Provisioning Services Architecture Overview. User Account Context / Service Account Context

Transcription

1 This article prvides a descriptin abut hw the Prvisining Services cmpnents interact with each ther and hw they shuld be cnfigured t grant adequate permissins. Prvisining Services Architecture Overview Admin Cnsle Cmmand Line Interface PwerShell Interface Cnfiguratin Wizard Prvisining Services Server Wrklads (VHDs) A B Active Directry C Netwrk Strage Nte n the arrws: Black/Green: cmpnents interactin Red: Active Directry cmpnents interactin Blue: cmpnents interactin User Accunt Cntext / Service Accunt Cntext User Accunt Cntext Admin Cnsle Cmmand Line Interface PwerShell Interface Cnfiguratin Wizard Prvisining Services Server Wrklads (VHDs) A Active Directry Service Accunt Cntext B C Netwrk Strage

2 The Service Accunt requires read/write/create permissins t the strage lcatins and datareader/ datawriter/execute permissins fr the SQL database. The User Accunt requires permissins t add/delete/reset AD machine accunt passwrds. Nte: The User Accunt des nt require SQL permissins. Cmpnents with Active Directry Interface Admin Cnsle Cmmand Line Interface PwerShell Interface Cnfiguratin Wizard Prvisining Services Server Wrklads (VHDs) A Active Directry B C Netwrk Strage The Cnsle cmmunicates with Active Directry fr add/reset/delete machine accunts. MCLI and PwerShell d the same. Thse peratins must be dne frm a user cntext with sufficient privileges. The SOAP service requires AD permissins t retrieve grup memberships. When the SOAP interface is used directly by a 3rd party tl, the Service Accunt will require permissins t add/reset/delete machine accunts. Cnsle Operatins Functinal implementatin: Admin Cnsle Cnsle: Prvisining Services Server Add/Remve/Reset AD cmputer accunt Munting VHD (if cnsle n server) SOAP: Retrieve grup list (rle based admin) Retrieve grups a user is a member f (rle based admin) Start/stp stream service Active Directry

3 Prgramming Interfaces Prvisining Services Server Functinal implementatin: Cmmand Line Interface / PwerShell: Add/Remve/Reset AD cmputer accunt N lcal functinality, everything implemented by SOAP Server Munting VHD (if running n server) PwerShell Interface SOAP API Service: Cmmand Line Interface Retrieve grup lists (rle based admin) Retrieve grups a user is a member (rle based admin) Start/stp stream service Active Directry Nte: The sap service cmmunicates with Active Directry fr rle based administratin and user assigned vdisk grup membership. Target Devices Functinal implementatin: Set cmputer accunt passwrd Change cmputer accunt passwrd when expired Prvisining Services Server Active Directry

4 Cnfiguratin Wizard Tasks: Active Directry: SQL: Retrieves list f grups (Rle Base Administratin Active Directry Prvisining Services Server Creates database Cnfigures service user accunt in database Adds initial farm administratr grup Adds server t farm Cnfiguratin Wizard Prvisining Services Server: Cnfigures Stream and Sap Service Accunt Types: Cnsle User Accunts: User Cntext: User lgged int Windws Service Accunts: Netwrk Service authenticates as the cmputer accunt Named user accunt Lcal accunt nt used with Active Directry Admin Cnsle Cnfig Wizard: User Cntext: user lgged int Windws MUST: Be part f dbcreatr and securityadmin rles Be db_wner rle when targeting blank DB Have View Any Definitin permissin when targeting blank DB Have lcal server admin privileges t install sftware Cnfiguratin Wizard

5 Cnsle User Accunts: Permissins Required: Add/Remve/Reset AD cmputer accunt Cnfig Wizard: Retrieve grup lists (rle based admin) Retrieve grups a user is a member (rle based admin) SQL sa permissins t create database Service Accunts Permissins: Permissins Required: Read/write/create/list permissins fr VHD files Add/Remve/Reset AD cmputer accunt (if using API) Set cmputer accunt passwrd (if using API) Retrieve grup lists (rle based admin) Retrieve grups a user is a member (rle based admin) Start/stp services if nt granted then Cnsle functinality will nt wrk. Can still use Services Cntrl Panel applet t cntrl services

6 Service Accunts Types: Netwrk Service: Minimal privilege lcal accunt Authenticates using the cmputer accunt Generally mre difficult t cnfigure because permissins assigned t individual cmputer accunts Named User: Lcal System: Privileges depend upn netwrk administratr Ptential service start prblems with passwrd expiratin plicies Lcal accunt with full system privileges Cannt access netwrk resurces SQL Server Permissins: Cnsle User Accunt: Nne Cnsle des nt cmmunicate directly with SQL Server Service Accunt: Member f db_datareader rle Member f db_datawriter rle Execute permissin n all database stred prcedures Cnfig Wizard: Nte: Must be part f dbcreatr and securityadmin rles Must be db_wner rle when targeting blank DB Must have View Any Definitin permissin when targeting blank DB If user des nt have sufficient privileges, Cnfig Wizard will prmpt fr a SQL user accunt Service accunts d nt need t be dmain administratrs Cnsle user accunt des nt access SQL Server

7 Mre Infrmatin: CTX Service Accunt Cnfiguratin fr Accessing SQL This dcument applies t: Prvisining Server 5.0 Prvisining Server 5.1 Prvisining Server 5.6