Integration Package for Microsoft Office SharePoint3

Transcription

1 Panorama NovaView 5 Integration Package for Microsoft Office SharePoint3

2 About the Integration package Release Notes This package applies to the Panorama NovaView Server and the Microsoft office SharePoint3. The information is detailed in the following sections: Panorama Integration package installation. Included installation files Panorama Single Sign-on Installation Panorama Integration package Automatic Installation This section describes the steps required to automatically install the Panorama Web Parts. Notes Install Panorama NovaView Planned Fix PN PN before Panorama NovaView Integration package for Microsoft Office SharePoint3. 1. Close all SharePoint pages. 2. Create a temporary directory. 3. Copy the installation files to the temporary directory. 4. Run the PanoramaWPInstaller.msi. You should see the welcome screen

3 5. In the Panorama NovaView Server step enter the name of the Panorama NovaView Server (NOTE: the screenshot below gives an example of Panorama and SharePoint installed on the same machine. If that is not a case, please type the panorama server name in this filed) 6. Select the desired installation folder: 7. Finish the installation process.

4 Included Installation Files PanoramaWPInstaller.msi setup.exe

5 Panorama Single Sign-on Installation Panorama Web parts use Single Sign-On technology. Microsoft Single Sign-On (SSO) is a service that installs with Microsoft SharePoint. It manages a list of the users who will need to sign on once, from that point on the system will recognize them. Copying Panorama WebParts Files 1. The first stage is to decide on an account that will be the administrator for SSO. It preferred to be a domain account, and it will be referred in this document as SSO Admin. 2. Open Computer Management, and add the SSO Admin to the IIS_WPG group. 3. Create folders: Panorama.WebParts under \Inetpub\Panorama.WebParts SsoLogin under \Inetpub\Panorama.WebParts\SsoLogin Bin under \Inetpub\Panorama.WebParts\SsoLogin\Bin 4. Right click on Panorama.WebParts and select Properties. Add the Group IIS_WPG with full control 5. Use the following table to copy files from the Panorama\EBI\Portal directory. If folders do not exist, please create them: File SSoLogin\SsoLogin.aspx SSoLogin\Panorama.gif SsoLogin\Web.config SSoLogin\SsoLogin.dll Name Destination Inetpub\Panorama.WebParts\SsoLogin Inetpub\Panorama.WebParts\SsoLogin Inetpub\Panorama.WebParts\SsoLogin Inetpub\Panorama.WebParts\SsoLogin\Bin 6. Open the file Settings.xml that is placed in \ Program Files\Common Files\Microsoft Shared\web server extensions\wpresources\panorama.webparts\ ae0aaac5fd5fc0 via Notepad and change the following XML elements: SsoSignApp: The URL to SsoLogin.aspx. Remember that you assigned a new port number to the web site Panorama.WebParts. The URL should follow this format: UseSSO: Change the value of the UseSSO key to True. <add key="usesso" value="true" />

6 Configuring SSO in SharePoint Admin To configure the SSO: 1. From the administration tools, open the Services window. Find Microsoft Single Sign-On Service and select it. 2. In the General tab, change the startup type to Automatic. 3. In the Logon tab, change the logon account to the SSO Admin acount. 4. Open SharePoint Portal Server Single Sign-On Administration by clicking on Start, SharePoint Portal Server, and SharePoint Portal Server Single Sign-On Administration. 5. In the SharePoint Portal Server Single Sign-On Administration page, click on the link Manage Server Settings for Single Sign-On and Enterprise Application Definitions. 6. Enter the SSO Admin account in the fields Account Name for Single Sign-on and Account Name for Enterprise Application Definitions, and click OK..

7 7. In the SharePoint Portal Server Single Sign-On Administration page, click on the link Manage settings for enterprise application definitions. 8. In the page that opens, click on Add Item. 9. In Create Enterprise Application Definition, enter the following values: Display name: Panorama.WebParts Application Name: Panorama.WebParts Contact: a valid address Account type: Individual Field 1: UserName Field 2: Domain Field 3: Password. Select this field to be masked.

8 Configuring IIS 1. Open Internet Information Services (IIS) Manager from the administration tools. 2. Right-click on the folder Application Pool, and select the option New, Application Pool. Enter Panorama.SsoLogin.Pool as the Application Pool ID, and click OK. 3. Right-click on Panorama.SsoLogin.Pool, and select Properties. 4. Click the Identity tab and select the Configure option. Enter the user name and password of the SSO Admin account. 5. In the Internet Information Services (IIS) Manager, right-click on the Web Sites folder, and select New, Web Site.

9 6. Enter the following information: Description: Panorama.WebParts. TCP port: Change the port to 81 or any other available port (Microsoft SharePoint uses port 80). The path of the site home directory is Inetpub\Panorama.WebParts. Click Next until the end. 7. Open the new web site. A SsoLogin folder will be under it. 8. Right-click on this folder and select Properties. In the Directory tab, click on the Create button and change the Application Pool to Panorama.SsoLogin.Pool. 8. Click the Security tab. There are two security configurations that can be set: Option 1: Open the internet options of the IE browser, if the check box Enable Integrated Windows Authentication is checked then the web site security need to be set on Enable anonymous access and the user account set to SSO Admin account and password.

10 Option 2: if the IE browser check box Enable Integrated Windows Authentication is not checked then the web site security need to be set on Integrated Windows Authentication 9. Close the IIS window.

11 Run NovaView Web Parts With Kerberos Authentication The alternative to using SSO (Single Sign-On) service to run Panorama NovaView Web Parts for SharePoint is to use Microsoft Security Delegation, which brings us back to fixing SharePoint authentication issues. Microsoft has an excellent KB article on how to go about fixing SharePoint to work with Delegation. How to configure a SharePoint Services to use Kerberos authentication Problem with that MS KB article is too technical oriented, so this is an approach to summarize steps needed to be taken to setup Kerberos Authentication 1. Novaview and SharePoint servers need to be trusted for delegation on the Domain controller, (NOTE: If you don't see the delegation tab, check the Domain functional level This is the Panorama server

12 2. Service Account running Novaview service must be trusted for delegation

13 3. If you have went over the Microsoft KB article you might have noticed this command setspn -A HTTP/ServerName Domain\UserName You will need to download setspn.exe from Microsoft. An actual working command line will look like this: (in our example SharePoint2007 is the machine, and PanoramaSupport\TestAdmin, is our Domain and User running the SharePoint service, also the IIS Application pool user for SharePoint.) setspn -A HTTP/SHAREPOINT2007 PanoramaSupport\TestAdmin setspn -A HTTP/SHAREPOINT2007.PANORAMASUPPORT.NET PanoramaSupport\TestAdmin If the command was successful you should get this message NOTE: We advise to add both names, computer name and FQDN as well, 4. Repeat the same step for the novaview server, for example setspn.exe -A HTTP/NOVAVIEW PanoramaSupport\TestAdmin setspn.exe -A HTTP/NOVAVIEW.PANORAMASUPPORT.NET PanoramaSupport\TestAdmin where NovaviewServer is the server name for Panorama Novaview and TestAdmin is the account that is running Novaview service To list SPN use -l option, in this example JOHN is the Novaview server: 5 Enable Kerberos Authentication on IIS Microsoft has this KB article how to configure Kerberos on IIS Find your SharePoint web site IDENTIFIER in IIS.

14 As you might have noticed from the picture, a default SharePoint installation using the Default Web Site will usually have the default ID of 1. If that match your installation then you can execute this command: cscript adsutil.vbs set w3svc/1/ntauthenticationproviders Negotiate,NTLM Otherwise replace the 1 in the command line with the number that matches your installation, for example If the command was run successfully then you should see this message It is recommended to Restart the Machine itself, for all the changes to take effect. Restarting the IIS service (IISRESET command) alone might not be enough sometimes. NOTE: Besides this we have notices that you can enable Authentication by just simply running the command in the following way cscript adsutil.vbs set w3svc/ntauthenticationproviders Negotiate,NTLM

15 6. Valid Servers Registry Key Add Novaview and Sharepoint server names to ValidServers REgistry Key on Novaview Service and restar Novaview Service 7. Application Pool Identity on SharePoint Server We recommend that Identity that is running Application Pool in IIS must be a full Admin Other things you can check: Event Viewer on SharePoint Server Event Viewer on Novaview Server Event Viewer on client machine If the Security Delegation still does not work, please contact Microsoft Technical Support for expert Networking help.

16 Troubleshooting Java.Lang.Security.Exception error Open panorama registry to the following location: HKEY_LOCAL_MACHINE\SOFTWARE\Panorama\NovaView\Admin Note: version number changes according to the version installed. Make sure ValidServers string is there Open share point home page. Copy from the browser URL the name of the share point server name ( Paste the copied value into the ValidServers value Go to share point machine Open a IE browser and go to you NovaView server page Copy from the browser the URL without the welcome/connector value ( Open Settings.xml file in the share point machine and paste there the copy value. Settings.xml located in:c:\program Files\Common Files\Microsoft Shared\web server extensions\wpresources\panorama.webparts\ ae0aaac5fd5fc0 Note: the last folder numberic sequence might be different depending on the version you have installed