For the Dutch TechNet magazine I wrote an article about the security within SharePoint. This is my first TechNet article and I think it has turned out great. The link to the article in included below.
Veiligheid in en om SharePoint – TechNet Magazine, juli 2010
Also read the article of a colleague of mine which wrote an article on SharePoint and Communities that was in the same magazine.
SharePoint, de virtuele koffiecorner – TechNet Magazine, juli 2010
A few weeks ago I tried to set up a SharePoint farm that uses Kerberos authentication. I always thought it was just a setting in SharePoint but infect it is much more than that.
What is Kerberos
Kerberos is a computer network authentication protocol, which allows nodes to communicate over a non secure network to prove their identity to one another.
Kerberos makes use of a trusted third party for the authentication, termed a Key Distribution Center (KDC) which consists of two parts: an Authentication Server (AS) and a Ticket Granting Server (TGS). Kerberos works on the basis of tickets which serve to prove the identity.
For communication between two entities, the KDC generates a session key which they can use to secure their interaction. A KDC runs on every domain controller as a function of the Active Directory Domain Services (AD KS).
Why use Kerberos
There are many reasons why u should use Kerberos authentication rather than the default NTLM. The main reason is because it is more secure than NTML. Besides this reason you should also use it to get around the “double hop” (http://support.microsoft.com/kb/329986) authentication issue. The most common scenarios for the double hop issue with SharePoint are around Excel services and Data Connection.
Setting up Kerberos authentication
To make use of Kerberos nothing needs to be changed if the domain controller is set-up correctly. Kerberos clients are configured to request ticket-granting tickets (TGT’s) of the Kerberos Key Distribution Center automatically. If the ticket is received successfully the Kerberos client saves the ticket on the locale machine.
One of the first things you should consider when you want to use Kerberos authentication is which accounts you will be using for your services and web applications. Those accounts will have to get a Service Principal Name. The servers you will be using will have to allow delegation.
To trust a computer for delegation
If every server in the farm is trusted for delegation you can start creating SPN’s (Service Principal Names) for the accounts you will be going to use for SQL Server and the SharePoint farm.
Service Principal Names
Service principal names are associated with the security principal (user or groups) in whose security context the service executes. Service Principal Names are created with a specific Syntax.
Service Principal Name syntax:
The basic syntax of service principal name is as follows:
[service type]/[instance name]:[port number]/[service name]
The elements of the syntax have the following meaning:
Note: When you use Kerberos authentication with SharePoint you have to know that Internet Explorer does not send the port number with the service principal name. For example for this address https://intra.motion10.com:443 the SPN will be http/intra.motion10.com.
How to create a SPN in Active Directory
To create a SPN for an account you have to follow the following steps.
Important: You cannot give two accounts the same Service Principal Name. This will cause the authentication to fail or fall back on NTLM if it is possible.
After you created the Service Principal Names you have to trust the accounts for delegation:
Trust accounts for Delegation
Windows server 2003 Active Directory
Windows server 2000 Active Directory
Note: If you do not have the delegation tab in the user properties you will have to use the steps of the Windows server 2000 Active Directory. This is because Windows 2003 Active Directory can run a in a 2000 mode.
Configure Kerberos for SQL server
Kerberos for SQL server has to be configured before you can install SharePoint Server 2007. This means we have to create a SPN for the SQL service account:
The SPN’s will be:
Testing the Kerberos authentication for SQL Server
If you have configured the SPN’s for the SQL service account you can test if it works by following the following steps.
If there isn’t a Success Audit that uses the Kerberos protocol you can check the following:
Configure Kerberos for your Web Applications
If you want your web applications to make use of Kerberos you have to create Service Principal Names for the accounts that will used for running the web applications.
If have written down a few examples of SPN’s of several addresses of web applications.
| Internet address | Service Principal Name |
| http://intra.motion10.com | http/intra.motion10.com |
| https://intra.motion10.com | http/intra.motion10.com |
| http://mossadmin:43433 | http/mossadmin |
| http://mysites.intranet.com | http/mysites.intranet.com |
Testing the Kerberos authentication for the web application authentications
If you have created SharePoint web applications that use Kerberos authentication, you are ready to test your configuration by following the following steps:
Configure the SSP Infrastructure for Kerberos
For the SSP infrastructure to use Kerberos you have to follow the following steps:
Register a new SPN for the SSP Service
For the SSP infrastructure to use Kerberos a few new SPN’s need to be created. This is because the SSP infrastructure runs on every server in the SharePoint farm. It is also bound to the following ports TCP 56737 en TCP 56738 and the SPN also needs to include the name of the Shared Service Provider.
So you have to create a separate SPN for each server in the farm. In the following table you will see a few examples.
|
Computer Name: MOSSQUERY Name Shared Service Provider SSP |
MSSP/MOSSQUERY:56737/SSP MSSP/MOSSQUERY:56738/SSP |
|
Computer Name: MOSSQUERY Name Shared Service Provider SharedServices4 |
MSSP/MOSSQUERY:56737/SharedServices4 MSSP/MOSSQUERY:56738/SharedServices4 |
|
Computer Name: MOSSCRAWL Name Shared Service Provider SharedServices1 |
MSSP/ MOSSCRAWL:56737/ SharedServices1 MSSP/ MOSSCRAWL:56738/SharedServices1 |
Configure the SSP infrastructure to use Kerberos
After you created the Service Principal Names for the SSP Infrastructure you have to inform the SSP infrastructure to use Kerberos. You can inform the SSP infrastructure by using the stsadm tool.
To configure your SSP infrastructure to use Kerberos authentication, perform the following procedure:
After following all the steps you successfully configured your SharePoint farm to use Kerberos authentication.
Within SharePoint you have the ability to create custom application pages. Application pages remain in the layouts folder of SharePoint. Each user can access these pages by typing in the URL in the explorer bar.
When you would navigate to one of these pages and you do not have enough rights, you would expect that you would be redirected to the access denied page. This is does not happen.
You can try this with a user that has minimal rights and navigate to the following page /_layouts/srchvis.aspx (An out of the box application page for settings the search visibility). You will see that the page gets rendered.
When you create a custom application page you can work around by doing the following:
protected override void OnLoad(EventArgs e) {
base.OnLoad(e);
if (SPContext.Current.Web.UserIsWebAdmin) {
if (!Page.IsPostBack) {
//perform your actions
}
}
else {
SPUtility.HandleAccessDenied(new Exception("You do not have access to this page."));
}
}
In the OnLoad of your page you can check whether the user has sufficient rights. In the example I perform this action by checking if the user is a site admin.
When the user hasn’t sufficient rights you can redirect him to the access denied page of SharePoint by using the HandleAccessDenied() method of the SPUtility class.
How do you perform these actions I hear you thinking? The first you can perform in multiple ways because it is different for each version of Internet Explorer:
The next action you can perform by opening Internet Options -> Security -> Local intranet -> Custom level -> Scroll all the way down and select Automatic logon with current username and password. Now there is still the third step we have to make. But what is it? The third step is changing the Group Policies off all the users. This will make sure every user off the company will receive these changes.
Did you ever have a problem with your my site? Well we did! The customer wanted a Citrix webpart on their my site. I did not recommend it but still they wanted it. The performance off the my site fell down the roof and we had to disable the my site so we could do a proper investigation what they didn’t do in the accept environment.
So how do you shut down the my site for all your users? What you can do is just stop the my site web application in IIS and all users will get a ‘Page Not Found’ error. This is not something a client will love so we did some research and found out that you can disable it by user or by user group.
If you navigate to ‘Central Administration’ and click on the ‘Shared Service Provider’ of you web application on the left side of your screen.
Under User Profiles and My sites you can click on ‘Personalization services permissions’.
In the screen that follows click on the user ‘NTAuthority\Authenticated Users’. This group off users represents all authenticated users.
Deselect ‘Create personal site’ in the upcoming screen and save your changes. Now the my site link will not be available to your users.
For a project we were working on we created a web application with a wrong application pool Identity. We wanted to set this correctly and we thought we could just change the application pool Identity in IIS, but we were wrong.
What happens was that the application pool identity was changed back by SharePoint in a period off time. When we saw this happening we began to look how we could change the application pool account in SharePoint.
Navigate to ‘Central Administration’ and click on the operations tab.
Click on ‘Service Accounts’ that is highlighted in the image above. In the screen that follows change the boxes to the preferences you want. For a ‘Web Application’ Identity you have to select the radio button ‘Web Application pool’ and select the correct preferences.
