Section 2.6. Setting Client Security

2.6. Setting Client Security

You'll encounter two security issues when first using a SharePoint site over the Internet:

Opening files from a library or workspace displays a security warning, as shown in Figure 2-18.
You can't create workspaces from Office applications.

You can't get rid of the security warning: Internet Explorer always warns you when you open files, such as Word or Excel files, that might contain viruses. However, if you open the file using the Office application or open a local file linked to the SharePoint site, you won't see the warning in Figure 2-18.

animal 2-18. Security warning when opening Office files from the Internet

The virus risk comes from macros the file might contain, and in any case, the Office macro security settings determine whether or not macros are run. To check those settings in your Office application, choose Tools Macro Security.

You can solve the second issue by adding your SharePoint site to the list of trusted sites in Internet Explorer:

Choose Tools Internet Options Security Trusted Sites Sites. Internet Explorer displays a list of the trusted sites for your local computer (Figure 2-19).
OK OK to close the dialog.

animal 2-19. Adding a SharePoint site to Internet Explorer's list of trusted sites

Once the SharePoint site is trusted, Office applications can create workspaces on the site from the Shared Workspace task pane. Neither of these security issues occurs for SharePoint sites on your local area network: those sites are included in the Local intranet zone, which has a higher level of trust.

2.7. Creating Self-Hosted Sites

All of the tasks in the preceding sections also apply to sites you create on your own server. The major differences between hosted and self-hosted sites are that:

You usually access self-hosted sites over an intranet rather than the Internet, so those sites are automatically trusted, and you have fewer client security issues to worry about.
Since self-hosted sites are usually part of your network, you can quickly grant all network users access to the site (see the section "Adding Members Quickly" later in this chapter).
You must install and maintain SharePoint yourself, which requires more knowledge about tools like IIS, SQL, and Windows security than you need when using hosted sites.
You have direct access to the server, so you have both more control and more responsibility (for backups , etc.) than in a hosted environment.

The rest of this chapter explores installing SharePoint and creating SharePoint sites on your own server. If you've already decided to stick with a hosted site, you can skip ahead to the section "Allowing Anonymous Access," because the next sections don't really apply to you.

2.8. Installing SharePoint Services

SharePoint Services is a component in Windows Server 2003. To install those services on an existing server you'll need the following:

An account with Administrative privileges for the server
Physical access to the server or access through the Windows XP Professional Remote Desktop utility
Access to a dedicated SQL Server or SQL Server installed on the target server (recommended)

There are three configuration options for installing SharePoint Services, and you should choose your target configuration before proceeding. The main difference among configurations is where data is stored, as described in Table 2-6.

Table 2-6. Possible SharePoint Services database configurations

Description	Database used	Advantages	Disadvantages
Default	WMSDE	Least expensive, simplest configuration	Capacity limited to 2 GB; no full-text search; database maintenance more difficult
Single server with SQL Server	Microsoft SQL Server 2000 SP3	Supports full-text search; backups are easy to manage; capacity is better than WMSDE	Additional expense; web server and database share single processor; limiting performance
Server farm	Microsoft SQL Server 2000 SP3 installed on dedicated server	All of the SQL Server advantages plus better performance and scaling	Additional expense; more complicated to set up

For anything more than a personal or small-office site, I recommend using one of the SQL Server configurations because otherwise you just won't get the capacity you may need. Once you've met the prerequisites and chosen a configuration, installing SharePoint follows these major steps:

Answer key questions (listed in Table 2-7).
Check your SQL Server installation and gather connection information. (Skip this step if you are using WMSDE.)
Prepare your server.
Install SharePoint Services.
Create a virtual server for new SharePoint sites.
Integrate web sites that the server was hosting before install.

The following sections examine these steps in more detail.

2.8.1. Questions to Ask Before You Install

Before installing SharePoint Services, you should have answers to the questions in Table 2-7, because the answers affect how you install and set up your SharePoint site. Note that these questions may require discussion with managers or team members .

Table 2-7. Installation checklist

Question	Choices	Comments
What database server will you use?	WMSDE SQL Server (local) SQL Server (separate dedicated server)	See Table 2-6.
Do you want to enable full-text searches?	Yes No	If yes, requires SQL Server.
Should all network users have read access?	Yes No	If yes, see "Adding Members Quickly."
Do you want members to be able to create their own personal sites?	Yes No	If yes, see "Enabling Self-Service Site Creation."
Will you allow anonymous access from the Internet?	Yes No	If yes, see "Allowing Anonymous Access."
Will you allow users to automatically create accounts on your network for use with SharePoint?	Yes No	If yes, requires Active Directory. This is an advanced setting, usually used by ISPs, that can't be changed without reinstalling.
Does the server host other web applications?	Yes No	If yes, see "Re-Enabling Existing Sites."

2.8.2. Checking SQL Server

If SharePoint is to use SQL Server, before you begin your installation, the full-text search component and Service Pack 3 (SP3) or later should be installed.

The full-text search component must be installed before the service pack to enable SharePoint's full-text search feature. Full-text search increases the amount of space required to store a database, and you may choose not to use it, but if you don't install it first you won't have that option later in SharePoint.

{% if main.adsdop %}{% include 'adsenceinline.tpl' %}{% endif %}

To install full-text search in SQL Server:

Run setup from your SQL Server 2000 installation disk.
Choose SQL Server 2000 Components Install Database Server Next and choose the server to modify.
Upgrade, remove, or add components to an existing instance of SQL server Next Next Add components to your existing installation Next. Setup displays the Select Components dialog box.
1. Download SP3 from Microsoft. Search http://www.microsoft.com/downloads for "SQL SP3" and download sql2ksp3.exe .
2. Run sql2ksp3.exe to unpack the files.
3. Run setup.bat from the unpacked files. Setup starts the installation wizard to walk you through the rest of the process.
The version number of SQL Server 2000 SP3 is 8.0.760 (SP3). To verify that a SQL Server is running SP3:
1. Start SQL Server Enterprise Manager.
2. Select the server and choose Action Properties General. The version information appears on the dialog box.
If SQL Server is running on a dedicated server, get the connection settings SharePoint needs during the installation process:
- Server name .
- Authentication type (Windows integrated or SQL).
- If using Windows integrated authentication, record the account the SharePoint server will use to connect to the SQL server.
- If using SQL authentication, record the SQL user name and password SharePoint will use to connect.
2.8.3. Preparing Your Host Server

If you are installing SharePoint on a server that is already hosting other web sites, be aware that installing SharePoint makes those sites unavailable at times during the installation. Before installing you should:
- Check for integration, upgrade, and compatibility issues with existing sites.
- Choose a time when site use is at a minimum.
- Notify users that sites will be unavailable during installation.
- Consider moving existing sites to another server during installation.
- Create a full backup of the server (of course).
The following sections outline some of the integration, upgrade, and compatibility issues you may encounter.

2.8.3.1 Integrating existing sites

If you have existing web sites on the server, you need to figure out how your new SharePoint sites fit in the organization of your sites. You may make the SharePoint site the new top-level site for your server, make it subordinate to your existing top-level site, or set up separate host headers or port numbers for your existing site and new SharePoint site.

Changing the structure of an existing site affects current users and breaks links they have established to your site, but it may be the best option if you are rolling out new capabilities. In general, it is best to roll out features gradually, so you may want to do some of both. See the section "Re-Enabling Existing Sites" later in this chapter for more information.

2.8.3.2 Upgrading from SharePoint Team Services

If you're upgrading a previous installation of SharePoint Team Services V1.0, Microsoft provides a migration tool ( smigrate.exe ). Extensive instructions can be found in the Administrator's Guide ( WindowsSharePointServicesAdmin.chm ), in the section "Migrating and Upgrading Web Sites."

2.8.3.3 Coexisting with Exchange Server

If your host server is also hosting Microsoft Exchange Server, you'll need to change the authentication method used by SharePoint in IIS after SharePoint is installed (see http://support.microsoft.com/default.aspx?scid=kb;en-us;823265). Note that you can't host Portal Server and Microsoft Exchange on the same machine.

2.8.4. Installing SharePoint

I hope the preceding sections didn't scare you off. Installing SharePoint Services is actually very simple, but I wanted you to be prepared because it's critical to choose your data source before you begin. Changing a live web server is serious business, and you don't want your support line to ring off the hook. Life is a lot easier if you are starting with a new, clean server.

To start installing SharePoint:
1. Download the SharePoint Services installation ( STSV2.EXE ). Search http://www.microsoft.com/downloads for "SharePoint Services."
2. Run STSV2.EXE . The download extracts the installation files and starts the SharePoint setup program. The first step is to select your database configuration, as shown in Figure 2-20.
  
  In some cases, Setup may require you to restart Windows 2003 after installing some components. After you restart, you'll have to run Setup again to resume installation.
If you choose the Typical Installation option, Setup installs SharePoint, configures it to use WMSDE, and creates an SQL instance named machinename /SHAREPOINT which is used to contain the SharePoint configuration and content databases.

To use a local installation of SQL Server, rather than WMSDE, choose Typical Installation, then upgrade the WMSDE database to SQL Server after installation is complete.

To use a SQL Server instance on a dedicated server, choose the Server Farm option. As mentioned earlier, setting up a dedicated SQL Server is more complex than using

animal 2-20. Choosing the database configuration

the other two database configurations, but it provides much better performance and room for growth in the future.

2.8.5. Upgrading WMSDE to SQL Server

To upgrade the default WMSDE database created by the Typical Installation option to use SQL Server:
1. Install SQL Server 2000 on the web server. Be sure to include the Full-Text Search component.
2. Install SP3 (see the section "Checking SQL Server" earlier in the chapter). Installing SQL Server should upgrade the instance of the WMSDE database to use SQL Server automatically.
3. Start SQL Server Enterprise manager and register the machinename \SHAREPOINT server instance.
If SQL Server SP3 was present when you installed SharePoint with the Typical Installation option, Setup still configures SharePoint to use WMSDE. To upgrade that database to use SQL Server without reinstalling SQL, use SQL Enterprise Manager to copy the content and configuration databases from the machinename \SHAREPOINT server instance to the installed SQL Server 2000 instance; then change the SharePoint database settings using the SharePoint Central Administration site. See Appendix A for details.

2.8.6. Setting Up a Web Farm

To install SharePoint using the Web Farm option, use the SharePoint Central Administration site to configure SharePoint's IIS settings and database connection:
1. Choose the IIS application pool to use for the Central Administration site shown in Figure 2-21. IIS can run each web site in a separate process, and those processes run under a Windows identity that determines their permissions.
  
  animal 2-21. Configuring IIS settings
2. If you change the application pool, you must run iisreset.exe to restart IIS before continuing.
3. Enter the database connection information for the SharePoint configuration database shown in Figure 2-22. The configuration database stores information about the SharePoint server and all the virtual servers it contains.
In Figure 2-22 I specified SQL server authentication rather than Windows-integrated authentication because my network is based on workgroups rather than domains. Most home networks are workgroup-based and most business networks are domain-based. You should use Windows authentication in domain-based networks since it makes administering security easier and passwords more secure.

The Active Directory Account Creation section in Figure 2-22 is used mainly by ISPs, such as those providing SharePoint hosting services. It allows SharePoint to automatically create user accounts and generate passwords, as mentioned in "Adding Members" earlier. If you're not an ISP, you'll want to keep the default setting.

animal 2-22. Configuring the database connection

2.8.7. Creating Virtual Servers

SharePoint uses separate databases for the server configuration and for virtual server content. Each virtual server in SharePoint represents a top-level web site in IIS. The content for each virtual server is contained in a database, as shown in Figure 2-23.

You can't see this association if you used WMSDE as your database because WMSDE doesn't include SQL Server Enterprise Manager. However, WMSDE creates a database instance called SHAREPOINT and then creates databases within that instance. You can find those databases on the server in C:\Program Files\Microsoft SQL Server\MSSQL$SHAREPOINT\Data .

To create a new virtual server in SharePoint, create a new, top-level site in IIS. Then extend that site using SharePoint Central Administration. The following sections describe these steps in greater detail.

2.8.7.1 Creating a top-level site in IIS

To create a new top-level site in IIS:
1. On the SharePoint server, choose Start Administrative Tools Internet Information Service (IIS) Manager.
2. New Web Site. IIS starts the Web Site Creation wizard.
3. When creating a top-level site in IIS, you can assign the site a specific IP address or port number on the server, as shown in Figure 2-24.
  
  animal 2-24. Assigning top-level sites different IP addresses or port numbers
  
  You can set different port numbers to handle different top-level sites on your server. In fact, that's how SharePoint configures the Central Administration siteby assigning it to an available port number. You can view that site by including the port number along with the domain, for instance http://wombat1:21960/ displays the Central Administration site on my network.
  
  Each top-level site must have a unique IP address or port number so IIS knows where to route requests. Port 80 is the default port for HTTP requests , so whichever site you assign to port 80 is the default site for that IP address.
  
  Networks can assign multiple IP addresses to a single server, but SharePoint only supports the All Unassigned setting: you can't host multiple IP addresses on a SharePoint server.
  
  You can change the port number assigned to a top-level site from the Properties dialog box in IIS after the site is created.
  
  2.8.7.2 Extending the site with SharePoint
  
  To extend a top-level site with SharePoint Central Administration:
  1. Choose Start Administrative Tools SharePoint Central Administration to display the Central Administration site.
  2. Complete list and select the name of the site you just created in IIS. SharePoint displays the Extend Virtual Server page.
  3. Enter the IIS application pool for the site, select the database settings, and enter the contact information for the site administrator; then choose OK.
  Extending a site with SharePoint configures IIS to send requests through the SharePoint ISAPI filter ( stsfltr.dll ), which then responds to those requests with data from the virtual server's content database as shown in Figure 2-25.
  
  2.8.8. Re-Enabling Existing Sites
  
  To re-enable non-SharePoint sites on your server after you install SharePoint services, add a unique host header for the site; host the site under a different port number; or host the site as a subsite .
  
  Adding a host header for the site creates a unique domain for each virtual server hosted at a single IP address. For example, both http://www.mstrainingkits.com and
  
  animal 2-25. Extending a site lets SharePoint handle requests
  
  http://www.usingsharepoint.com refer to the IP address of my Windows 2003 server. IIS determines which site to display based on the header received with the request. To add a host header in IIS:
  1. Select the site in IIS and choose Action Properties Web Site and click Advanced. IIS displays the Advanced Web Site Identification dialog.

Setting

Value

IP Address

All unassigned

TC Port

80

Host Header Value

Your domain name (for example, www.mstrainingkits.com)

Click OK twice to close the dialogs and make the changes.

Make sure the domain you specified in step 2 is registered for the IP address. On the Internet, that is done with a domain registrar. Within an intranet, that is done on the DNS server or through the client's hosts file (search your system folder for "hosts").

Hosting the site under a different port number means the domain part of the address includes a specific port number rather than using the default HTTP port (80) (for example, http://www.usingsharepoint.com:8080/). To change a site's TCP port, select the site in IIS and choose Action Properties Web Site and change the TCP port settings.

The disadvantage of this approach is that the web address now includes an ugly port number ( 8080 )-- but it is the simplest way to get things working quickly.

Hosting an existing site as a SharePoint subsite is more complicated, but establishes a more hierarchical site address. For example: http://www.mstrainingkits.com/ExistingSite. To host an existing web site as part of the top-level SharePoint site:

Create a new virtual folder for the existing web site within the SharePoint web site. Select the SharePoint site in IIS and choose Action New Virtual Directory and complete the Directory Creation wizard.
Change the SharePoint site's security and session state settings in Web.config to enable the subsite to execute.
Test your site to verify that it works from the new address.

animal 2-26. Excluding a folder from SharePoint management

Excluding a path tells SharePoint not to apply its ISAPI filter to requests for resources in that subsite or sites beneath it. In this case, the subsite mstrainingkits maps to a separate site, which is a conventional ASP.NET application.

If your existing site is an ASP.NET application, you'll need to change the security settings SharePoint uses. By default, SharePoint runs under limited permissions, which prevents hosting ASP.NET applications. To increase these permissions, open the SharePoint site's Web.config file and change the trust element's level attribute to WSS_Medium as shown here:

<trust level="

WSS_Medium

" originUrl="" />

SharePoint omits the ASP.NET Session module by default, so you need to make the change (indicated in bold ) to Web.config if your ASP.NET application uses session state:

<httpModules>
     <clear />
     <add name="OutputCache" type="System.Web.Caching.OutputCacheModule" />
     <add name="WindowsAuthentication"
     type="System.Web.Security.WindowsAuthenticationModule" />

<add name="Session" type="System.Web.SessionState.SessionStateModule"/>

</httpModules>

After you complete these steps, verify that your existing application works from the subsite address. There are a couple things you should check for:

Broken links or missing resources. If your site used absolute addresses rather than relative ones, the change to your site structure may break those links.
Missing application starting points. If your existing site included subsites with their own executables, you'll need to recreate those application starting points in IIS.

To create application starting points in IIS, select the folder containing the application and choose Action Properties. Then, on the properties dialog, click Create, select the application pool to run under, and click OK. Figure 2-27 illustrates adding an application starting point for a subsite within MStrainingkits .