePoint 2010 usage?
    • Do we have needs for the Visual Upgrade capability of SharePoint 2010 or do we need to upgrade SharePoint 2007 to SharePoint 2010 permanently?
    • Do we need to access the content in read-only mode while moving from SharePoint 2007 to the SharePoint 2010?
    • How much downtime is afforded during migration and upgrade?
    • Are you planning to restructure your current SharePoint 2007 environment in the SharePoint 2010 or are you expecting to use the same taxonomy and URLs?
  • Analyze SharePoint 2007 Server Infrastructure
    • Have you run any pre-upgrade checker on your MOSS environment? Please execute the pre-upgrade scan utility and provide us the report.
    • What level of service packs and cumulative updates are installed on the SharePoint 2007 farm? Do you have WSS SP2 or MOSS 2007 SP2 installed?
    • Please provide details about current hardware configurations for each server in the farm?
      • CPU, # of processors, dual core vs. quad core
      • 32-bit vs. 64-bit
      • RAM
      • Hard disk space
      • Networking capabilities
      • Any Additional Hardware Configuration customized to the environment
    • What version of Windows Server Infrastructure is running SharePoint 2007 environment? 32-bit Windows 2003 Server, 64-bit Windows 2003 Server, 64-bit Windows 2008 Server, 64-bit Windows 2008 Server R2
    • Is the current SharePoint environment configured on a single server or multiple server farms? If it’s configured on a multi-server farm, please provide us details:
      • How many web front end servers are used?
      • Is web front servers are Load balanced? If yes then is it software or hardware Load Balanced?
      • How many database servers are used?
      • Is database servers are clustered? If yes then is it software or hardware Load Balanced?
    • What version of SQL Server is used in the SharePoint environment?
      • SQL Server 2000, SQL Server 2005, SQL Server 2005 Express, SQL Server 2008, SQL Server 2008 R2
      • 32-bit or 64-bit
    • If the department SharePoint environment uses MOSS 2007, please provide details about SSP, My sites, Profiles, Index, or Query servers, if applicable.
    • Is your SharePoint environment deployed on virtual servers? If yes, please provide details about virtualization technologies, host servers, virtual server details. Please provide the virtual infrastructure diagram, if available
    • Please provide details about your SharePoint hosting environment specific to Active Directory, Domain name, and Forest information.
    • Please provide the farm topology diagrams, if available – Physical Diagram and Logical Diagram
  • Analyze SharePoint 2007 Information Architecture
    • How many sites or site collections or web applications need to be migrated? Please provide the number of sites, URLs for each Site, and any DNS configurations used for each site.
    • Please document the current Site Navigation, Sub Site Structure, or Site Map structure as an outline or Visio format.
    • What is the current size of the SharePoint content databases? Please provide the name and size for each content database.
    • Is your current SharePoint environment using Search?  If yes, what kinds of search capabilities are used?
      • Out of box search capabilities or third-party tools
      • Sources used in search environment – SharePoint site, file shares, or any other Non-SharePoint environment
      • Search Index File Size
  • Analyze SharePoint 2007 Customizations
    • Have you customized the SharePoint 2007 environment using the SharePoint Designer?
    • Does your SharePoint environment have a customized look and feel – Master Pages, Page templates, Style Sheets, Themes, Custom site logos? If yes, please provide details?
    • Have you customized the SharePoint 2007 environment using custom code? Do you have custom code available? Have you deployed custom code using Solutions Packages and Features framework? Please provide us details.
    • Have you deployed Custom Site Definitions in SharePoint 2007 environment?
    • Does your SharePoint environment contain custom web parts or custom workflows or any custom components – Third party web parts, .NET custom components?  If yes, please provide details.
    • Have you installed “Fabulous 40 Application Templates” in your environment?
  • Analyze SharePoint 2007 Integration
    • Is your SharePoint environment integrated with Email?  If yes, is it integrated with SMTP or Exchange?
    • What version of Office is currently integrated with the SharePoint environment? Office 97, Office XP, Office 2000, Office 2003, Office 2007, or any other
    • Is your SharePoint environment integrated with Microsoft Outlook? If yes, what kinds of Outlook features are integrated with the SharePoint environment – e.g. Calendar, Task Lists, Contact Lists, and Alerts etc.?
    • Is the current SharePoint infrastructure integrated with InfoPath technologies?  If yes, what version is used – InfoPath 2007, InfoPath Form Services, or Office Form Server 2007?
    • Is the current SharePoint infrastructure integrated with SSRS? If yes, what version of SQL Server SSRS is used – SQL Server 2005 or SQL Server 2008?  How many reports are deployed in the current SSRS infrastructure (# of reports)?
    • Is the current SharePoint infrastructure integrated with Office Communication Server for online presence? If yes, what version of OCS is used – OCS 2007?
    • Is the current SharePoint environment integrated with Non-SharePoint systems to present information in SharePoint lists (e.g. Line of Business (LOB) Applications, Business Data Catalogs (BDC) components)?
  • Analyze SharePoint 2007 Backup and Restore Process
    • What are the RPO and RTO of the SharePoint Environment? Is this a Mission Critical System?
    • What kind of backup methodologies are used to backup SharePoint environment? Farm Level backup, Site Collection Backup, Data Protection Manager, or third-party/ISV tools? How often do you backup your SharePoint environment?
    • Have you ever restored the farm from the backups? Do you have formal recovery farm?
    • What kind of backup methodologies are used for Server backups? Are you backing up on Tapes? Do you move the tapes to another location?

Posted in Admin General, Architecture | Leave a Comment »

SharePoint 2010 Deployment Assessment Questionnaires

Posted by nikspatel on January 5, 2011

If you are at the client deploying new SharePoint 2010 installation, use this questionnaire to install and configure the new SharePoint 2010 environment in the organization. This can be during pre-sales process to assess the client requirements and needs. I am planning to update this over time.

  • Basic Information
    • Do you have any existing SharePoint 2007 environment and planning to upgrade to the SharePoint 2010 environment?  If yes, please refer the SharePoint 2007 Upgrade and migration section. If no, are you planning to build new SharePoint 2010 farm?
    • What is the main purpose of the SharePoint 2010 environment? Intranet, Extranet, Document Management System, Digital Asset Management, , or Web Content Management
    • How many users are using the SharePoint 2010 environment? Internal vs. External Users.
    • What is average usage of the SharePoint 2010 environment? Light, Typical, Heavy, or Extreme
    • Do you have any compliance or regulatory needs to isolate the SharePoint Security and SharePoint Content? This would allow you to make single farm vs. multi-farm decisions.
    • Does your SharePoint environment support multi-lingual sites for international users?
    • Do we have any user adoption policy for SharePoint 2010 and end-user training plans?
    • Do we have any governance plans to support the ongoing growth of the SharePoint 2010 usage?
    • Do we have any wireless users accessing SharePoint environment? What are the mobility needs?
  • Feature Analysis
    • Do you plan to use the SharePoint Foundation 2010 or SharePoint 2010 Standard Edition or SharePoint 2010 Enterprise Edition?
    • Do you like to configure the Enterprise Search or High-end FAST search product?
    • Do you have any immediate needs of SharePoint 2010 Service Applications? User Profiles, Managed Metadata, Performance Point, Excel Services, Access Services, InfoPath Form Services, Office Web Applications, and Web Analytics Services
    • What are the needs for the basic social features of the SharePoint 2010 – My Sites, Newsfeed, Wikis, Blogs, Ratting, Tagging, Notes, and Bookmarks etc.? What are the needs for advanced social features of the SharePoint 2010 with NewsGator integration – social sites, micro-blogging, newsfeed, and onboarding etc.?
  • Server Infrastructure
    • Please provide your current Server, Desktop, and IT infrastructure standards
      • What version of Windows Server Infrastructure is used in your organization? Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2? 32-bit or 64-bit?
      • What version of desktop operating system is used in the organization? Windows XP or Windows 7
      • What version of Office is currently used in the organization? Office 2007, Office 2010, or other
      • What version of browser is supported by the SharePoint 2010 environment? Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Mozilla Firefox, Google Chrome
      • Is your SharePoint environment will be deployed on physical servers or virtual servers? If yes, please provide details about preferred virtualization technologies.
      • Is your SharePoint environment accessible from outside of the network? Have you configured any extranet technologies? E.g. UAG
      • Do you have a dedicated Active Directory, Windows Infrastructure, Virtualization, and SQL Server teams?
    • Do you meet following server infrastructure pre-requisites?
      • SharePoint and SQL Server Hardware Requirements – 64bit processor
      • SharePoint Foundation 2010 and SharePoint 2010 are available only as 64bit. It requires 64-bit architecture from top to bottom – 64bit Hardware, 64bit Windows OS, 64bit SQL server, and 64bit SharePoint Server Software. There is no 32-bit version of SharePoint 2010 Products.
      • Windows Server Requirements
        • Windows Server 2008 R2
        • 64-bit edition of Windows Server 2008 Standard with SP2
      • Development Desktops
        • 64-bit edition of Windows 7
        • 64-bit edition of Windows Vista with SP1
      • Database Requirements
        • Microsoft SQL Server 2008 R2
        • 64-bit edition of Microsoft SQL Server 2008 with SP1 and CU2
        • 64-bit edition of Microsoft SQL Server 2005 with SP3 and CU3
      • Browser Support
        • Level 1 – Internet Explorer 7, Internet Explorer 8 (32-bit), Mozilla Firefox 3.5
      • Additional Support
        • Microsoft SQL Server 2008 R2 to work with Power Pivot workbooks
        • Microsoft SQL Server 2008 R2 Reporting Services Add-in for SharePoint Technologies (SSRS) to use Access Services for SharePoint Server 2010
        • Microsoft Server Speech Platform to make phonetic name matching work correctly for SharePoint Search 2010
    • How would you like to configure advanced SharePoint needs?
      • What are your needs for high availability, disaster recovery, backup and restore, and redundancy? Do you have any preferred backup and disaster recovery software? Are you planning to use the OOB SharePoint backup and restore methodologies or use the Microsoft Data Protection Manager?
      • Are you planning to configure and implement SharePoint environment for international users? How are you planning to deploy the SharePoint topology – Geographic topology or Centralized Farm? Are your users will be connected via LAN or WAN to access SharePoint environment?
      • Do you have contact number for your Microsoft representative for licensing discussion?
  • Security
    • Are all your users access the SharePoint 2010 content using their active directory accounts or via multiple authentication systems?
    • Are you planning to have least-privileged SharePoint 2010 installation and configured environment?
    • What are your server anti-virus standards for the Windows Server infrastructure? E.g. MacAfee
    • What are your SharePoint Antivirus needs for SharePoint environment to scan the uploaded documents? E.g. Forefront Antivirus for SharePoint
    • What is your server security updates and patches schedule? Do you install only critical updates? Do you allow automatic updates? Do you test or evaluate the windows update before patching up the production servers?
    • What are your standards for the SharePoint Service Accounts? What are your domain accounts AD password policies? Do you need service accounts configured with automatic password?
  • Monitoring
    • What are your plans to monitor the SharePoint and SQL Server environment? If yes, what technology you prefer?
    • Does your organization use the SCOM and System Center? Are you planning to use SQL and SharePoint Management Pack?
  • Integration
    • Do you have any incoming or outgoing email configured? Can you please provide us the SMTP server and Exchange email-relay configuration?
    • Is your SharePoint environment is integrated with any other Microsoft or Non-Microsoft technologies
      • Microsoft Dynamics CRM
      • SQL Server Reporting Services
      • Lotus Notes
      • SAP
      • OCS or LYNC

Posted in Admin General, Architecture | Leave a Comment »

« Previous Entries
 
Follow

Get every new post delivered to your Inbox.