NOVA CloudBase và SharePoint 2010 – Chúng tôi đã làm điều đó như thế nào?

Mục lục

1. Tích hợp Live ID với cơ chế Claims Based Authentication. 1

2. Tích hợp với SharePoint 2010 và sử dụng lại cách đăng nhập truyền thống ASP.NET Membership Database bằng FBA.. 1

2.1. HOW TO:Forms Based Authentication (FBA) on SharePoint 2010. 1

** Note: This FBA configuration method is based upon the pre-release version of SharePoint 2010 and may change in the final release **. 1

2.2. Setup your SharePoint 2010 site. 1

2.3. Setup your User Database. 2

2.4. Provide Access to the Membership Database. 3

2.5. Setup IIS 7.0 Defaults. 4

2.6. Setup the FBA Zone in SharePoint 2010. 8

2.7. IIS 7.0 Web Site Configuration for SharePoint 2010 FBA.. 11

2.8. Set the User as Site Administrator on the SharePoint 2010 Web Site. 12

2.9. Test the site. 14

2.10. Add the reference to the user friendly people picker. 15

3. Final Note. 16

1. Tích hợp Live ID với cơ chế Claims Based Authentication

NOVA Technologies đã quyết định sử dụng giải pháp tích hợp LiveID vào NOVAVN.COM. Giải pháp LiveID được xem là một giải pháp cách mạng khi người dùng không còn phải sử dụng hoặc lệ thuộc vào tài khoản trong Active Directory của chính hệ thống SharePoint Portal. Giải pháp tích hợp Live ID sử dụng cơ chế Claims Based Authentication (CBA).

Trong năm 2006, cơ chế thường sử dụng là Forms Based Authentication (FBA) lưu trữ các dữ liệu đăng nhập trong cơ sở dữ liệu ASP.NET Membership Provider SQL. CBA trong SharePoint 2010 giảm bớt những hạn chế có ở FBA.

Về cơ bản, thay vì đăng nhập vào bằng tài khoản Active Directory bạn có thể sử dụng tài khoản Live, Hotmail, Live@edu, MSN. Nếu bạn quên mật khẩu có thể khôi phục thông qua Live. CTO Lê Toàn Thắng (MSTS SharePoint người Việt Nam), MCITP Enterprise Administrator và là Master Trainer về Live@edu Nguyễn Văn Bốn là những người hỗ trợ giải pháp tích hợp này cho NOVAVN.COM.

2. Tích hợp với SharePoint 2010 và sử dụng lại cách đăng nhập truyền thống ASP.NET Membership Database bằng FBA

2.1. HOW TO:Forms Based Authentication (FBA) on SharePoint 2010

** Note: This FBA configuration method is based upon the pre-release version of SharePoint 2010 and may change in the final release **

The following article details FBA configuration on a SharePoint 2010 site. If you are looking for information regarding the configuration of FBA on a SharePoint 2007 / WSS 3.0 site, check out this article instead.

2.2. Setup your SharePoint 2010 site

  1. In Central Admin, create a new site. By default, this will use Windows Authentication. Since we haven’t setup FBA yet, we need to setup the Web Application first as a Windows site.
  2. Create the Web Application
  3. Create a default Site Collection, and make a windows user (below we’ve used the Administrator account) a Site Administrator.

2.3. Setup your User Database

  1. Setup the ASP.NET Membership Database. Note: You can use custom membership stores, DotNetNuke, even Live! credentials. But the .NET membership database is very simple to setup. This requires the SQL Server database. You can use the integrated version that is supplied with SharePoint, Express or a fully featured SQL Server (Standard or Enterprise) Edition.
  2. Find the setup file aspnet_regsql.exe located at either of the following locations depending upon your OS:
  3. When the ASP.NET SQL Server Setup Wizard appears, select “Configure SQL Server for application services”, then click Next
  4. Enter the SQL Server and Database name.
  5. Above, I have named the database FBADB
  6. Click Next and Finish

2.4. Provide Access to the Membership Database

As an administrator, you’ll be able to add and modify user accounts. But from the SharePoint runtime, we’ll have to provide access to the membership store. This can be done in two ways. If using SSPI (Integrated Security) for the connectionstring from SharePoint, you’ll need to determine the Service Account that runs the Application Pool. Then you’ll provide access to this windows (or service) account in SQL Server to the FBADB database. Or, if you don’t want to use SSPI, or don’t want to take the time to figure out the startup service account for SharePoint you can simply create a login to the FBADB database. Following are steps for the second approach.

  1. Open SQL Server Management Studio (SSMS 2008) and select Security , then Logins
  2. Right Click Logins and Select “New Login”
  3. Create a SQL Server account. Below, we’d created the account FBAService with password pw
  4. Select “User Mapping”
  5. Mark the checkbox next to FBADB, and select the row.
  6. In “Database role membership”, make the user a dbo_owner.
  7. Click OK to save the new user.

2.5. Setup IIS 7.0 Defaults

  1. Open up Internet Information Services Manager
  2. Select the Web Server, then double click Connection Stringsimage
  3. Click Add..
  4. Enter the Server (.), Database (FBADB) and the Credentials for the user FBAService (by clicking the Set button). If you want to use SSPI, simpy select “Use Windows Integrated Security” instead.
  5. Click OK to save
  6. Click to Select the Server from the Connections pane again, and double click Providers.
  7. On the Feature dropdown, select .NET Users. Your machine may take a while to respond while the configuration is read.
  8. On the Actions menu, click Add..
  9. On the Add Provider form, select SqlMembershipProvider as the Type
  10. Provide a name: FBA.
  11. Drop down ConnectionStringName and select FBADB
  12. Set any other parameters you’d like. I set some Password related options for user interaction later.
  13. Click OK to save
  14. From the Feature dropdown, select .NET Roles, then click Add..
  15. Provide a name: FBARole, and select Type: SqlRoleProvider
  16. Select the ConnectionStringName: FBADB
  17. Click OK to save the .NET role.

2.6. Setup the FBA Zone in SharePoint 2010

  1. Browse to SharePoint 4.0 Central Administration, Select Security
  2. In Application Security, select Specify Authentication Providers
  3. Select the Web Application.
  4. Click the Default Zone.
  5. Ensure the Web Application is the correct one on the next page!
  6. Change Authentication Type to Forms
  7. Check Enable Anonymous (* note that this does not immediately enable Anonymous access; it merely makes the option available on the front-end web application *
  1. Click Save.
  2. When the process is finished, the membership provider should now display FBA.

What SharePoint has done behind the scenes is make the necessary changes to the IIS website to support Forms based authentication. But we still have a little problem. If we browse to the site right now, we won’t be prompted for Windows credentials anymore. Not only do we NOT have a user in the .NET membership database, but we have no FBA based administrators. Let’s tackle that next.

2.7. IIS 7.0 Web Site Configuration for SharePoint 2010 FBA

  1. In IIS Manager, select the SharePoint site. In this example, we used the default site (80).
  2. Double click the .NET Users icon
  3. Click Set Default Provider from the actions pane on the left and select FBA
  4. Click OK to save.
  5. While we’re here, let’s add our first user. This will be used as an administrative account on the FBA site. Click Add..
  6. Select a User, Email and Password. Depending upon parameters you defined earlier you may be prompted with challenge/response questions.
    ** The password may require some strength by default. If you receive an error message that states the “password is invalid”, simply add a number or non-alpha character.
  7. Next, select the SharePoint Central Administation v4 web site from the connections menu in IIS.
  8. Click .Net Users, then in the Actions menu select “Set Default Provider” and set that to FBA.

2.8. Set the User as Site Administrator on the SharePoint 2010 Web Site

  1. In SharePoint Central Admin v4, go to Application Management
  2. In the Site Collections section, select “Change Site Collection Administrators
  3. On the next page, select the Site Collection we’ve been using.
  4. You’ll note that the primary site collection administrator has a little red squiggly. Why? We don’t have Windows Authentication enabled for this site and therefore no way to resolve. Delete the Administator account.
  5. In the field type the user created above (we used fbaadmin), then click the Check Names button. You should see a black underline noting that the name was resolved.

2.9. Test the site

  1. In a Web Browser, when you access the site http://localhost (if that’s what you used), you’ll be presented with the SharePoint login screen, not a Windows login pop-up. (Wow, and you thought SharePoint 2007 had a spartan login screen. Get a load of this !)
  2. Login with the fbaadmin credentials and you should be able to access the site.

2.10. Add the reference to the user friendly people picker

You know the picker…so you can easily find those needles in the haystack. For that to work in Central Admin and this site against your .NET membership database, you need to add a reference to the provider.

  1. In IIS Manager, browse to the Central Admin web application. Explore the folder and find the web.config file. Open in Notepad.
  2. Find the <PeoplePickerWildcards> node and use the following:

< clear />
<add key=”FBA” value=”%” />

3. Final Note

If you plan to use the same membership database for multiple sharepoint sites AND you choose to encrypt the passwords, you’ll need to add one final step. In IIS 7, on the first site, select the Machine Keys icon. Copy those keys. In the next site that you create, you’ll need to use the same machine keys and disable “Automtically Generate” and disable “Generate Unique Key”. This is crucial as the machine key is used to determine the encrypted password that is passed back to the .NET membership database.


About thangletoan

Hallo Aloha

Posted on 08/01/2012, in Công nghệ và Giáo dục, Chính sách CNTT, Microsoft, Microsoft Cloud, Microsoft Office, Microsoft Office 365, Microsoft SharePoint, NOVA Cloudbase, ROBUSTA Training & Best Trainer, SharePoint 2010; Microsoft; FBA; IIS and tagged , . Bookmark the permalink. %(count) bình luận.

  1. Je me nomme Adélaïde.
    Je suis vieille de 35 printemps : je ne fait pas de problème à
    le dire !
    Je suis une animateur enfant ! Est-ce un défaut que d’être une vraie prune ?

Trả lời

Mời bạn điền thông tin vào ô dưới đây hoặc kích vào một biểu tượng để đăng nhập: Logo

Bạn đang bình luận bằng tài khoản Đăng xuất /  Thay đổi )

Google+ photo

Bạn đang bình luận bằng tài khoản Google+ Đăng xuất /  Thay đổi )

Twitter picture

Bạn đang bình luận bằng tài khoản Twitter Đăng xuất /  Thay đổi )

Facebook photo

Bạn đang bình luận bằng tài khoản Facebook Đăng xuất /  Thay đổi )


Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: