FBA Migration Guide XTRASHARE INSTALLATION GUIDE. This is the XtraShare installation guide

Transcription

1 XTRASHARE INSTALLATION GUIDE This is the XtraShare installation guide FBA Migration Guide How to migrate from the CodePlex FBA solution to Extradium for SharePoint R i o L i n x s u p p o r r i o l i n x. c o m 3 / 3 1 /

2 2 TABLE OF CONTENTS Introduction... 3 Objectives... 3 Conventions... 3 Why a Migration Guide?... 3 Migration Overview... 4 Step-by-step Migration Procedure... 5 Retrieval of FBA Parameters... 5 Migration Tools Configuration... 5 Removal of Existing FBA Configuration... 7 Extradium Installation and Configuration... 8 Users and Groups SQL and SharePoint Migration... 8 User Verification and Extradium FBA Enablement... 9 User Notification... 9

3 3 INTRODUCTION OBJECTIVES This document provides a step-by-step procedure to migrate an existing SharePoint FBA solution based on the CodePlex SharePoint 2010 FBA Pack solution ( ) to Extradium 2010 for SharePoint. CONVENTIONS The following table lists the acronyms used in this document. Acronym Meaning SPF SharePoint Foundation (v4) MSS Microsoft SharePoint Server 2010 CA Central Administration (refers to a SharePoint server that hosts a Central Administration site) WFE Web Front-End (designates a SharePoint server with the Web Application Role) FBA Forms-Based Authentication, an authentication method that allows users to sign in through a login/password form. WHY A MIGRATION GUIDE? The SharePoint 2010 FBA Pack is based on the default ASP.NET FBA database (created with the aspnet_regsql.exe tool), while Extradium for SharePoint uses its own database (in order to provide more advanced features such as user segregation, administration delegation, etc.). As such, users must be migrated from the ASP.NET FBA database to the Extradium database. This is achieved by a custom.net console application. Furthermore, SharePoint encodes FBA users based on the ASP.NET Membership provider name (and FBA groups or roles based on the ASP.NET Role manager name). For instance, with the values below for the ASP.NET membership provider and role manager, the FBA users and groups tokens in SharePoint will have the following format: i:0#.f FbaMembershipProvider [username] c:0-.f FbaRoleManager [groupname]

4 4 Because Extradium uses specific membership provider and role manager names ( ext and extg respectively), it is also necessary to migrate the existing FBA users in SharePoint, so that they keep their permissions once they re in the Extradium database (otherwise, they would be considered different users by SharePoint). This is achieved by a PowerShell script. Note: This.NET console application will only migrate the login, address, first name and last name of the user (first name and last name are inferred from the Full Name property of the users as stored in the SharePoint site). Important Note: The passwords are not migrated from the ASP.NET FBA database to the Extradium database. Instead, new temporary passwords are randomly generated by the migration tool. Next, you should use the Send credentials to users menu in the Users Management or Groups Management page of the Extradium Central Administration site to send her new password to each user (which she will have to reset when she first signs in with it). MIGRATION OVERVIEW The migration consists of the following high-level tasks: 1. Gather the SharePoint 2010 FBA Pack parameters 2. Configure the Extradium migration console application and PowerShell script 3. Remove the FBA modifications in various web.config files 4. Install Extradium 2010 for SharePoint and configure the Extradium database 5. Run the Extradium migration tools 6. Enable Extradium on your web application s zone. The next sections provide detailed instructions for each of the high-level tasks above.

5 5 STEP-BY-STEP MIGRATION PROCEDURE RETRIEVAL OF FBA PARAMETERS This first task is necessary so that you can properly configure the Extradium migration tools (see next section). 1. Open the SharePoint Central Administration and navigate to the Web Applications List. 2. Select the Web Application where the SharePoint 2010 FBA Pack solution has been deployed 3. Click the Authentication Providers button in the SharePoint Ribbon 4. Select the zone where FBA was enabled 5. Write down the ASP.NET Membership Provider name and the ASP.NET Role manager name you are currently using with the SharePoint 2010 FBA Pack (the screenshot below is an example of possible values, not the values you should have): 6. Press Cancel to exit this page. MIGRATION TOOLS CONFIGURATION 1. If you don t already have a RioLinx account, sign up here in order to download Extradium 2010 for SharePoint and get access to the migration tools 2. Download the FBA Pack-to-Extradium migration tools from this location and extract the zip archive to a folder of one of the SharePoint servers which Extradium will be deployed onto. 3. Open the RioLinx.Extradium.Migration.AspNetFba.exe.config file and configure the following parameters (highlighted in the screenshot below):

6 6 a. SQL Server Instance Name where the ASP.NET FBA is hosted b. ASP.NET FBA Database Name c. Name of the current ASP.NET membership provider name (as retrieved in the previous section) d. Url of the Site Collection where the SharePoint 2010 FBA Pack Forms Based Authentication Management site collection feature is activated 4. Open the MigrateFBAUsersAndRoles.ps1 PowerShell script and modify the following 3 parameters to match your environment: a. Url of the Site Collection where the SharePoint 2010 FBA Pack Forms Based Authentication Management site collection feature is activated b. ASP.NET Membership Provider Name (as retrieved in previous section) c. ASP.NET Role Manager Name (as retrieved in previous section) 5. In order for the.net migration console application to run properly, you must add a few stored procedures to your ASP.NET FBA database: open SQL Server Management Studio and run the extradium _migration_procedures.sql file on the ASP.NET FBA database.

7 7 REMOVAL OF EXISTING FBA CONFIGURATION Because Extradium for SharePoint assumes it is installed in a clean environment (i.e. an environment where FBA has not yet been configured), you must 1) remove all the modifications you previously made to various web.config files (in order to enable Formsbased Authentication) and 2) remove your existing FBA configuration from SharePoint: 1. On each SharePoint Web Front End server, edit the web.config file of the web application s zone where FBA was enabled and remove the following the FBA membership provider and role manager entries. For instance, with the values mentioned above in 5a and 5b, the following entries will be removed: <add name="fbamembershipprovider" connectionstringname="fbaextranet" minrequiredpa sswordlength="4" minrequirednonalphanumericcharacters="0" passwordattemptwindow="5 " enablepasswordretrieval="false" enablepasswordreset="true" requiresquestionandan swer="true" applicationname="/" requiresunique ="true" passwordformat="hashed" type="system.web.security.sqlmembershipprovider, System.Web, Version= , Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /> <add name="fbarolemanager" connectionstringname="fbaextranet" applicationname="/" type="system.web.security.sqlroleprovider, System.Web, Version= , Culture =neutral, PublicKeyToken=b03f5f7f11d50a3a" /> 2. On each SharePoint Web Front End server, edit the web.config file of the SharePoint Security Token Service (in C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\WebServices\SecurityToken) and remove the same provider and role as mentioned above. 3. On each SharePoint Web Front End server where the Central Administration is running, edit the web.config file of the SharePoint Central Administration Web Application and remove the same provider and role as mentioned above. 7. Now, you will need to remove the current FBA configuration from your web application s zone. To do so, open the SharePoint Central Administration and navigate to the Web Applications List. 8. Select the Web Application where the SharePoint 2010 FBA Pack solution has been deployed 9. Click the Authentication Providers button in the SharePoint Ribbon 10. Select the zone where FBA was enabled

8 8 11. In the Claims Authentication Types section, uncheck Enable Forms Based Authentication (FBA) 12. Scroll down and press Save to commit these changes EXTRADIUM INSTALLATION AND CONFIGURATION This section is very short, because the installation procedure is fully documented in the Extradium 2010 Quick Start Guide. Please follow the steps up to the How to initially configure Extradium section and switch to the next section in this migration guide. USERS AND GROUPS SQL AND SHAREPOINT MIGRATION This is the step where users and groups are migrated from the former ASP.NET FBA database over to the Extradium database and where the SharePoint user tokens are updated to match Extradium s membership provider and role manager names: 1. On the SharePoint server where Extradium was installed, run RioLinx.Extradium.Migration.AspNetFba.exe (a log file named FBAImportLog.csv will be generated in the folder where this tool runs) 2. Run the MigrateFBAUsersAndRoles.ps1 from a PowerShell command prompt. The PowerShell command will display the users and groups that are migrated.

9 9 USER VERIFICATION AND EXTRADIUM FBA ENABLEMENT Once the migration has been performed, verify that all your groups and users are available in the Groups Management and Users Management pages of the Extradium Central Administration Site. Follow the instructions in the How to enable Extradium Forms-Based Authentication section of the Extradium 2010 Quick Start Guide to enable Extradium on your web application. USER NOTIFICATION Since all the user passwords have been randomly reset by the migration tool, you should send their new passwords to the migrated users. To do so, you can use the Send credentials to user menu for each user in the Users Management page: Alternatively, you can also send the same s in bulk by using the Send credentials to group s users menu in the Groups Management Page: