Exercise 10-1: Establishing Secure Access

The work we have completed so far in this book has all been accomplished as if SPS was only accessible from an internal server. Typically, we have used the machine name of the server directly in the browser. If you want to include external access to SPS as part of your solution, however, you will have to make some changes.

The first thing you'll have to do is give your portal a name that's accessible from outside the firewall. Typically, you use portal or sharepoint as a prefix in the domain name (e.g., portal.datalan.com ) and make a new entry in the Domain Name Service (DNS) for the enterprise. You'll also have to ensure that the server running the portal has an Internet Protocol (IP) address that can be exposed on the Internet, unlike the default setup this book uses.

Although these steps are enough to expose the portal externally, they are not enough to guarantee security. At a minimum, you should enable Secure Socket Layers (SSL) for the portal. You may also choose to implement a more significant authentication scheme such as the use of tokens. In this exercise, you will give your portal an alias name and enable SSL.

Creating an Alias

Creating an alias for your web site is a simple matter of making a new record entry in the DNS for the network. Creating an alias will allow you to use a name like sharepoint.sps.local when accessing SPS instead of SPSPortal . Although you will create your alias solely for internal use, you can create an alias for external use and map it to an IP address that will expose the portal on the Internet.

Here is what you should do to create an alias for SPSPortal :

Log in to SPSController as the domain administrator.
Select Start Administrative Tools DNS.
In the dnsmgmt dialog, expand the Forward Lookup Zones folder.
Right-click the sps.local folder and select New Alias (CNAME) from the pop-up menu.
In the New Resource Record dialog, type sharepoint .
Click Browse.
Double-click the SPSController node.
Double-click the Forward Lookup folder.
Double-click the sps.local folder.
Select the spsportal entry from the list and click OK.
In the New Resource Record dialog, click OK. Figure 10-4 shows the new entry in the DNS system.

Figure 10-4: Creating an alias

One problem with using alias names to access the portal is that users will be presented with a log-in box regardless of whether they are inside or outside the firewall. There is no way to prevent this behavior. Users can also expect to be prompted occasionally when documents are accessed. You should be careful about how you configure and access SPS to minimize unnecessary logon prompts.

To test the alias name, follow this procedure:

Log in to SPSClient as an end user of the portal.
Open Internet Explorer and navigate to sharepoint.sps.local .
When prompted, log in and verify the portal home page is visible.

Another problem with using alias names lies in the proper resolution of addresses. Hard-coded addresses that reference internal resources can become unavailable when accessed externally through the alias name. SPS helps some-what in this regard by providing a place for you to list alias names that are in use. When you list alias names for SharePoint, it will use the alias with search results to ensure that the address links are always valid.

Here is what to do to list the alias name with SharePoint Services:

Log in to SPSPortal as a portal administrator.
Select Start All Programs SharePoint Portal Server SharePoint Central Administration.
On the SharePoint Portal Server Central Administration page, select Portal Site and Virtual Server Configuration Configure Alternate Portal Site URLs for Intranet, Extranet, and Custom Access.
On the "Configure alternate portal access settings" page, select Edit from the drop-down menu associated with the Default Web Site entry.
In the Intranet URL field, type http://sharepoint.sps.local .
Click OK.

Enabling Secure Sockets Layer (SSL)

Enabling SSL for your portal affords an extra level of security based on certificates and encryption. In order to enable SSL for your portal, you must have a certificate for the server. Once the certificate is available, you can install it on the server and enable SSL.

Installing Certificate Services

Server certificates can be purchased commercially from a trusted source such as VeriSign, or you can create your own using Microsoft Certificate Services. In this exercise, you will install and use Microsoft Certificate Services. Making your own certificates is fine for testing and limited production use, but if you are going to allow access to the portal to a wide audience, you should consider getting a certificate from a trusted provider.

To install Certificate Server, follow these steps:

Log in to SPSController as a domain administrator.
Select Start Control Panel Add or Remove Programs.
In the Add or Remove Programs dialog, click Add/Remove Windows Components.
In the Windows Components dialog, check the Certificate Services box.
Respond to the warning dialog by clicking Yes.
Uncheck the "Internet Explorer enhanced security configuration" box.
In the Windows Components dialog, click Next.
In the CA Type step, select Stand-Alone Root CA.
Click Next.
In the CA Identifying Information step, type spscontroller into the "Common name for this CA" text box.
Click Next.
In the Certificate Database Settings step, accept the default values and click Next.
Click Finish to complete the operation.

Creating the New Certificate

You begin creating a certificate by preparing a request using the virtual server that you want to secure. This server prepares a text file that may then be submitted to Certificate Services. In this case, you will create a request for SPSPortal :

Log in to SPSPortal as a local administrator.
Open Windows Explorer.
Create a new directory at c:\certificates\spsportal .
Select the c:\certificates directory, right-click it, and select Sharing and Security from the pop-up menu.
On the Sharing tab, select Share This Folder.
Click Permissions.
Grant everyone full control and click OK.
Click OK again.
Select Start Administrative Tools Internet Information Services (IIS) Manager.
Expand the SPSPortal node and open the Web Sites folder.
Right-click the Default Web Site node and select Properties from the pop-up menu.
On the Directory Security tab, click Server Certificate.
In the Web Server Certificate wizard, click Next.
In the Server Certificate step, select the Create a New Certificate option, and click Next.
In the Delayed or Immediate Request step, select the "Prepare the request now, but send it later" option, and click Next.
In the Name and Security Settings step, leave the values as they are and click Next.
In the Organization Information step, type your company name in the Organization field and your company unit in the Organizational Unit field.
Click Next.
In the Your Site's Common Name step, type spsportal in the Common Name field.
Click Next.
In the Geographical Information step, enter the appropriate information and click Next.
In the Certificate Request File Name step, click Browse.
In the Saves As dialog, navigate to the c:\certificates\spsportal directory and click Save.
In the Certificate Request File Name step, click Next.
In the Request File Summary step, click Next.
Click Finish to complete the operation.

Once the request is prepared, you may use it to create a new certificate. Certificate Services uses the text file created under SPSPortal to generate the certificate. The new certificate may then be installed on the portal server.

Here you will create the new server certificate:

Log in to SPSController as the domain administrator.
Open Internet Explorer and navigate to spscontroller/certsrv/default.asp .
Click the Request a Certificate link.
Click the Advanced Certificate Request link.
Click the link labeled "Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file".
Open the certificate text file in NotePad that you previously saved at \\spsportal\certificates\spsportal .
Copy the entire contents of the certificate file and paste them into the Saved Request.
Click Submit.
Select Start Administration Tools Certification Authority.
In the Certification Authority dialog, expand the tree and open the Pending Requests folder.
Locate the pending request, right-click it, and select All Tasks Issue from the pop-up menu.
Open Internet Explorer and navigate to spscontroller/certsrv/default.asp .
Click the "View the status of a pending certificate request" link.
Click the link for the pending certificate.
On the Certificate Issued page, click the Download Certificate link.
In the File Download dialog, click Save.
Save the file into the \\spsportal\certificates\spsportal directory.
On the Certificate Issued page, click the Download Certificate Chain link.
In the File Download dialog, click Save.
Save the file into the \\spsportal\certificates\spsportal directory.

Installing the New Certificate

Once the new certificate is created, then you can install it on the portal server. When using the Microsoft Certificate Services, you must install the certificate file with the .p7b extension. This file will establish the appropriate trusts to ensure that you can view the portal.

To install the new certificate, follow these steps:

Log in to SPSPortal as the local administrator.
Select Start Administrative Tools Internet Information Services (IIS) Manager.
Expand the SPSPortal node and open the Web Sites folder.
Right-click the Default Web Site node and select Properties from the pop-up menu.
On the Directory Security tab, click Server Certificate.
In the Web Server Certificate Wizard, click Next.
In the Pending Certificate Request step, select "Process the pending request and install the certificate."
Click Next.
In the Process a Pending Request step, click Browse.
In the Open dialog, navigate to the c:\certificates\spsportal directory and select the file with the .cer extension.
Click Open.
In the Process a Pending Request step, click Next.
In the SSL Port step, accept the default value and click Next.
In the Certificate Summary step, view the details and click Next.
Click Finish to complete the operation.
In the Default Web Site Properties dialog, click View Certificate.
In the Certificate dialog, verify that the certificate is valid by viewing the Certification Path tab.
Click OK.
In the Default Web Site Properties dialog, click Edit under the Secure Communications section.
In the Secure Communications dialog, check the Require Secure Channel box and click OK.
In the Default Web Site Properties dialog, click OK.
When the Inheritance Overrides dialog appears, click OK.

Testing Secure Access

Once the certificate is installed on the portal server, you are ready to utilize SSL. When users access the portal through SSL, they will initially see the certificate warning; you can subsequently install the certificate on their machine and trust your root authority. This will allow them to access the portal without acknowledging the certificate each time.

Here is what you need to do to test secure communications:

Log in to SPSClient as a portal end user.
Open Internet Explorer and navigate to https ://sharepoint.sps.local .
When the Security Alert dialog appears, click View Certificate.
On the Certification Path tab, select the root certificate named spscontroller and click View Certificate.
In the Certificate dialog, click Install Certificate.
In the Certificate Import Wizard, click Next.
In the Certificate Store step, select to Automatically Select the Certificate Store Based on the Type of Certificate and click Next.
Click Finish to complete the operation.
In the Root Certificate Store dialog, click Yes.
In the Certificate dialog, click OK.
In the other Certificate dialog, click OK.
In the Security Alert dialog, click Yes.