SharePoint 2013 Configuration Guidance for 21 CFR Part 11 Compliance Revision 1.00

Transcription

1 SharePoint 2013 Configuration Guidance for 21 CFR Part 11 Compliance Revision 1.00 June 2013 Microsoft Corporation Health and Life Sciences Industry Unit Paragon Solutions Health and Life Sciences Practice

2 Table of Contents Introduction... 4 Acknowledgements... 6 Document Approach... 7 I. Electronic Signature Architecture... 7 Architecture for Electronic Signatures for SharePoint On Premises... 7 Architecture for Digital Signatures for SharePoint on Premises... 8 Architecture for SharePoint on Azure Infrastructure as a Server... 9 Architecture for Digital Signatures on Office Windows Server Microsoft Systems Center Active Directory Domain Services Active Directory Rights Management Server Active Directory Certificate Services What is XAdES? XAdES digital signature levels in Office Time stamping and XAdES-T signatures Active Directory Federation Services SQL Server 2008 R2 and SQL Server Database Security SharePoint Designer II. Electronic Signature Configuration Electronic Signature Use Case Process Flow Components for Electronic Signature Web Service Architecture for Electronic Signatures Configuring SharePoint for Electronic Signatures Workflow Settings for Electronic Signatures InfoPath Task Form Modification for Electronic Signatures Save and Publish Form Final SharePoint Configuration and Testing III. Digital Signature Architecture IV. Configuring the Digital Signature Use Case Administrator Configuration for Digital Signatures Configure Document Library Templates Configure Document Library Version Histories Configuring the enforcement of a digital certificate type Configure Document Templates for Workflow and Digital Signatures Create workflows for digital signatures Add or Change a Collect Signatures Workflow Set Permissions for the Document Library Set Policies for the Document Library V. Using the Digital Signature Use Case Digitally Signing a Document View the Version Histories for Digital Signatures Viewing the Digital Signature Audit in the Document CFR Part 11 Requirements Subpart B Electronic Records Controls for Closed Systems (a) Validation of Systems

3 11.10 (b) Record Review and Inspection (c) Records protection and retrieval (d) System Access (e) Audit Trail (f) Operational System Checks (g) Protect records from unauthorized access (h) Data Input Validation (i) Training (j) Electronic Signature Policy (k) System control Controls for Open Systems Signature Manifestations (a) Signature Manifestation (b) Control of signature information Signature/Record Linking Subpart C Electronic Signatures General Requirements (a) Uniqueness (b) Identity Verification (c) Legal Certification Electronic Signature Components and Controls (a) Non-biometric Signatures (b) Biometric Signatures Controls for Identification Codes/Passwords (a) Uniqueness of identity (b) Password Policy (c) Deactivation of Users (d) Unauthorized use of passwords or identification codes (e) Identification Code Device Testing Systems Validation and Compliance

4 Introduction With the advent of compliance features in SharePoint 2007, Microsoft has continually added capabilities into the SharePoint platform that allow the system even easier compliance with regulations such as 21 CFR Part 11. This whitepaper, developed jointly between Microsoft and Paragon Solutions, details how Microsoft SharePoint 2013 can be configured to be compliant with regulations such as Part 11. Our approach to this document is fairly straightforward: The first section deals with the use cases involved in configuring a system for 21 CFR Part 11 compliance and takes the implementing party step by step through those configurations, with screen shots and where necessary any code or registry settings necessary to complete the system. The second section walks the reader through the 21 CFR Part 11 regulation and details how the configurations listed in the first section and the SharePoint platform as a whole can be used in a Part 11 compliant system. Two notes of importance when approaching this document. 1) No software or hardware system can be 21 CFR Part 11 compliant despite our statements above for ease of understanding. Part 11 compliance and validation are both dependent on how the implementing party uses the system in the context of their own processes. This document provides assistance towards qualification while validation and 21 CFR Part 11 compliance are completely up to the implementing party. 2) Our approach in this document is to take individual use cases and consider their ramifications across distinct architectures. Each architectural approach is treated differently where necessary in both the Use Cases section and in the Part 11 overview section. The three architectures are: a. Microsoft SharePoint 2013 as implemented in the traditional on premises version of SharePoint. b. Microsoft SharePoint 2013 as implemented in an Azure Infrastructure as a Service virtual machine c. Microsoft SharePoint Online as part of Office 365 Again, this document is guidance. It does not guarantee that your implementation will be able to achieve compliance with any given regulation. But it does give you a jump start in your qualification and configuration efforts against 21 CFR Part 11 and thus other relevant regulations for the Life Science industry. 4

5 Disclaimer The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property Microsoft Corporation. All rights reserved. Microsoft, Microsoft Office 2013, Microsoft SharePoint 2013, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, Microsoft Rights Management Services, Active Directory, Windows Server 2008 R2, Windows Server 2012, Windows 8, Windows 7, Windows Vista, Windows XP, Microsoft Windows, Microsoft Forefront, Microsoft Visual Studio and other Microsoft products are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. 5

6 Acknowledgements As with any effort of this size, there are a myriad of persons involved in its development. In this case, the efforts of Paragon Solutions ( in the development of the demonstration system, SharePoint configurations, workflows, SharePoint Designer configurations and sample source code, all of which were absolutely essential for this project to be successful. It is also necessary to acknowledge the Life Sciences Industry Unit members who wrote and reviewed the configuration text, the use cases, regulation interpretation and guided the development of the end product. Finally, it is necessary to acknowledge the efforts of the Microsoft Consulting Services on the 2007 version of this whitepaper, portions of which remain intact especially in the section that maps each part of 21 CFR Part 11 to the needed configuration step. 6

7 Document Approach As mentioned in the introduction, this document is split into two major sections, the first that deals with use cases, workflows and configuration steps and the second that deals with the regulations themselves and how those configurations in the first section may be used to comply with those regulations. Within the use case section are detailed the logical architectures needed to support electronic signatures, the configurations for electronic signatures, the end user flow for electronic signatures, and finally the configurations and end user flows for digital signatures. I. Electronic Signature Architecture Not mentioned in the introduction is a slight change in the approach for the use cases and workflow. In the 2010 version of this document, we took a comprehensive approach, detailing all the possible iterations needed for Part 11 compliance. In this document we take a far simpler approach as Office 2013 permits it. The approach we take in this document is to provide the reader with a single approver workflow use case, either through digital signatures or electronic signatures as defined by Part 11. There are a few advantages to this use case: It is straightforward to implement, with little additional code needed. The single approver use case can be modified to multi-approver workflows, either serial or parallel, through documentation that is readily available from numerous sources. The second approach that we took was to take advantage of the continued support for SharePoint 2010 Workflows. This enabled us to take advantage of both current and previous versions of the Microsoft Platform (Windows Server, Active Directory, and Information Rights Manager). This approach is more version agnostic and allows the implementer to either take advantage of the more current features of SharePoint 2013 and/or build on the platforms that they already have in their data centers. Architecture for Electronic Signatures for SharePoint On Premises 7

8 Windows Server 2008 R2 Windows Server 2012 Active Directory SharePoint 2013 Information Rights Management Microsoft Office 2013 Architecture for Digital Signatures for SharePoint on Premises Windows Server 2008 R2 Windows Server 2012 Active Directory SharePoint 2013 Information Rights Management Microsoft Office

9 Architecture for SharePoint on Azure Infrastructure as a Server Azure Infrastructure as a Service Systems Center Configuration Manager Windows Server 2008 R2 Windows Server 2012 Active Directory SharePoint 2013 Systems Center Operations Manager Information Rights Manager Microsoft Office 2013 Architecture for Digital Signatures on Office 365 While 21 CFR Part 11 Configuration Guidance for SharePoint Online is not provided for Electronic Signatures in detail in this document, it is possible to enable X.509 Digital Signatures in Office 365. As such we provide architectural guidance in this document. It is also important to note that methods for Electronic Signatures on Office 365 are being investigated. There is third-party documented evidence that details how Office 365 can be qualified by implementing parties. We will build on this qualification guidance as we continue to develop electronic signature features on the Office 365 platform in future versions of this document. 9

10 Windows Server 2008 R2 Windows Server 2012 Active Directory SharePoint 2013 Information Rights Management Microsoft Office 2013 Windows Server Windows Server is the basis for all the components needed for regulatory compliance. Some of the key compliance features of inherent in both Windows Server 2008 R2 and Windows Server 2012: The ability to provide Network Access Protection which enforces health requirements by monitoring and assessing the toll of client computers when they attempt to connect or communicate on a network. Client computers that are not in compliance with the health policy can be provided restricted network access until their configuration is updated and brought into compliance with policy. The concept of server roles allows server administrators to quickly and easily configure any Windows -- based server to run a specific set of tasks and remove extraneous 0S code from system overhead. Windows Server 2008 R2 further extends this model would support work more rules in a broadening of current role support. The Server Core installation option is important to mention here as it only includes necessary components for running applications such as SharePoint. Microsoft Systems Center Using Microsoft Systems Center, both Configuration Manager and Operations Manager, further enables compliance by providing capabilities for IQ and OQ, important parts of qualifying the platform. These features include: The ability to provide detailed IQ reports when used with a software distribution system such as Microsoft Systems Center Configuration Manager 10

11 The ability to provide detailed OQ reports when used with the systems management provided through Microsoft Systems Center Operations Manager. Active Directory Domain Services Part of Windows Server Core Infrastructure is Active Directory Domain Services. While SharePoint can utilize an LDAP system, Active Directory provides the means to manage the identities and relationships that make up your organization's network in a way that is easily integrated with the rest of your Microsoft-based infrastructure. It gives out-of-thebox functionality needed to centrally configure and administer system, user, and application settings. Active Directory Rights Management Server The next component in the identity and access management system is Active Directory Rights Management Services (AD RMS). With AD RMS you can augment an organizations security strategy by protecting information through a persistent usage policies, which remain with the information, no matter where it is moved. You can use AD RMS to help prevent sensitive information such as clinical trial reports, site monitoring documentation or even s from intentionally or accidentally getting into the wrong hands. This is configured through the Information Rights Management (IRM) screen which can be applied at the document library or document library template level. It is important to note that users do not have to have Office installed to read protected documents and messages. SharePoint Web Applications understands rights management, so any user with access to a browser and rights to the document can view the document. It is also important to note that users do not need to reside within your organization, as long as they are granted appropriate rights. Any user with a Hotmail account or a LiveID can be granted access to a document and then able to view it through a SkyDrive account or through . Active Directory Certificate Services Active Directory Certificate Services provides customizable services for issuing and managing certificates used in software security systems employing public key technologies. Active directory certificate services allows organizations to deploy a digital certificate infrastructure, creating a web of authentication between devices, users, and applications. AD CD is a role in Windows Server, which provides an integrated public key infrastructure (PKI) that enables capabilities such as digital signatures, strong authentication, and secure communications. These certificates when used in conjunction with Office provide the ability to sign Microsoft Office documents which are compliant with the XML-DSign and XAdES 11

12 standards for digital signatures. Since XAdES forms the basis of other standards such as Safe BioPharma, this system can be integrated into a SAFE-compliant system in a fairly straightforward manner. What is XAdES? XAdES (XML Advanced Electronic Signatures) is a set of tiered extensions to XML-DSig, the levels of which build upon the previous to provide more and more reliable digital signatures. By implementing XAdES, Office complies with the European Union Advanced Electronic Signature Criteria in Directive 1999/93/EC as well as a new Brazilian government directive which defines XAdES as the accepted standard for digital signing in Brazil. Users can digitally sign documents by using Excel 2013, PowerPoint 2013, and Word They can also use Excel 2013, InfoPath 2013, or Word 2013 to add a signature line or signature stamp. Digitally signing a document that has a digital certificate but does not have a signature line or stamp is known as creating an invisible digital signature. Visible and invisible digital signatures both use a digital certificate for signing the document. The difference is the graphical representation in the document when a visible digital signature line is used. More about this aspect of the digital signature will be discussed in the section on Configuring Digital Signatures. By default, Office 2013 creates XAdES-EPES digital signatures, when either a selfsigned certificate or a certificate signed by a CA is used during the creation of the digital signature. The XAdES digital signature levels, which are based on the XML-DSig digital signature standard and available in Office 2013, are listed in the following table. Each of the levels builds upon the previous level and contains all the capabilities of the previous levels. For example, XAdES-X also contains all of the capabilities of XAdES-EPES, XAdES-T, and XAdES-C, in addition to the new functionality that is introduced in XAdES-X. XAdES digital signature levels in Office 2013 Signature level XAdES-EPES (Base) XAdES-T (Timestamp) XAdES-C (Complete) XAdES-X (Extended) Description Adds information about the signing certificate to the XML-DSig signature. This is the default for Office 2013 signatures. Adds a time stamp to the XML-DSig and XAdES-EPES sections of the signature, which helps protect against certificate expiration. Adds references to certification chain and revocation status information. Adds a time stamp to the XML-DSig SignatureValue element, and the T and C 12

13 XAdES-X-L (Extended Long Term) sections of the signature. The additional time stamp protects the additional data from repudiation. Stores the actual certificate and certificate revocation information in addition to the signature. This allows for certificate validation even if the certificate servers are no longer available. Time stamping and XAdES-T signatures Time stamping digital signatures (XAdES-T signatures) is an important scenario we focused on in Office. In order to create a time stamped signature, you ll need to: Set up a timestamp server that complies with RFC Configure signature policy to let the client systems know where to locate the timestamp server. You ll also need to add the timestamp server s root certificate to the root certificate store. Once everything is configured, you can just create signatures like you normally would. A timestamp from a trusted timestamp server extends the life of your signature, because even after the certificate expires, the timestamp proves that the certificate had not expired at the time of signing. As a result, time stamping protects against certificate expiration, and if the certificate was revoked after the signature was applied, the signature is still valid. Additional information on Planning Digital Signature Settings can be found on Microsoft Technet at and further in this document in the section on Configuring Digital Signatures. Active Directory Federation Services While not a hard and fast requirement for Part 11 compliance, ADFS provides simplified access and single sign-on for on premises and cloud-based applications in the enterprise, across organizations, and on the web. In the case of access to compliant SharePoint sites, it allows IT administrators and end users to grant access to known entities, even users outside their organizational boundaries. ADFS and SharePoint together accomplish this by using SAML 2.0 standard claimsbased authentication and security. Once the ADFS servers of two organizations are pointed at each other through a simple configuration, end users from both organizations are free to collaborate, participate in workflow and even execute electronic or digital signatures in both organizations SharePoint sites. 13

14 SQL Server 2008 R2 and SQL Server 2012 Both Microsoft SQL Server 2008 R2 and SQL Server 2012 contain a complete set of enterprise ready technologies and tools that provide the database and business intelligence technologies for SharePoint and many of the other Microsoft platforms. As a database management platform, SQL Server manages databases more efficiently and effectively. It provides your people with built-in tools for greater control and oversight. It manages at scale, automate automates tasks, and streamlines troubleshooting. As the business intelligence platform, it is a comprehensive platform for business intelligence that includes enhanced reporting, deeper and more powerful analysis, rich data modeling, master data management capabilities, and full integration with Microsoft Office. Microsoft SQL Server also provides the database and business intelligence platform for SharePoint 201e. This better together capability means that not only does SQL Server store the objects and configurations of SharePoint, but it also provides on-demand and self-service business intelligence, list generation and PowerPivot capabilities. Database Security 21 CFR 11.10(d) notes that access to IT applications must be limited to authorized individuals. In addition to internal safeguards built into a computerized system, external safeguards and policies should be put in place to ensure that access to the computerized system and to the data is restricted to authorized personnel. Staff should be kept thoroughly aware through training and procedures of system security measures and the importance of limiting access to authorized personnel. Procedures and controls should be put in place to prevent the altering, browsing, querying, or reporting of data via external software applications that do not enter through the protective system software. IT guidelines, standard operating procedures and controls typically ensure that access to back-end servers and applications is controlled. There is a potential security issue where a person with elevated permissions to the WSS-Content-Database could alter records in the database table and impact the Signed Person, Date signed, and Purpose of Signing tables. Per typical IT operating measures, people with elevated permissions are typically authorized and working under strict operating procedures. The likelihood of malicious changes is low. However, if someone did alter the underlying database tables, SharePoint will not recognize these changes; hence the signature would become invalidated. There are other options for achieving this level of check and balance to ensure that a malicious activity at the database level is discovered and accounted for. However, for most organizations internal IT operating procedures preclude unauthorized access to servers and applications. 14

15 SharePoint Designer SharePoint Designer is the mechanism the IT Professionals and Power Users can use to create workflows, design custom pages and other tasks that are not available in the SharePoint interface itself. 15

16 II. Electronic Signature Configuration The following use case details the configurations and resulting process for applying an electronic signature to a document. Again, note that this use case can be modified for multiple signatures, parallel or serial, in a straightforward fashion using the Workflow Manager tool. The description of using that tool will be provided as we go through the workflow. Electronic Signature Use Case Process Flow Start User enters data All Fields Entered Authenticate AD Active Directory Valid? Render Error Message Complete Signature Task Workflow Update List Item to Signature Collection = completed Declare Record End 16

17 Components for Electronic Signature To handle the signing signature referred to in Part 11 documentation, a couple departures from standard SharePoint are needed. The first is an InfoPath form that captures the username and password of the person signing the record. The second is a web service that authenticates that user. The third is a workflow that handles the approval from start to finish. To accomplish this there are a few components necessary to configuring and developing the workflows and approvals necessary to handle Part 11 compliant electronic signatures on SharePoint Web Service for Approval Signatures SharePoint Configuration InfoPath Task Form Modification Workflow SharePoint Configuration Finalization Testing Web Service Architecture for Electronic Signatures To handle the approval signature portion, we have made a key architectural improvement by enabling the signature authentication to be conducted from a Web Service. This has the advantage of platform independence in that the web service can be run onpremises or in a public or private cloud environment. In the on premises implementation or on the Azure IaaS implementation, the web service is contained within the server itself. In the Office 365 / SharePoint Online implementation, the web service may be contained in either an Azure Web Service (calling the Azure Active Directory) or within a Custom Activity calling an Azure Web Service. We give you this information as guidance to what our current thinking may be this may change as development continues. Within the web service there are three steps that we will review: Building Deploying Testing 17

18 Building Web Service for Electronic Signatures The web service solution can also be downloaded from Creating the Web Service Solution Step by Step Visual Studio Setup 1. Open Visual Studio (E.G. Visual Studio 2010) Start > All programs > Microsoft Visual Studio 2010/2013 > Microsoft Visual Studio 2010/ Select File > New > Project - Use SharePoint 2010 Template Empty SharePoint Project 3. Name the Project and Solution Name = ADUserQuery 4. Click OK 5. Deploy as a Farm Solution and provide a local site for debugging (Your solution will not be automatically deployed here) 6. Click Finish 7. Add all references if they do not exist(usually under.net tab or browse to them may have to search your computer first) a. Microsoft.SharePoint b. Microsoft.SharePoint.Security c. System d. System.Core e. System.Data f. System.Data.DataSetExtensions g. System.DirectoryServices Path=C:\windows\microsoft.NET\Framework\v \System.Director yservices.dll h. System.Web.Services i. System.Xml j. System.Xml.Linq 8. Remove all references that are not needed a. System.Runtime.Serialization b. System.ServiceModel c. System.ServiceProcess 9. Right click on the solution root It should say ADUserQuery a. Add SharePoint Layouts Mapped Folder 10. Right click on the solution root It should say ADUserQuery a. Add Class b. Choose Windows Service c. Name it - ADQueryClass.cs d. Click Finish e. Expand ADQueryClass.cs f. Delete ADQueryClass.Designer.cs 11. Right click ADUserQueryClass.cs and View Code 18

19 a. Click inside the code window press Control +A b. Delete all Code c. Copy ( AdUserClass.cs Section) and Paste code from below into AdUserClass.cs code window 12. Expand Layouts, then right click on ADUserQuery folder a. Add Class b. Choose Windows Service c. Name it = ADCustomWebService.asmx d. Delete - ADCustomWebService.Designer.asmx e. Copy and Paste code from below into ADCustomWebService.asmx code window 13. Right Click Features and Add Feature a. Name it = ADUserQuery (Right click Featrure 1 and rename) b. Open up feature and rename the title to ADUserQuery as opposed to ADUserQuery.feature1 14. Expand Package a. Open Package.package (Double click on it) b. Move ADUserQuery (ADUserQuery) into the Items in the solution section c. Items in the package section should only have Layouts (ADUserQuery) with a single file - ADCustomWebService.asmx in it. Your Solution should look like this Strong Name your assembly 15. In Visual Studio, Go to Tools > External Tools. 16. Click on Add to add a tool, and put in the following values: 19

20 a. Title: Strong Name b. Command: Powershell.exe c. Arguments: -command "[System.Reflection.AssemblyName]::GetAssemblyName(\"$(TargetPath) \").FullName" d. Check Use Output Window 17. Uncheck everything else here s how it should look 18. In your project, go to Tools > Strong Name 19. In the output window, it will give you the assembly name All you will need is the PublicKeyToken 20

21 20. Right click and View Code for ADCustomWebService.asmx file 21. Copy your newly generated and paste that replacing the PublicKeyToken with your new one that you just generated 22. Close out all open forms and code pages and save when prompted 23. Right click on the solution ADUserQuery and build solution If no errors exist then proceed to next step a. If errors exist, fix them 24. Right click on the solution ADUserQuery and package Code Filename = ADQueryClass.cs using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Web.Services; using System.DirectoryServices; namespace ADUserQuery { class ADQueryClass : WebService { 21

22 [WebMethod] public string ValidateActiveDirectoryLogin(/*string domain,*/ string username, string password) { Boolean success = false; string fullname = string.empty; //DirectoryEntry Entry = new DirectoryEntry("LDAP://" + domain, username, password); DirectoryEntry Entry = new DirectoryEntry(); Entry.Username = username; Entry.Password = password; DirectorySearcher searcher = new DirectorySearcher(Entry); searcher.searchscope = System.DirectoryServices.SearchScope.Subtree; try { searcher.filter = "(SAMAccountName=" + username + ")"; //searcher.propertiestoload searcher.propertiestoload.add("cn"); System.DirectoryServices.SearchResult results = searcher.findone(); #region OtherProp //var userfullname = results.getdirectoryentry().properties["cn"].value.tostring(); //var a1 = results.getdirectoryentry().properties["displayname"].value.tostring(); //var a2 = results.getdirectoryentry().properties["name"].value.tostring(); //var a3 = results.getdirectoryentry().properties["samaccountname"].value.tostring(); #endregion var first = results.getdirectoryentry().properties["givenname"].value.tostring(); var last = results.getdirectoryentry().properties["sn"].value.tostring(); success = (results!= null); if (success) { fullname = first + " " + last; } } } catch (Exception) { success = false; //lblmessage.text = "Error: " + ex.message; } return fullname; } } 22

23 FileName = ADCustomWebService.asmx This string is partially created by your strong name (The Bold is code you can reuse. The Underlined will have to come from your strong name public key token output.) <%@ WebService Language="C#" Debug="true" Class="ADUserQuery.ADQueryClass, ADUserQuery, Version= , Culture=neutral, PublicKeyToken=eab87ead4547e21c" %> Building, Packaging and Deploying the Solution Building the Solution Step 1: Open Web Service Solution Open Visual Studio Web Service Solution, Right Click on Package Open Visual Studio Web Service Solution; Right click and package Step 2: Solution Copy from Development to Production Copy solution from your Dev to your Test or Prod environment Navigate to: Your solution s bin\debug directory where the WSP was packaged to, then open up your deployment directory on your production Web Server 23

24 Step 3: Add the Solution to your Solution Store Add spsolution Provide the literal path that would include the file name Navigate to: Start > All Programs > Microsoft SharePoint 2013 Products > SharePoint 2013 Management Shell 24

25 Deploying the Web Service Step 1: Within Solution Properties, click on Deploy Solution Navigate to: Start > All Programs > Microsoft SharePoint 2013 Products > SharePoint 2013 Central Administration; Navigate to System Settings > Farm Management = Manage Farm Solutions > Click on aduserquery.wsp Step 2: Deploying Solution Continued Within the Deploy Solution Dialog, Choose Now to deploy now and click on OK 25

26 Testing the Web Service Step 1: Check the Web Service Root Web App URL + _Layouts + Folder Name + Web Service Name.asmx = Web Service URL E.G. 26

27 Step 2: Check the Web Service WSDL URL Append?WSDL to the end of your Web Service URL E.G. - E.G. 27

28 Configuring SharePoint for Electronic Signatures There are a few basic steps to configuring SharePoint for Electronic Signatures: Activate Site Collection Features Create Content Admin Security Group Record Declaration Settings Library Permissions Version and Audit Settings Step 1: Activate Site Collection Features The two site collection features needed for both the electronic signatures and the digital signatures are the In Place Records Management and Workflow Navigate to: Site Contents > Settings > Site Collection Features Step 2: Create New Content Admin Security Group The purpose of this SharePoint Security Group is for isolation of list administrators at the document library level. We will create it, then add it to our document library. List administrators will have the ability to delete and modify undeclared records. The next step is to create a new content admin security group that will be used to limit the rights of the content administrators of Part 11 compliant document libraries. Navigate to: Site Contents > Settings > Site Permissions > Create Group 28

29 Step 3: Security Group Permissions Action: Choose Full Control for the Security Group Permissions in the Create Group Dialog Click Create 29

30 Step 4: Adding your Content and List Admins The Users in this group will have the ability to undeclared records if need be. You now want to add the content and list admins to the newly created security group. Navigate to: Taken here by previous step Action: Add ONLY proposed List Administrators to this group. Step 5: Site Collection Record Declaration Settings The next step is to set the site collection record declaration settings. This will set how documents are treated within the site collection once they are declared to be a record. Navigate to: Home > Site Contents > Settings > Record Declaration Settings Actions: Set Record Declaration Settings: o Block Edit and Delete o Not available in all locations by default o All list contributors and administrators o Only list administrators Click OK 30

31 Step 6: Create the Document Library for Electronic Signatures Navigate to: Home > Site Contents > Add an App > Document Library Action: Name the document library Step 7: Set the Library Record Declaration Settings Navigate to: Home > Site Contents > Settings > Site Libraries and Lists > Customize esig Documents Actions: 31

32 Click on Record declaration settings Set the library record declaration settings: o Use the site collection default setting Click OK Step 8: Set Library Permissions Navigate to: Same navigation as previous step Actions: Set unique permissions and remove all other groups except the minimal groups seen below Add Content Admin Security group to library Set ONLY Content Admin Security Group to Full Control 32

33 Step 9: Turn on Library Versioning Settings Navigate to: Same navigation as previous step Actions: Set Versioning Settings o Require content approval for submitted items? No o Create major versions - minimum Click OK Step 10: Configuring Site Auditing Settings Once all the permissions and library settings are complete, it is time to set the site collection audit settings. Navigate to: Home > Site Content > Settings > Site Collection Audit Settings Action: Set the Site Collection Audit Settings o Automatically trim the audit log for this site? No o Documents and Items > Specify the events to audit: Select all o List, Libraries and Sites > Specify the events to audit: Select all 33

34 Workflow Settings for Electronic Signatures There are five basic parts to set the workflow settings for electronic signatures, with multiple steps within each part. Those parts are: Copying and modifying a workflow Setting messages Setting Record Declaration Action Save and Publishing Workflow Viewing Available Site Workflows Copying and modifying a workflow Step 1: Open SharePoint Designer 2013 Open Site Navigate to: Start > All Programs > Microsoft Office 2013 > SharePoint Designer 2013 > Click Open Site > Type in the URL of your Site Action: Input the appropriate site name Enter any credentials as necessary 34

35 Step 2: Copy and modify existing out of the box workflow Actions: Click Workflows in the left navigation Right click on the collect signatures workflow Select Copy and Modify 35

36 Step 3: Name the copied workflow Actions: Fill in with the name for the new workflow Click OK Click Save 36

37 Modifying the Message These steps will modify the message sent to those who need to approve or sign the document record. Step 1: Edit the new workflow Actions: Right Click on your new workflow Select Edit Workflow Left Click on Collect Signatures Workflow Task Left Click on Change the behavior of a single task Step 2: Update Task Information in Actions: Update the Current Task: Assigned To Update Workflow Context: Initiator 37

38 Step 3: Modifying the Current Task: Assigned To Actions: Insert new line in the workflow Change the Hyperlink 38

39 Step 4: Modify the Task Completion Hyperlink Actions: Click Add or Change Lookup Change the Data Source Change the Field From Source 39

40 Step 5: Change the Task Completion Conditions Click Change the Completion Condition for this Task Process 40

41 Step 6: Insert a New Action: Declare Record Click on the space before then End Task Process Click on Insert Action : Declare Record 41

42 Save and Publish the Workflow Click on Save Click on Publish 42

43 Viewing Available Site Workflows Navigation to: Home > Site Contents > Settings > Site Libraries and Lists > Customize esig Documents > Workflow Settings > Step 1: Navigate to the Site Library Verify the New Workflow is in the Site Library 43

44 InfoPath Task Form Modification for Electronic Signatures The InfoPath Task Form is necessary for capturing the electronic signature. Add New Web Service Data Connection Add new fields Add Authentication View Add Rules Save and Publish To begin, Open SharePoint Designer 2013 with a blank form and add in any design elements you desire. Add New Web Service Data Connection Step 1: Create new receive data connection Navigate to: Start > All Programs > Microsoft Office 2013 > SharePoint Designer 2013 > Click Open Site > Type in the URL of your Site > Click on workflows > Click on your copied workflow > Click on Collect Signature Workflow Task Form in the Forms Section of SharePoint Designer 2013 > Click Data Tab > Click Data Connections Actions: 44

45 Add Connection Create anew connection to: o Receive Data Click Next Step 2: Select source of data Navigate to: From previous dialog Actions: SOAP Web Service Click Next 45

46 Step 3: Insert Web Service definition: Navigate to: From previous dialog Actions: SOAP Web Service Defintion Click Next 46

47 Step 4: Data Connections List Navigate to: From previous dialog Actions: Choose remaining defaults Uncheck Automatically receive data when form is opened check box ValidateActiveDirectoryLogin - Data Connection now available 47

48 Add New Fields to InfoPath Forms Navigation to: Click on Data Tab > Show Fields > Show Advanced view > Right Click myfields > Add group > provide the names seen above Step 1: Actions: Right click myfields > Click add 48

49 Step 2: o o o o Actions: Set ValuesName = AuthenticationGRP Type = Group Repeating = unchecked Click OK 49

50 Step 3: Navigation to: Right Click my:authenticationgrp Group > Add Field > provide values below Actions: Set Values o Name = UserID o Type = Field o Data type = Text o Default Value = blank o Repeating = unchecked o Cannot be blank = unchecked o Click OK 50

51 Step 4: Navigation to: Right Click my:authenticationgrp Group > Add Field > provide values below Actions: Set Values o Name = UserPassword o Type = Field o Data type = Text o Default Value = blank o Repeating = unchecked o Cannot be blank = unchecked o Click OK Step 5: Navigation to: Right Click my:authenticationgrp Group > Add Field > provide values below Actions: Set Values o Name = Results o Type = Field o Data type = Text o Default Value = blank o Repeating = unchecked o Cannot be blank = unchecked o Click OK Step 6: Actions: Right click myfields > Click add 51

52 Step 7: o o o o Actions: Set ValuesName = AuthenticationErrorMessage Type = Group Repeating = unchecked Click OK Step 8: Navigation to: Right Click my:authenticationerrormessage Group > Add Field > provide values below Actions: Set Values o Name = ErrorMessage o Type = Field o Data type = Text o Default Value = blank o Repeating = unchecked o Cannot be blank = unchecked o Click OK Step 9: Navigation to: Right Click my:authenticationerrormessage Group > Add Field > provide values below Actions: Set Values o Name = ErrorFlag o Type = Field o Data type = True/False o Default Value = FALSE o Repeating = unchecked o Cannot be blank = unchecked o Click OK Step 10: Navigation to: Right Click my:authenticationerrormessage Group > Add Field > provide values below Actions: Set Values o Name = ErrorMessageNote o Type = Field o Data type = Text o Default Value = blank o Repeating = unchecked o Cannot be blank = unchecked o Click OK Add Authentication View Navigation to: Click on Page Design Tab > New View Step 1: Name the View = Authentication View 52

53 Step 2: Insert Tab > custom Table = 5 Row x 3 Column Step 3: Add UserID and UserPassword from AuthenticationGRP into top two middle columns of the two top rows > color text of UserPassword Field White Step 4: Add button Call It Submit Step 5: Merge cells on rows 4 and 5 > Add UserID and UserPassword from AuthenticationErrorMessage group into Table on rows 4 and 5 Step 6: Insert default values into fields, color them bold red and make them read only Adding Rules into the InfoPath Form Adding Rule to Submit Button Navigation to: Click on Submit Button > Click on Home Tab > Manage Rules 53

54 Step 1: Set UserName = UserID Create new rule Condition = none Action add Set a fields Value where Field=username and value=userid 54

55 55

56 Step 2: Set Password New - Action add Set a fields Value where Field=password and value=userpassword 56

57 Step 3: Add Query for Data New - Action add Query for Data; Data connectiovalidateactivedirectorylogin 57

58 58

59 Step 5: Add Active Directory Logon Result Continue Rule 1 New - Action add Set a fields Value where Field=results and value=validateactivedirectoryloginresult 59

60 60

61 Create Rule 2 Authentication View Submit Button Step 1: Create new rule Step 2: Set Condition where Results = Blank 61

62 Step 3: Add Error flag Add Set a field s value where Field=ErrorFlag and value=true() 62

63 Create Rule 3 Authentication View Submit Button Step 1: Click New Rule (Rule 3) Step 2: Set Condition where results = blank 63

64 Step 3: Add Action = Submit data; Data Connection = Signed Step 4: Add Action Close this form Create Rule 1 Main View Sign Button Navigation to: Click Page Design Tab > Change view to Main View > Click on Sign Button > Click on Home Tab > Click Manage Rules Step 1: New Rule; Conditions = none 64

65 Step 2: Set action = Switch Views; Views = Authentication View 65

66 Save and Publish Form Quick Publish 66

67 Save Form to Local System Publishing Completed 67

68 Final SharePoint Configuration and Testing There are two parts to the final SharePoint Configuration and Testing: Adding the workflow to the document library Testing the new workflow Adding the Workflow to your library Step 1: Choose your newly published workflow Step 2: Name the workflow Step 3: Create a new task and history list Optional Choose a Default Signer 68

69 Test the New Signature Process Navigation to: Home > Site Contents > esig Documents 69

70 Step 1: Begin the Signature Process Upload a document to the library o Click Files Tab o Click upload document then browse and click ok Start the esig- Workflow o Click Ellipsis next to document name o Click the Ellipsis in the next window o Click on workflows Step 2: Choose a Signer 70

71 Step 3: Signer Receives with Instructions Step 4: Signer is brought to their history and tasks 71

72 Review document before signing Click task link for Task Form 72

73 Step 5: Task Form Main View Click Sign Step 6: Task Form Authentication View Insert your password Receive message if wrong password is typed Click Submit 73

74 Step 7: esig Workflow = Completed Lock is displayed showing declared Record esig-workflow Status = Completed Step 8: Compliance Details on Document Policy Status Record Declaration Status 74

75 Step 9: Showing Workflow Completed 75

76 76

77 III. Digital Signature Architecture The following use cases will detail the configurations and resulting process for applying a digital signature to a document either in a single signature scenario or in a multiple signature scenario. Windows Server 2008 R2 Windows Server 2012 Active Directory Rights Management Services SQL Server 2008 R2 SQL Server 2012 SharePoint 2013 Certificate Services FAST Enterprise Search Document Mgmt Policy Mgmt Workflow Records Mgmt Electronic & Digital Signature Workflow While the overall architectural components are important, it is also key to identify proper organization, sizing of the server farm, navigation and other concepts. Those elements are largely outside scope of this document. For information on the concepts of sizing, navigation and geographical disbursement, please visit as well as for best practice information on SharePoint implementation on an enterprise scale. 77

78 IV. Configuring the Digital Signature Use Case Administrator Configuration for Digital Signatures Similar steps are required for creating workflows for Digital Signatures as they are for Electronic Signatures. Configure Document Library Templates Creating the document library templates is essential, as this provides the signature blocks that will be used during the X.509 certificate signature process. As with the electronic signatures, you first select the document library that will be used for the Digital Signatures. When there, click on the Library Tools > Library tab in the Ribbon Bar. This brings you to the Document Library Settings page which enables you to add the necessary columns for digital signatures. Configure Document Library Version Histories While digital signatures are more secure than electronic signatures, it is still important to create and set version histories for the audit trail capabilities of the document library. The steps for doing this are the same as for configuring electronic signatures. Configuring the enforcement of a digital certificate type Inserting the appropriate registry settings to enforce a type of digital certificate is extremely important. This will provide the type of certificate that complies with 21 CFR 11. These settings are per user and can be easily enforced via a GPO (Group Policy Object) or logon Script. These settings enforce the minimum requirements for a digital certificate. What they do not enforce is a compliant Time Server. In order for a digital certificate to comply with 21 CFR 11, the Time Server also has to comply with RFC Please ask your domain administrator if your Domain Controllers comply with this policy. Action: Create a registry file: 1. Open up notepad 2. Insert text from below 3. Save file as signature.reg 4. Double click on file or right click and merge 78

79 This is an EXAMPLE Registry setting: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Signatures] "XAdESLevel"=dword: "MinXAdESLevel"=dword: "TimestampRequired"=dword: "TSALocation"=" "LastSigningCert"=hex:52,a6,c8,4b,5d,4a,e4,18,3c,d0,4d,7c,5b,a4,8b,af,0f,17,82,\ d0 "SignatureUISettings"=dword:000001c3 Configure Document Templates for Workflow and Digital Signatures Setting the document templates for digital signatures is straight forward. First you need to set the document library to open documents in the client application not the browser. Once that is complete, you create the document template inside Word 2013 that has the document signing block. The final step is to create workflow that sends the document for final approval. Open Documents in the Client Not Browser Step 1: Set Documents to Open in Word 2013 Navigate to: Document Library > Document Library Settings > Advanced Settings 79

80 Step 2: Open in Word 2013 Action: Select Open in the Client Application Click OK Create the Word Template Step 1: Create the Word Template Navigate to: Document Library > Document Library Settings > Advanced Settings Action: Click Edit Template in the Document Template section under the Template URL 80

81 Step 2: Add the Signature Block to the Word Template To add a visual representation of a signature, it is necessary to add a signature block to the template. You can add as many signature blocks as will be necessary for the workflow and document type. Navigate to: Insert > Signature Line > Microsoft Office Signature Line Step 3: Add details to the Signature Block Action Complete details in the Signature Block 81

82 Create workflows for digital signatures Creating workflows that utilize digital signatures is actually more straightforward than for electronic signatures. These workflows can either be created in SharePoint itself, or through SharePoint Designer. In fact, as mentioned previously, SharePoint 2013 contains out of the box workflows for digital signatures called Collect Signatures. This is the same signature workflow as copied for use in the Electronic Signature use case. Add or Change a Collect Signatures Workflow The Collect Signatures Workflow is as defined in the electronic signatures section. Set Permissions for the Document Library These steps are the same as for electronic signatures. Set Policies for the Document Library These steps are the same as for electronic signatures. V. Using the Digital Signature Use Case The Digital Signature Use Case is very straight forward: Creating a new document from the document template for that document library, right click on the signature block, select sign (with a digital signature) and provide the signature. The signature marks the document as final and prevents further revisions to the document. This workflow mechanism minimizes the need to declare the document to be a record, as the signed version of the document is immutable: it cannot be changed without invalidating the signature. Of course, it is possible to view all the version histories of the document, with all the same versioning and audit trail mechanisms possible as with the electronic signatures. 82

83 Digitally Signing a Document Step 1: Open the Template Document from the Library Actions: Click on New Document in the Document Library Step 2: Author document as necessary, making necessary changes Step 3: Initiate Collect Signatures Workflow Step 4: Sign the Document 83

84 Step 5: Define the Signature New to Office 2013 is the ability to determine the type of signature and the reason for signing. This is particularly important for 21 CFR Part 11. Not shown is the signing ceremony, where the user choose the digital certificate they want to use for the signature and provide the PIN or Password for the certificate. Action: Define Commitment Type Define Purpose for Signing 84