17 Integrating SharePoint Server

17.1.1 About Windows Impersonation

This integration relies on Windows impersonation, which enables a trusted user in the Windows server domain to assume the identity of any user requesting a target resource in SharePoint Portal Server 2003 or SharePoint Office Server 2007. This trusted impersonator maintains the identity context of the user while accessing the resource on behalf of the user.

Impersonation is transparent to the user. Access appears to take place as if the SharePoint resource were a resource within the Access System domain.

17.2.1 Supported Versions and Platforms

Any references to specific versions and platforms in this chapter are for demonstration purposes.

You can find support and certification information at the following URL:

http://www.oracle.com/technology/documentation/

You must register with OTN to view this information.

Also, you can see the supported versions and platforms for this integration on Metalink, as follows.

To view information on Metalink

1. In your browser, enter the following URL:

   https://metalink.oracle.com

2. Log in to MetaLink.

3. Click the Certify tab.

4. Click View Certifications by Product.

5. Select the Application Server option and click Submit.

6. Choose Oracle Identity Management and click Submit.

7. Click Oracle Identity Management Certification Information 10g (10.1.4.0.1) (html) to display the Oracle Identity Management page.

8. Click the link for Section 6, Oracle Access Manager Certification to display the certification matrix.

17.2.2 Required Microsoft Components

Table 17-1 lists the Microsoft components required to integrate with SharePoint Portal Server 2003 and SharePoint Office Server 2007.

17.2.3 Required Oracle Access Manager Components

The components in Table 17-2 are required to integrate with SharePoint Server and SharePoint Portal Server.

17.4.1 Installing Microsoft Components

Except where noted, all Microsoft SharePoint Portal Server-related components must be installed on the same host machine, including the following software:

• Windows Server 2003

• Microsoft IIS v6 Web Server

• SharePoint Portal Server (and underlying WSS)

The following Microsoft components can be installed on machines other than the one hosting the main SharePoint Portal Server installation:

• Active Directory (see Table 17-1 for installation location details).

• SQL Server must be installed on a machine in the Active Directory domain only if the Active Directory Domain Controller is installed on the same machine as SharePoint Portal Server. See Table 17-1 for installation location details.

• Additional SharePoint Portal Server front end servers.

• One or more back end servers containing SharePoint Portal Server resources such as Web pages, documents, or applications.

The following task overview includes references to documentation that provides procedures and steps you need to complete when installing the Microsoft components for this integration.

Task overview: Installing Microsoft Components

1. Install Windows Server 2003 on the machine that will host your SharePoint Portal Server installation, as described in the appropriate Microsoft documentation.

2. Install IIS on the machine that will host your SharePoint Portal Server installation, as described in the appropriate Microsoft documentation.

3. Install Active Directory, as described in the appropriate Microsoft documentation and the Oracle Access Manager Installation Guide; also, see Table 17-1 for installation location considerations.

4. If SharePoint Portal Server and Active Directory Domain Controller reside on the same machine, you must also install Microsoft SQL Server on that machine as well, as described in Table 17-1.

5. Install SharePoint Services and SharePoint Portal Server on the root virtual server (which uses port 80, by default) of your IIS installation or on some other IIS virtual server.

6. Create and set up your portal.

7. After you install SharePoint Portal Server, stop and test the installation to ensure it operates correctly before you integrate with Oracle Access Manager.

Task Overview: Creating and setting up a Sharepoint portal

1. Create a portal.

   See "To create a portal" for details.

2. Upload a test document.

   See "To upload a document to the portal" for details.

3. Create audiences.

   See "To create audiences" for details.

4. Edit audiences (if necessary).

   See "To edit audiences" for details.

5. Compile audiences.

   See "To compile audiences" for details.

To create a portal

1. In the Portal Site and Virtual Server Configuration section of the SharePoint Portal Server Central Administration page for server on which you wish to create a portal, click Create a portal site.

2. In the Portal Creation Options section, click Create a portal.

3. In the Site Name section, in the Name box, type a name for the portal site. This name will appear at the top of most pages for the portal site.

4. In the Virtual server list within the Site URL section, click the existing virtual server on the server that will host the portal site.

5. In the URL box, type the URL through which users connect to the portal site. By default, this URL is http://server_name/. If you choose a virtual server that has a port number other than 80, the port number appears as part of the URL, that is, http://server_name:port_number/.

   Note:

   Make sure to specify the load-balanced URL, not the local server URL.

6. In the Account name box of the Owner section, type the account name of the portal site owner in the format Domain\user_name. The portal site owner manages content and user access.

7. In the E-mail address box, type the e-mail address for the portal site owner, then click OK.

8. On the Create Portal Confirmation for server_name page, click OK to begin creating the portal site.

9. The Operation Status page displays as the portal is created. Following successful portal site creation, the Operation Successful page appears. At this point, you can begin detailed configuration of the portal site.

To upload a document to the portal

1. Using your Web browser, navigate to the home page for the portal.

2. Select Upload Document from the Actions list.

3. On the Upload Document page, click Browse, navigate to the document you wish to add, then click Open.

   To add multiple documents simultaneously, click Upload Multiple Files.

   To replace a file of the same name within the library, select the checkbox titled "Overwrite existing file(s)?"

4. Click Save, then click Close.

To create audiences

1. Audiences, which are based on jobs or tasks within an organization, match specified users to target content while preventing all other users from viewing that content. On the Managing Audiences page for the site you wish to configure, click Create audience.

2. On the Create Audience page, type a name and description for the audience.

3. Click either "Satisfy all rules" or "Satisfy any of the rules," then click OK.

4. After the Add Audience Rule page appears, add whatever rules you wish to govern access to the site content. (You can also add rules through the View Audience Properties page.) For details, consult the Microsoft SharePoint Portal Server documentation on Adding and Editing Audience Rules.

5. Compile the audience so that the content is targeted to that audience. See "To compile audiences".

To edit audiences

1. On the View Audience Properties page for the site you are configuring, click View Audience Properties, then click Edit audience.

2. On the Edit Audience page, change the name or description of the audience, as necessary.

3. Click either "Satisfy all rules" or "Satisfy any of the rules," then click OK.

4. When the View Audience Properties page reappears, Add, Delete, or Edit the audience rules, as necessary.

5. Review the statistics for the audience, checking the number of current members and the most recent time of compilation. When you are satisfied with all the settings for the audience and the rules associated with that audience, compile the audience so that your changes take effect. See "To compile audiences".

To compile audiences

1. Any changes you make to an audience or the rules associated with them do not take effect until you compile the audience. Navigate to the Manage Audiences page and check the compilation status and most recent compilation time for the audience you wish to compile. (You can also view the number of incomplete audiences on this page).

2. Either start a compilation or set a compilation schedule.

17.4.2 Installing Oracle Access Manager Components

The ISAPI Webgate for SharePoint Portal Server must be installed on the same machine as SharePoint Portal Server. The rest of your installation can reside on the same machine or any other machine.

If you choose to install on a different machine (which can be a Solaris, Linux, or Windows machine), it can be set up for Active Directory (if the host machine runs Windows Server 2003) or some other directory service, such as NetScape Directory Server (if the machine runs Solaris or Linux, for example).

If both Oracle Access Manager and SharePoint Portal Server are set up for different instances of Active Directory, both instances must belong to the same Active Directory domain.

To install Oracle Access Manager components for SharePoint Portal Server integration

1. On either the same machine that hosts SharePoint Portal Server (or on a different machine), install an Identity Server and a WebPass, then set up the Identity System as described in the Oracle Access Manager Installation Guide and see Table 17-2 for WebPass installation considerations.

2. On either the same machine that hosts SharePoint Portal Server (or a different machine), install Policy Manager and one or more instances of the Access Server, as described in the Oracle Access Manager Installation Guide and Table 17-2.

3. On the machine hosting the SharePoint Portal Server instance you are trying to integrate, install an ISAPI WebGate.

   The IISImpersonationExtension.dll will be installed as part of the package in the following directory:

   WebGate_install_dir\access\Oblix\apps\webgate\bin\

   Where WebGate_install_dir is the directory where you installed the WebGate.

4. If you installed Policy Manager or WebPass on the same IIS virtual server as SharePoint Portal Server, complete activities in "Defining Managed Paths in SharePoint".

17.4.2.1 Defining Managed Paths in SharePoint

You complete the following procedure only if the Policy Manager or WebPass resides on the same IIS virtual server as SharePoint Portal Server and listens to the same port as that IIS virtual server. For instance, the default virtual IIS server uses port 80, as do many Policy Manager and WebPass installations; therefore, you need to change the port used by one application or exclude the path used by the Oracle Access Manager component through the Define Managed Paths feature in SharePoint.

To define managed paths in SharePoint

1. Select Start, Administrative Tools, SharePoint Central Administration.

2. In the Virtual Server Configuration section, click Configure virtual server settings.

3. In the Virtual Server list, click Default Web Site or the name of the virtual server on which both SharePoint Portal Server and the Oracle Access Manager components are installed.

4. In the Virtual Server Management section, select Define Managed Paths.

5. In the Add a Path section, type the path to Policy Manager or WebPass, then click the button marked Excluded path.

6. Click OK to add the path to the list of excluded paths.

Figure 17-1 Defining Managed Paths in SharePoint

17.6.1 Creating a Trusted User Accounts

This special user should not be used for anything other than impersonation.

To create a trusted user account

1. On the Windows 2003 machine hosting your SharePoint Portal Server installation, select Start, Programs, Manage Your Server, Domain Controller (Active Directory), Manage Users and Computers in Active Directory.

2. In the Active Directory Users and Computers window, right-click Users on the tree in the left pane, then select New, User.

3. In the First name field of the pane entitled New Object - User, enter an easy-to-remember name such as SPPSImpersonator.

4. Copy this same string to the User logon name field, then click Next.

5. In succeeding panels, you will be asked to choose a password and then retype it to confirm.

Figure 17-2 Setting up a Trusted User Account for Windows Impersonation

17.6.2 Assigning Rights to the Trusted User

You need to give the trusted user the right to act as part of the operating system.

To give appropriate rights to the trusted user

1. Select Control Panel, Administrative Tools, Domain Controller Security Policy.

2. On the tree in the left pane, click the plus icon (+) next to Local Policies.

3. Click User Rights Assignment on the tree in the left pane.

4. Double-click "Act as part of the operating system" in the right pane.

5. Click Add User or Group.

6. In the Add User or Group panel, type the User logon name of the trusted user (SPPSImpersonator in our example) in the User and group names text entry box, then click OK to register the change.

Figure 17-3 Configuring Rights for the Trusted User in Windows Impersonation

17.6.3 Binding the Trusted User to Your WebGate

You need to bind the trusted user to the WebGate by supplying the authentication credentials for the trusted user, as follows.

To bind your trusted user to your WebGate

1. Point your browser to your Access System Console. For example:

   http://hostname.domain.com:port/access/oblix

   where hostname is the DNS name of the machine hosting your Policy Manager, domain is the name of the server domain to which the machine belongs, and port is the number of the port to which Policy Manager listens.

2. Navigate to Access System Console, Access System Configuration, AccessGate Configuration.

3. Select the name of the Webgate you want to modify.

   The Details for AccessGate page appears with a summary of the configuration information for this WebGate. At the bottom of this Web page are fields for Impersonation Username and Impersonation Password.

4. Click the Modify button at the bottom of the Details for AccessGate page.

5. After the Modify AccessGate page appears, scroll to the bottom and enter the username and password for the trusted user account you created through the task .

   For example:

   
   

6. Click the Save button to commit the changes and return to the Details page.

   A bind has been created for the WebGate and the trusted user. The WebGate is now ready to provide impersonation on demand. The demand is created by an Authorization Success Action in a policy domain created for impersonation.

17.6.4 Adding an Impersonation Action to a Policy Domain

You must create or configure a policy domain to protect your SharePoint resources. You do this by adding an Authorization Success Action with a return type of "headerVar," the "name" parameter set to "Impersonate", and the "return attribute" parameter set to "samaccountname" for a single-domain Active Directory installation or "userPrincipalName" for a multi-domain Active Directory forest.

You must also choose an easy-to-remember name for the domain, such as Impersonation Policy Domain.

For details on creating a policy domain, see the Oracle Access Manager Access System Administration Guide.

To add an impersonation action to your policy domain

1. Navigate to the Access System Console and log in, for example:

   http://hostname.domain.com:port/access/oblix

   Where hostname is the DNS name of the machine hosting your WebPass and Policy Manager, domain is the name of the server domain to which the machine belongs, and port is the number of the port to which Policy Manager listens.

2. Navigate to the Authorization Definitions page of the policy domain you want to change:

   Policy Manager, My Policy Domains, PolicyName, Authorization Rules

   Where PolicyName refers to the policy domain you created specifically for impersonation (ImpersonationPolicyDomain in our example).

   Currently defined authorization rules are listed. If none are listed, click the Add button and complete the form to create one.

3. Click the link to the rule to which you want to add the impersonation action to expand the description.

4. Click the Actions tab, directly under the Authorization Rules tab.

   The Authorization Success page appears, with a separate section for Authorization Success and Authorization Failure. If no actions are identified, you must add them. If actions are provided, you can modify them.

   You need to add a header variable named "impersonate" to the Authorization Success Action in the policy domain for impersonation.

5. On the Authorization Success page, click the Add or Modify button.

6. In the Authorization Success area, fill in the Return details.

   For example:

   Type: HeaderVarName: IMPERSONATEReturn attribute: uid or samaccountname (Active Directory username, the Windows domain user for the desired folder)
   

   Where "HeaderVar" is the return Type, "IMPERSONATE" is Name of the header variable for impersonation, and the Return value of uid or samaccountname is based on the directory being used.

7. Save the rule, which is used for the second WebGate request (for authorization).

   The following is a sample screen shot.

   
   

17.6.5 Adding an Impersonation dll to IIS

You are ready to configure IIS by adding the IISImpersonationExtension.dll to your IIS configuration. See "To add the impersonation dll to your IIS configuration" for details.

If you have multiple Web sites, where some are integrated with SharePoint Portal Server while others are not, you may want to enable impersonation for the Web sites that are not integrated with the SharePoint Portal Server. To do this, you must install Impersonation.dll at any level of the Web site tree and add a wildcard extension for Web sites. See "To add a wildcard extension for Web sites" for details.

To add the impersonation dll to your IIS configuration

1. Select Start, Administrative Tools, Internet Information Services (IIS) Manager.

2. Click the plus icon (+) to the left of the local computer icon on the tree in the left pane.

3. Click Web Service Extensions on the tree in the left pane.

4. Double-click Oblix WebGate in the right panel to open the Properties panel.

5. Click the Required Files tab.

6. Click Add.

7. In the Path to file text box, type the full path to IISImpersonationExtension.dll.

   By default, the path is:

   WebGate_install_dir\access\oblix\apps\webgate\bin\ IISImpersonationExtension.dll

   Where WebGate_install_dir is the directory of your WebGate installation.

   Note:

   If any spaces exist in the path (for example, C:\Program Files\Oracle\...) surround the entire string with double quotes (" ").

8. Click OK.

9. Click the General tab on the Web Services Extension Properties panel, then verify that the box "Do not check the file location" is not checked.

10. Verify that the Allow button to the left of the Oblix WebGate icon is greyed out, which indicates that the dll is allowed to run as a Web service extension.

Figure 17-4 Configuring IIS Security Settings

To add a wildcard extension for Web sites

1. If Oracle Access Manager is not integrated with SharePoint Server, configure a wildcard extension for Web sites by navigating as follows:

   Click Start, then click Administrative Tools, then click Internet Information Services (IIS) Manager.

2. Click the plus icon (+) to the left of the local computer icon on the tree in the left pane.

3. Click Web Sites in the tree in the left pane.

4. Right-click the icon representing your Web site, then click Properties in the menu.

5. Click the Home Directory tab.

6. Click the Configuration button.

7. In the list box for Wildcard application maps, click the entry for IISImpersonationExtension.dll to highlight it, then click Edit.

8. Ensure that the box is unchecked.

17.6.6 Testing Impersonation

You can test Impersonation in the following ways:

• Outside the SharePoint Server context or test single sign-on, as described in "Creating an IIS Virtual Site Not Protected by SharePoint Server"

• Using the Event Viewer, as described in "Testing Impersonation Using the Event Viewer"

• Using a Web page, as described in "Testing Impersonation using a Web Page"

• Using negative testing as described in "Negative Testing for Impersonation"

17.7.1 Configuring IIS Security

Be sure to configure IIS Security before you continue.

To configure IIS Security for the SharePoint Server integration

1. Select Start, Administrative Tools, Internet Information Services (IIS) Manager.

2. Click the plus icon (+) to the left of the local computer icon on the tree in the left pane.

3. Click Web Sites on the tree in the left pane.

4. Right-click the icon on the tree in the left pane that represents the SharePoint Server server you are protecting with your WebGate, then select Properties from the menu.

5. In the property sheet for the SharePoint Server server, click the Directory Security tab.

6. In the Authentication and access control section of the Directory Security tab, click Edit.

7. In the Authentication Methods panel, click the box labelled Enable anonymous access so that a check appears, then click OK to complete the task.

Figure 17-6 Configuring IIS Security

17.7.2 Configuring the Wildcard Extension

You are ready to configure the wildcard extension for each SharePoint Portal Server virtual server for which you wish to enable integration.

To configure the wildcard extension for SharePoint Portal Server virtual servers

1. Select Start, Administrative Tools, Internet Information Services (IIS) Manager.

2. Click the plus icon (+) to the left of the local computer icon on the tree in the left pane.

3. Click Web Sites on the tree in the left pane.

4. Right-click the icon representing your SharePoint Portal Server server, then click Properties on the menu.

5. Click the Home Directory tab.

6. Click the Configuration button.

7. In the list box for Wildcard application maps, click the entry for IISImpersonationExtension.dll to highlight it, then click Edit.

8. Ensure that the box is unchecked.

9. Verify that the file exists, then click OK three times to close the Add/Edit panel, the Application Configuration panel and the property sheet for your portal server.

Figure 17-7 Configuring the Wildcard Extension

17.7.3 Editing web.config

Add the following line to the web.config file.

<add key = "SPS-EnforceIISAnonymousSetting" value="false" />

To edit web.config for the SharePoint Portal Server integration

1. Open Windows Explorer and navigate to the document root of your IIS Web site.

2. Use any text editor to open the XML file web.config.

3. Locate the appSettings markers at the end of the file, or create them if they do not exist:

   <Configuration>
   // [Various configuration settings]
   <appSettings>
   // [Insert "<add key . . .>" here.]
   </appSettings >
   </Configuration>
   

   Important:

   The appSettings markers are case sensitive and must appear as appSettings.

4. Add the following line where indicated in the previous listing:

   <add key = "SPS-EnforceIISAnonymousSetting" value="false" />
   

5. Save web.config.

6. Restart IIS so that the new setting will take effect by completing the following steps:

   1. Select Start Menu, Internet Information Services (IIS) Manager.

   2. In the tree in the left pane, locate the name of the local computer hosting your SharePoint Portal Server installation and write it down; you will need the name of this computer to restart IIS.

   3. Right-click the local computer icon and select Disconnect from the menu.

   4. After the warning asks if you really want to disconnect, click Yes to confirm the action.

      The local computer icon disappears from the tree in the left pane, indicating that IIS has been shut down on that machine.

   5. In the tree in the left pane, right-click the Internet Information Services icon and click Connect on the menu.

   6. In the Connect to computer panel, type the name of the computer hosting your SharePoint Portal Server installation, then click OK to restart IIS.

Figure 17-8 Restarting IIS after Editing web.config

17.7.4 Synchronizing User Profiles Between Directories

You need to synchronize user profiles between the SharePoint Portal Server directory and the Oracle Access Manager directory:

• Uploading user data—If your Oracle Access Manager installation is configured for any directory server other than SharePoint Active Directory, you must load the user profiles that reside on the other directory server to SharePoint Active Directory.

• Importing user profiles in SharePoint Portal Server—After uploading the user profiles, you need to import the profiles from Active Directory to SharePoint Portal Server.

To configure importing user profiles in SharePoint Portal Server

1. Go to Site Settings.

2. Under User Profile, Audiences, and Personal Sites, click Manage Profile Database.

3. To configure user profile imports from Active Directory, click Configure Profile Import.

17.7.5 Testing Your Integration

After you complete the tasks to enable integration, you should test to verify that integration is working.

This section contains the following topics:

• Testing the SharePoint Portal Server Integration

• Testing Single Sign-On for the SharePoint Portal Server Integration