Hybrid for SharePoint Server Search Reference Architecture

Transcription

1 Hybrid for SharePoint Server 2013 Search Reference Architecture

2 2014 Microsoft Corporation. All rights reserved. This document is provided as-is. Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 2

3 Contents About this white paper... 4 Who this white paper is for... 4 Introduction... 4 Architecture, authentication, and functionality overview... 5 Hybrid computing overview... 5 Why hybrid SharePoint?... 6 Introduction to hybrid search... 7 Overview of result sources and query rules... 8 SharePoint query rules overview... 8 Configure a SharePoint hybrid environment... 9 Display hybrid search results in SharePoint Server 2013 on-premises... 9 Step 1: Create a result source that defines how to get search results from SharePoint Online Step 2: Create a query rule to turn on hybrid search results in SharePoint Server Step 3: Try a search from the SharePoint Server 2013 Search Center Display hybrid search results in SharePoint Online Step 1: Create a result source that defines how to get search results from your SharePoint Server 2013 deployment Step 2: Create a query rule to turn on hybrid search results in SharePoint Online Step 3: Test your configuration for displaying search results from SharePoint Server 2013 in SharePoint Online Step 4: Try a search from the SharePoint Online Search Center Additional information Glossary Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 3

4 About this white paper This white paper details how Microsoft SharePoint 2013 and Office 365 Hybrid Search can be configured to support both inbound and outbound topologies. It also demonstrates that setting up both enables Search to function bidirectionally. Who this white paper is for This white paper is intended for system administrators who need detailed guidelines for setting up a Search service application in a hybrid SharePoint Server 2013 and Office 365 online environment. To ensure a smooth setup process, this white paper includes configuration steps, commands, and links to additional reference material. Introduction SharePoint 2013 and Office 365 Hybrid Search enable users to quickly find content across specified on-premises and cloud environments. The Search capability in SharePoint can be configured to aggregate and display results for a seamless user experience that requires no knowledge of where content is stored. In a SharePoint environment, Search is a service application that needs to be set up with parameters specific to each implementation. To deploy and configure a Search service application, you must perform the following main tasks: 1. Create accounts. Certain domain user accounts are required specifically for a Search service application. 2. Create a Search service application. A Search service application provides enterprise search features and functionality. 3. Configure the Search service application. Basic configuration of a Search service application includes configuring a default content access account, an contact, and content sources. 4. Configure the Search service application topology. You can deploy search components on different servers in the farm. You can also specify which instance of Microsoft SQL Server is used to host your search-related databases. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 4

5 Architecture, authentication, and functionality overview SharePoint implementations frequently span locally deployed and hosted servers to meet the business requirements of internal users, partners, and customers. Microsoft provides tools to simplify and streamline your SharePoint implementation, and the modular nature of SharePoint architecture enables you to maintain a secure leastprivileges execution permission policy. This paper explores the processes required to set up a Search service application in a hybrid SharePoint Server 2013 and Office 365 online environment. However, you first need to set up your SharePoint environment. To set up your SharePoint environment, you will need to complete the following high-level steps: 1. Configure identity management. 2. Configure directory synchronization with single sign-on. 3. Configure a reverse proxy device. 4. Configure the hybrid infrastructure. 5. Configure server-to-server authentication. The Hybrid for SharePoint Server 2013: Security Reference Architecture white paper provides detailed guidance on how to complete these steps. After their completion, you will be ready to configure SharePoint 2013 and Office 365 Hybrid Search, based on the detailed guidance provided in this white paper. Hybrid computing overview Today s organizations face significant challenges, including driving IT efficiency and business value in the face of increased pressure to comply with regulations. The goal of any hybridization or the combining of two related but dissimilar entities is to gain leverage from the strengths of both parts, while minimizing the components weaknesses. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 5

6 Hybrid computing is based on a computing model that allows organizations to use a combination of traditional and cloud computing environments to achieve a higher degree of flexibility, rather than forcing a choice between either an on-premises or cloud model. Why hybrid SharePoint? Organizations can use Microsoft SharePoint Online and SharePoint on-premises to achieve a hybrid computing model. With hybrid SharePoint, these organizations can start to realize the benefits associated with the use of cloud computing coupled with the flexibility to customize the environment and govern data as tightly as in an on-premises system while delivering a consistent experience to users. Figure 1 shows some of the most immediate benefits, including: Maintain consistency across clouds with familiar tools and resources. Extend your data center with a consistent management toolset and familiar development and identity solutions. Provide enterprise-grade performance and security in the data center and in the cloud. Meet changing business needs with greater flexibility. Deliver capacity on demand. Figure 1: Benefits of a hybrid SharePoint environment Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 6

7 Introduction to hybrid search A SharePoint hybrid environment consists of an on-premises deployment of SharePoint Server 2013 and a cloud deployment of SharePoint Online, which is an instance of Office 365. The SharePoint Server 2013 search index and the SharePoint Online search index typically contain different content. The SharePoint Server 2013 search index can contain crawled content from local SharePoint Server sites, file shares, and other sources. The SharePoint Online search index can contain crawled content only from SharePoint Online sites. Hybrid search enables users to get and view search results from both indexes at the same time by performing a single search. In this topology, your on-premises SharePoint Server 2013 farm can consume content and resources from your Office 365 tenant. For example, search can be configured to allow federated users to see both local and remote search results in a SharePoint Server 2013 search portal, while only allowing for local results in the SharePoint Online search portal. To set up a hybrid search solution, you perform either or both of the following configurations. If you want to configure both solutions, you can do either one first, followed by the other. Display hybrid search results in SharePoint Server 2013 on-premises: Configure a SharePoint hybrid environment so that user searches from the SharePoint Server 2013 Enterprise Search Center display results from both the SharePoint Online and SharePoint Server 2013 search indexes. Display hybrid search results in SharePoint Online: Configure a SharePoint hybrid environment so that user searches from the SharePoint Online Enterprise Search Center display results from both the SharePoint Server 2013 and SharePoint Online search indexes. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 7

8 Overview of result sources and query rules A result source in SharePoint Server 2013 is used to specify a provider to get search results from and, optionally, to narrow a search to a subset of those results. When a user issues a query, the search system associates the query with a result source to provide search results. The result source is a definition that specifies each of the following: Search provider or source URL to get search results from (for example, Local index). Protocol to use to get search results (for example, the OpenSearch protocol). Query transform, which can narrow results from the given search provider or URL to a specified subset (for example, a subset that has a particular content type). A result source can also specify other settings, such as an authentication method to use when requesting results from a provider. SharePoint query rules overview Query Rules, a search customization feature that allows you to read, transform, and act on a user-entered search term, is an incredibly powerful tool that enables the manipulation of search results when a search is executed. Query rules encompass three components: Result sources Conditions Actions The Query Rules tool in SharePoint 2013 Search adds a great deal of extensibility to search. The ability to add numerous types of conditions and actions that can pull data from multiple sources into one search experience is a big step forward from SharePoint 2010 Search. Combining query rules with different result types and display templates makes it easier for administrators to customize the look and feel of SharePoint 2013 Search. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 8

9 Configure a SharePoint hybrid environment A SharePoint hybrid environment enables user searches from the SharePoint Server 2013 Search Center to display results from both the SharePoint Server 2013 and SharePoint Online search indexes. This section describes how to configure a SharePoint hybrid environment so that searches from the SharePoint Server 2013 Enterprise Search Center display hybrid results that is, results from both search indexes. This configuration is called outbound hybrid search because it requires an outbound hybrid authentication topology. For more information, see Plan a one-way outbound hybrid topology. The search results from SharePoint Online will appear with the search results from SharePoint Server 2013, but in a separate group called a result block. You can configure the block of results from SharePoint Online to be shown above all the results from SharePoint Server 2013, or to be ranked by relevance compared to the SharePoint Server 2013 results. Display hybrid search results in SharePoint Server 2013 on-premises This section shows you how to display hybrid search results in the Enterprise Search Center of your SharePoint Server 2013 deployment. To successfully display hybrid search results, you will need to complete the following steps: Step 1: Create a result source that defines how to get search results from SharePoint Online Step 2: Create a query rule to turn on hybrid search results in SharePoint Server 2013 Step 3: Try a search from the SharePoint Server 2013 Search Center Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 9

10 Step 1: Create a result source that defines how to get search results from SharePoint Online In this step, you will create a result source in the SharePoint Server 2013 deployment. This result source is a definition that specifies SharePoint Online as a provider to get search results from. This definition specifies each of the following: SharePoint Online URL to get search results from. Protocol for getting those results. Method for authenticating against SharePoint Online. Result sources can be created at the Search service application level, site collection level, or site level. In the procedure in this section, you create the result source at the Search service application level. This will make the result source available to any query rule that is created at the same level, as well as to any query rule that is created for a site collection or site that is in a web application that consumes the Search service application. For more information about result sources, see the following resources: Understanding result sources for search in SharePoint Server 2013 Configure result sources for search in SharePoint Server 2013 To create a result source 1. Verify that the user account that you use to perform this procedure is an administrator for the Search service application that you want to configure. 2. In your SharePoint Server 2013 deployment, in Central Administration, in the Application Management section, click Manage service applications. 3. Click the Search service application to which you want to add a result source. 4. On the Search Administration page for the Search service application, in the Quick Launch, click Result Sources. 5. On the Manage Result Sources page, click New Result Source. 6. On the Add Result Source page, do the following: a. In the General Information section, in the Name text box, type a name for the new result source. For example, type Get results from SharePoint Online. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 10

11 b. (Optional) In the General Information section, in the Description text box, type a description of the new result source. This description will appear as a tooltip when the pointer rests on the result source on certain configuration pages. c. In the Protocol section, click Remote SharePoint. d. In the Remote Service URL section, type the address of the root site collection in SharePoint Online that you want to get search results from, such as e. In the Type section, click SharePoint Search Results. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 11

12 f. In the Query Transform section, do one of the following: i. Keep the default query transform. The default transform is {searchterms}, which is a query variable that stands for the query that the user typed, as it was changed by the most recent query transform. ii. Type a different query transform in the text box, or click Launch Query Builder if you want to use Query Builder to help you configure a query transform. Note: You can use the query transform to narrow the search results to a specified subset for example, a subset that is from a particular SharePoint site collection or site. However, if you are not familiar with query transforms in SharePoint 2013, we recommend that you keep the default query transform here. For more information, see the following resources: Plan to transform queries and order results in SharePoint 2013 and Query variables in SharePoint Server g. In the Credentials Information section, click Default Authentication. h. To save the new result source, click OK. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 12

13 Step 2: Create a query rule to turn on hybrid search results in SharePoint Server 2013 In this step, you will create a query rule in your SharePoint Server 2013 deployment. This query rule uses the result source that you created previously in Step 1 of this section. When the query rule fires, it causes search results from the SharePoint Online search index to be displayed in a result block on a search results page in your SharePoint Server 2013 deployment. The results from the SharePoint Online search index are displayed along with results from the SharePoint Server 2013 search index. Like result sources, query rules can be created at the Search service application level, site collection level, or site level. In the procedure in this section, you create the query rule at the Search service application level. Because you create the rule at this level, the rule can apply to queries that users submit in sites or site collections that consume the Search service application. For more information about query rules, see the following resources: Plan to transform queries and order results in SharePoint 2013 Manage query rules in SharePoint Server 2013 To create the query rule 1. Verify that the user account that you use to perform this procedure is an administrator for the Search service application that you want to configure. 2. In the SharePoint Server 2013 deployment, in Central Administration, in the Application Management section, click Manage service applications. 3. Click the Search service application in which you created a result source in the previous procedure in this section (Step 1: Create a result source that defines how to get search results from SharePoint Online). 4. On the Search_service_application_name: Search Administration page, in the Quick Launch, click Query rules. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 13

14 5. On the Search_service_application_name: Manage Query Rules page, do the following: a. Under the text For what context do you want to configure rules?, in the Select a Result Source list, select a result source for which you want this query rule to be applicable. For testing, we recommend that you select Local SharePoint Results. If you do so, the query rule will be applicable when a user performs a query in the Everything search vertical in the Enterprise Search Center because that vertical uses the Local SharePoint Results result source by default. After you select a result source from the drop-down list, all existing query rules that apply to that result source appear on the page. Note: On the Search_service_application_name: Add Query Rule page, in the Context section, you will be able to add or remove result sources for which you want the rule to be applicable. b. (Optional) In the For what context do you want to configure rules? section, in the User Segments list, select a user segment for which you want this query rule to be applicable. User segments are based on terms that describe users in the term store of a Managed Metadata service application. Note: On the Add Query Rule page, in the Context section, you will be able to add or remove user segments for which you want the rule to be applicable. c. (Optional) In the For what context do you want to configure rules? section, in the Topic Categories list, select a topic category for which you want this query rule to be applicable. Topic categories are based on Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 14

15 terms for categories in the term store of a Managed Metadata service application. Note: On the Add Query Rule page, in the Context section, you will be able to add or remove categories for which you want the rule to be applicable. d. Click New Query Rule. 6. On the Search_service_application_name: Add Query Rule page, do the following: a. In the General Information section, in the Rule Name text box, type a name for the new query rule. For example, type Show results from SharePoint Online. b. If the Context section is collapsed, click the arrow next to Context to expand it. c. In the Context section, do the following: i. Under Query is performed on these sources, do one of the following: If you want this query rule to be applicable for queries that users submit against any result source, click All sources. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 15

16 To add other result sources for which you want the query rule to be applicable, click One of these sources, and then optionally click Add Source. Note: The result source that you selected on the Search_service_application_name: Add Query Rule page (for example, Local SharePoint Results see Step 5a of this procedure) will be shown in the One of these sources section. When you click One of these sources, this query rule will be applicable only when a user submits a query against one of the result sources in this list. Therefore, make sure that the result source appears for which you want this query rule to be applicable for example, Local SharePoint Results. ii. (Optional) In the Query is performed from these categories section, specify the topic categories (based on terms for topic categories in the term store of a Managed Metadata Service application) to perform the query from. iii. (Optional) In the Query is performed by these user segments section, specify user segments (based on terms that describe users in the term store of a Managed Metadata Service application) to which you want the query rule to apply. d. In the Query Conditions section, specify conditions to control when the rule will fire, or click Remove Condition if you want the rule to fire for any query text. For testing, we recommend that you click Remove Condition so that the rule will fire for any query text. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 16

17 e. In the Actions section, under Result Blocks, click Add Result Block. f. In the Add Result Block dialog box, do the following: i. (Optional) In the Block Title section, in the Title text box, change the title to the text that you want to display above the result block on the search results page. For example, type Results for "{subjectterms}" from SharePoint Online. ii. In the Query section, in the Configure Query text box, do one of the following: Keep the default query, which is {subjectterms}. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 17

18 Note: If you are not familiar with transforming queries in SharePoint 2013, we recommend that you keep the default query here, namely {subjectterms}. For more information, see the following resources: Plan to transform queries and order results in SharePoint 2013 and Query variables in SharePoint Server Type a different query in the text box, or click Launch Query Builder if you want to use Query Builder to help you configure a query. iii. In the Query section, in the Search this Source list, click the name of the result source that you created in the previous procedure in this section (Step 1: Create a result source that defines how to get search results from SharePoint Online) for example, Get results from SharePoint Online. iv. In the Query section, in the Items drop-down list, select the number of search results from SharePoint Online that you want to show in this result block on the search results page. For example, select 3 to display three results from SharePoint Online in this result block. v. If the Settings section is collapsed, click the arrow next to Settings to expand it. vi. In the Settings section, do the following: If you want to display a Show More link at the bottom of the result block, select More link goes to the following URL, and type the URL for the link to a page that displays more results from the SharePoint Online search index. For example, to specify the main search results page as the page that displays more results, typically you can type a URL of the following form (followed by?k={subjectterms} to signify the user s search query): /results.aspx?k={subjectterms} When end users click Show More, they will see more results for the result block. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 18

19 To place the block of results from SharePoint Online relative to the results from SharePoint Server 2013, do one of the following: o o To display the result block at or near the top of the first page of search results, click This block is always shown above core results. Note: In this case, core results are the results from the SharePoint Server 2013 search index. This option is useful for testing, or when most of the relevant content is located in the remote search index in the hybrid environment. If you select this option for more than one result block, you can configure the order in which the result blocks are displayed by ranking the associated query rules. To display the result block such that it is ranked by relevance compared to the core results (in which case the result block might not appear on the first page of search results), click This block is ranked within core results (may not show). Note: This is the default setting and is typically the more appropriate choice in a production environment. As with individual results, the rank of the result block might be different when users perform the same query later. For example, if users click search results in the result block, the result block will be ranked higher in the search results over time. Otherwise, the result block will be ranked lower over time. (Optional) In the Group Display Template URL text box, specify a different URL for the group display template. (Optional) In the Item Display Template text box, specify an item display template. vii. Skip the Routing section. viii. Click OK to add the result block. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 19

20 g. On the Add Query Rule page, if the Publishing section is collapsed, click the arrow next to Publishing to expand it. h. On the Add Query Rule page, in the Publishing section, do the following: i. Select Is Active. When a query rule is active, it fires whenever the query conditions are met. ii. (Optional) Specify a Start Date, End Date, Review Date, and Contact. The start date and end date specify when the query rule will be active. If you specify a start date without an end date, the rule will always be active after the start date. If you specify an end date without a start date, the rule will always be active until the end date. If you do not specify a start date or an end date, the rule will always be active. i. Click Save. After a few moments, when federated users submit queries from the SharePoint Server 2013 Search Center against a result source that you specified in Step 6c of this procedure, they will see results from both search indexes, as shown in Figure 2. In this figure, a block of three search results from SharePoint Online appears above the search results from SharePoint Server Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 20

21 Figure 2: Displaying search results from both search indexes Note: A federated user is a user whose on-premises Active Directory Domain Services (AD DS) domain account is synchronized between SharePoint Server 2013 and SharePoint Online, and who accesses resources in both environments by authenticating with the federation identity provider, such as Active Directory Federation Services (AD FS) 2.0. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 21

22 Step 3: Try a search from the SharePoint Server 2013 Search Center In this step, you will validate your configuration for displaying search results from both SharePoint Server 2013 and SharePoint Online in the SharePoint Server 2013 Search Center. You will log on to SharePoint Server 2013 as a federated user and try some searches from the Enterprise Search Center. Note: If you are using single sign-on (SSO) authentication, it is important to test hybrid Search functionality by using federated user accounts. Native Office 365 user accounts and Active Directory Domain Services (AD DS) accounts that are not federated are not recognized by both directory services. Therefore, they cannot authenticate using SSO and cannot be granted permissions to resources in both deployments. For more information, see Accounts needed for hybrid configuration and testing. To try a search from the SharePoint Server 2013 Search Center 1. Log on to your SharePoint Server 2013 deployment as a federated user who has been activated in SharePoint Online and who has permissions to view the root site collection in SharePoint Online. 2. Go to the Enterprise Search Center in the SharePoint Server 2013 deployment. 3. In the Enterprise Search Center, do the following: a. Click a search vertical that uses a result source that you specified in Step 6c of the second procedure in this section (Step 2: Create a query rule to turn on hybrid search results in SharePoint Server 2013). Make sure that the test query yields search results from the SharePoint Server 2013 search index and the SharePoint Online search index. b. In the search box, type a test query, such as the name of your company. c. Click the search icon, or press Enter. On the search results page, you should see results from the SharePoint Server 2013 search index and a result block of results from the SharePoint Online search index. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 22

23 4. If you do not see results from both search indexes, confirm the following: The search system in SharePoint Server 2013 has crawled the local content. For information about how to view the crawl log, see Crawl log in View search diagnostics in SharePoint Server You have configured the hybrid SharePoint environment as described in the following articles, and in the following order: Configure a hybrid topology for SharePoint Server 2013 Configure identity management for a hybrid topology in SharePoint Server 2013 You have configured Search features and functionality as described in this section. 5. Correct any errors or omissions, and then try a search again. If you still do not see search results from both search indexes, check the SharePoint Unified Logging Service (ULS) logs, also called the SharePoint trace logs. For more information, see Overview of Unified Logging System (ULS) Logging. Display hybrid search results in SharePoint Online This section shows you how to configure a SharePoint hybrid environment so that user searches from the SharePoint Online Search Center display hybrid results from both the SharePoint Online and SharePoint Server 2013 search indexes. This configuration is called inbound hybrid search because it requires an inbound hybrid authentication topology. (For more information, see Plan a one-way inbound hybrid topology.) The search results from SharePoint Server 2013 will appear with the search results from SharePoint Server 2013, but in a separate group called a result block. You can configure the block of results from SharePoint Server 2013 to be shown above all the results from SharePoint Online, or to be ranked by relevance compared to the SharePoint Online results. To display hybrid search results in the SharePoint Online Search Center, in SharePoint Online you perform the following procedures, which are described in detail in the following articles: Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 23

24 Step 1: Create a result source that defines how to get search results from the SharePoint Server 2013 deployment Step 2: Create a query rule to turn on hybrid search results in SharePoint Online Step 3: Test your configuration for displaying search results from SharePoint Server 2013 in SharePoint Online Step 4: Try a search from the SharePoint Online Search Center Note: SharePoint supports the accessibility features of common browsers to help you administer deployments and access sites. For more information, see Accessibility for SharePoint Before you begin: The hybrid Search configuration that you perform in this section is a SharePoint hybrid solution, and as such you perform it in the final phase of the SharePoint hybrid configuration process. Therefore, this section assumes that you have satisfied the prerequisites that are described in Prerequisites for inbound hybrid search in Plan hybrid search for SharePoint Server Step 1: Create a result source that defines how to get search results from your SharePoint Server 2013 deployment In this step, you will create a result source in SharePoint Online. This result source is a definition that specifies SharePoint Server 2013 as a provider to get search results from. This definition specifies each of the following: The protocol for getting search results from the SharePoint Server 2013 deployment. The URL of the reverse proxy device. The reverse proxy device forwards search queries from SharePoint Online to your SharePoint Server 2013 deployment. The ID of the target application that stores the Secure Store SSL certificate. Result sources can be created at the SharePoint Admin Center level, site collection level, or site level. In the procedure in this section, you create the result source at the SharePoint Admin Center level. This makes the result source available to any query rule that is created at the same level, as well as to any query rule that is created for a site collection or site. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 24

25 About the Secure Store Service The Secure Store Service is a claims-aware authorization service that includes an encrypted database for storing credentials. The Secure Store Service is an authorization service that runs on an application server. The Secure Store Service provides a database that is used to store credentials. These credentials usually consist of a user identity and password, but can also contain other fields that you define. For example, SharePoint Server 2013 can use the Secure Store database to store and retrieve credentials for access to external data sources. The Secure Store Service provides support for storing multiple sets of credentials for multiple back-end systems. Usage scenarios for Secure Store include the following: Excel Services can use Secure Store to provide access to external data sources in published workbooks. This can be used as a substitute to passing a user s credentials to the data source, a process which often requires configuring Kerberos delegation. Excel Services requires Secure Store if you want to configure an unattended service account for data authentication. Visio Services can use Secure Store to provide access to external data sources in published data-connected diagrams. This can be used as a substitute to passing a user s credentials to the data source, a process which often requires configuring Kerberos delegation. Visio Services requires Secure Store if you want to configure an unattended service account for data authentication. PerformancePoint Services can use Secure Store to provide access to external data sources. PerformancePoint Services requires Secure Store if you want to configure an unattended service account for data authentication. Power Pivot requires Secure Store for scheduled refresh of PowerPivot workbooks. Microsoft Business Connectivity Services can use Secure Store to map the user s credentials to a set of credentials for an external system. You can either map each user s credentials to a unique account on the external system or you can map a set of authenticated users to a single group account. Business Connectivity Services can also use Secure Store to store certificates for accessing an on-premises data source from SharePoint Online. SharePoint runtime can use Secure Store to store credentials necessary to communicate with Azure services, if any of the user apps require SharePoint runtime to provision and use Azure Services. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 25

26 Secure Store Service preparation When you prepare to deploy the Secure Store Service, be aware of the following important guidelines: Before you generate a new encryption key, back up the Secure Store database. You should also back up the Secure Store database after it is initially created, and again each time credentials are re-encrypted. When a new key is generated, the credentials can be re-encrypted with the new key. If the key refresh fails, or the passphrase is forgotten, the credentials will not be useable. Back up the encryption key after initially setting up Secure Store, and back up the key again each time it is regenerated. Do not store the backup media for the encryption key in the same location as the backup media for the Secure Store database. If a user obtains a copy of both the database and the key, the credentials stored in the database could be compromised. Because Secure Store is used to store sensitive information, for better security we recommend that you consider the following guidelines: Run the Secure Store Service in a separate application pool that is not used for any other service. Run the Secure Store Service on a separate application server that is not used for any other service. Create the Secure Store database on a separate application server running SQL Server. Do not use the same SQL Server installation that contains content databases. Target applications A target application is a collection of information that maps a user or users to a set of encrypted credentials stored in the Secure Store database. Target applications contain the following information that you define: Whether this is an individual or group mapping. What fields to store in the Secure Store database. (The default is Windows User Name and Windows Password, but additional field types can be selected, depending on the application.) Users with permissions to administer the target application. The individual or group to whom you are mapping the credentials. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 26

27 Each target application has a unique application ID that you define that is used to reference the target application from external applications such as Excel Services or SharePoint Designer. Secure Store credential mappings The Secure Store Service supports individual mappings and group mappings. In a group mapping, every user who is a member of a specific domain group is mapped to the same set of credentials. In an individual mapping, each individual user is mapped to a unique set of credentials. Individual mappings are useful if you need logging information about individual user access to shared resources. For group mappings, a security layer maps credentials for multiple domain users against a single set of credentials that are stored in the Secure Store database. Group mappings are easier to maintain than individual mappings, and can provide improved performance. Secure Store Service and claims authentication The Secure Store Service is a claims-aware service. It can accept security tokens and decrypt them to get the application ID, and then perform a lookup. When a SharePoint Server 2013 Security Token Service (STS) issues a security token in response to an authentication request, the Secure Store Service decrypts the token and reads the application ID value. The Secure Store Service uses the application ID to retrieve credentials from the Secure Store database. The credentials are then used to authorize access to resources. For more information about result sources, see the following resources: Understanding result sources Manage result sources To create a result source 1. Verify that the user account that you use to perform this procedure is a global administrator for the Office 365 subscription that you want to configure. 2. In the SharePoint Online Admin Center, in the Quick Launch, click Search. 3. On the Search Administration page, click Manage Result Sources. 4. Click New Result Source. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 27

28 5. On the page where you can create a new result source, do the following: a. In the General Information section, in the Name text box, type a name for the new result source. For example, type Get results from SharePoint Server Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 28

29 b. (Optional) In the General Information section, in the Description text box, type a description of the new result source. This description will appear as a tooltip when the pointer rests on the result source on certain configuration pages. c. In the Protocol section, select Remote SharePoint. d. In the Remote Service URL section, type the address of the external endpoint of the reverse proxy device, such as The reverse proxy device routes queries that are submitted in SharePoint Online to the SharePoint Server 2013 deployment. For more information, see Configure a reverse proxy device for SharePoint Server 2013 hybrid. The external endpoint of the reverse proxy device is its Internet-facing endpoint. The address of that external endpoint is called the external URL. About the role of a reverse proxy in a SharePoint Server 2013 hybrid deployment SharePoint Server 2013 and SharePoint Online can be configured in a hybrid configuration to securely combine search results and external data from Microsoft Business Connectivity Services (BCS) and Duet Enterprise. Reverse proxy devices play a role in the secure configuration of a hybrid SharePoint Server 2013 deployment when inbound traffic from SharePoint Online needs to be relayed to your on-premises SharePoint Server 2013 farm. For example, if a federated user uses a SharePoint Online search portal that is configured to return hybrid search results, a reverse proxy device intercepts and preauthenticates the request for onpremises SharePoint Server 2013 content and then relays it to SharePoint Server The reverse proxy device in a hybrid topology provides a secure endpoint for inbound traffic using SSL encryption and client certificate authentication. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 29

30 e. In the Type section, click SharePoint Search Results. f. In the Query Transform section, do one of the following: i. Keep the default query transform. The default transform is {searchterms}, which is a query variable that stands for the query that the user typed, as it was changed by the most recent query transform. ii. Type a different query transform in the text box, or click Launch Query Builder if you want to use Query Builder to help you configure a query transform. Note: You can use the query transform to narrow the search results to a specified subset for example, a subset that is from a particular SharePoint site collection or site. However, if you are not familiar with query transforms in SharePoint Server 2013 or SharePoint Online, we recommend that you keep the default query transform here. For more information, see Plan to transform queries and order results in SharePoint 2013 and Query variables in SharePoint Server Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 30

31 g. If you are connecting to your organization s intranet through a reverse proxy, in the Credentials Information section, do the following: i. Click SSO Id. ii. In the Reverse proxy certificate (Secure Store Id) text box, type the name of the target application for example, SecureChannelTargetApp. This stores the Windows certificate that will be used to authenticate to the reverse proxy device. h. To save the new result source, click OK. Step 2: Create a query rule to turn on hybrid search results in SharePoint Online In this step, you will create a query rule in SharePoint Online that uses the result source that you created previously in Step 1 of this section. When the query rule fires, it causes search results from content in the SharePoint Server 2013 search index to be displayed in a result block on a search results page in SharePoint Online. Query rules can be created at the SharePoint Admin Center level, site collection level, or site level. In the procedure in this section, you create a query rule at the SharePoint Admin Center level, which will apply to any queries that users submit in this instance of SharePoint Online. For more information about query rules, see the following resources: Plan to transform queries and order results in SharePoint 2013 Manage query rules in SharePoint Server 2013 To create a query rule 1. Verify that the user account that you use to perform this procedure is a global administrator for the Office 365 subscription that you want to configure. 2. In the SharePoint Online Admin Center, in the Quick Launch, click Search. 3. On the Search Administration page, click Manage Query Rules. This will take you to the Manage Query Rules page. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 31

32 4. On the Manage Query Rules page, do the following: a. Under the text For what context do you want to configure rules?, in the Select a Result Source list, select a result source for which you want this query rule to be applicable. Note: For testing, we recommend that you select the Local SharePoint Results result source here. If you do so, the query rule will be applicable when a user performs a query in the Everything search vertical in the Enterprise Search Center because that vertical uses the Local SharePoint Results result source by default. After you select a result source from the drop-down list, all existing query rules that apply to that result source appear on the page. On the Add Query Rule page, in the Context section, you will be able to add or remove result sources for which you want the rule to be applicable. b. (Optional) Under the text For what context do you want to configure rules?, in the User Segments list, click a user segment for which you want this query rule to be applicable. User segments are based on terms that describe users in the term store of a Managed Metadata Service application. On the Add Query Rule page, in the Context section, you will be able to add or remove user segments for which you want the rule to be applicable. c. (Optional) Under the text For what context do you want to configure rules?, in the Topic Categories list, select a topic category for which you want this query rule to be applicable. Topic categories are based on terms for categories in the term store of a Managed Metadata Service application. On the Add Query Rule page, in the Context section, you will be able to add or remove categories for which you want the rule to be applicable. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 32

33 d. Click New Query Rule. This will take you to the Add Query Rule page. 5. On the Add Query Rule page, do the following: a. In the General Information section, in the Rule Name text box, type a name for the new query rule. For example, type Show results from SharePoint Server b. If the Context section is collapsed, click the arrow next to Context to expand it. c. In the Context section, do the following: i. Under Query is performed on these sources, do one of the following: If you want this query rule to be applicable for queries that users submit against any result source, click All sources. Select One of these sources, and then optionally click Add Source to add other result sources for which you want the query rule to be applicable. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 33

34 Note: The result source that you selected on the Add Query Rule page (for example, Local SharePoint Results see Step 4a of this procedure) will be shown under One of these sources. When you select One of these sources, this query rule will be applicable only when a user submits a query against one of the result sources in this list. Therefore, make sure that the result source appears for which you want this query rule to be applicable for example, Local SharePoint Results. ii. (Optional) Under Query is performed from these categories, specify the topic categories (based on terms for topic categories in the term store of a Managed Metadata Service application) to perform the query from. iii. (Optional) Under Query is performed by these user segments, specify user segments (based on terms that describe users in the term store of a Managed Metadata Service application) to which you want the query rule to apply. d. In the Query Conditions section, specify conditions to control when the rule will fire, or click Remove Condition if you want the rule to fire for any query text. For testing, we recommend that you click Remove Condition so that the rule will fire for any query text. e. In the Actions section, under Result Blocks, click Add Result Block. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 34

35 f. In the Add Result Block dialog box, do the following: i. (Optional) In the Block Title section, in the Title text box, change the title to the text that you want to display above the result block, such as Results for "{subjectterms}" from SharePoint Server ii. In the Query section, do the following: In the Configure Query text box, do one of the following: o Keep the default query, which is {subjectterms}. Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 35

36 Note: If you are not familiar with transforming queries in SharePoint 2013, we recommend that you keep the default query here, namely {subjectterms}. For more information, see the following resources: Plan to transform queries and order results in SharePoint 2013 and Query variables in SharePoint Server o Type a different query in the text box, or click Launch Query Builder if you want to use Query Builder to help you configure a query. In the Search this Source list, select the name of the result source that you created in the previous procedure in this section (Step 1: Create a result source that defines how to get search results from the SharePoint Server 2013 deployment) for example, Get results from SharePoint Server In the Items drop-down list, select the number of search results from SharePoint Server 2013 that you want to show in this result block on the search results page. For example, select 3 to display three results from SharePoint Server 2013 in this result block. iii. If the Settings section is collapsed, click the arrow next to Settings to expand it. iv. In the Settings section, do the following: If you want to display a Show More link at the bottom of the result block, click More link goes to the following URL, and type the URL for the link to a page that displays more results from the SharePoint Server 2013 search index. For example, to specify the main search results page as the page that displays more results, type a URL of the following form (followed by?k={subjectterms} to signify the user s search query): ter_name/pages/results.aspx?k={subjectterms} Hybrid for SharePoint Server 2013 Search Reference Architecture October 2014 Page 36