**[SharePoint Configuration for Federation]{.underline}**

A.  **SiteMinder Federation Set up and Configuration**

```{=html}
<!-- -->
```
1.  Prerequisites for SiteMinder

    a.  Install Java JRE 1.5x

2.  Install SiteMinder Web Agent on all SharePoint Web Front End servers

    a.  Use default selection.

        i.  Click **Yes** to configure agent

        ii. Click **No** to overwrite DDL

        iii. Click **Yes** for Host Registration

    b.  Add new web extension to IIS configuration

        i.  ISAPIWebAgent: C:\\Program
            Files\\Netigrity\\bin\\isapiwebagent6.dll

        ii. PWServices_default C:\\Program
            Files\\Netigrity\\pw\\smpwservicescgi.exe

        iii. Pwservices: C:\\Program
             Files\\Netigrity\\pw\\smpwservicescgi.exe

    c.  Host Registration

        i.  username: smAdmin

        ii. password: Contact SSO team for password

        iii. Hostname: server FQDN

        iv. Conf obj: IIS

        v.  IP: IP address of SiteMinder policy server:port number

        vi. Filename: smHost.conf

        vii. Location: C:\\Program
             Files\\netegrity\\webagent\\bin\\IIS\\WebAgent.conf

        viii. Agent Config Obj: server FQDN (make sure has same name in
              policy server)

    d.  On IIS WFE server

        i.  Go to **C:\\Program
            Files\\netegrity\\webagent\\bin\\IIS\\WebAgent.conf**,
            change **EnableAgent** to **Yes**. Restart IIS

        ii. On the IIS top root Web Sites, right click **properties**,
            select **ISAPI Filters** tab, **remove** Site Minder
            WebAgent.

        iii. On the web application that needs SSO:

             1.  Right click **properties**, click **Home Directory**
                 tab, click Configuration then click Insert. Enter
                 **\"C:\\Program
                 Files\\netegrity\\webagent\\bin\\ISAPI6WebAgent.dll\"**,
                 do not check **Verify that file exists**. Move the
                 entry to top of the list. Then click **Ok**.

             2.  Click on **ISAPI Filters** tab. Click **Add**, enter
                 Filter name **Site Minder WebAgent**, enter Executable
                 or browse and select: **C:\\Program
                 Files\\netegrity\\webagent\\bin\\ISAPI6WebAgent.dll**.
                 Click **Ok**.

        iv. On Web Service Extensions, make sure the following
            extensions are allowed:

            1.  ISAPIWebAgent

            2.  PWservices (file location: C:\\Program
                Files\\netegrity\\webagent\\pw\\smpwservicescgi.exe)

            3.  PWServices_default (file location: C:\\Program
                Files\\netegrity\\webagent\\pw_default\\smpwservicescgi.exe)

**B. Configuring SharePoint 2007 to use ADAM and Federation**

Assumptions:

-   An existing SharePoint site has been created and can authenticate
    against Active Directory.

-   ADAM database has been properly configured and Account/password sync
    is up-to-date.

Steps:

1.  On SharePoint Central Admin

    a.  Click on Application Management \> Authentication Providers \>
        Edit Authentication

    b.  Enter Membership provider name: **ADAMMembership** (note: it is
        case sensitive)

    c.  Enter Role manager name: **LdapRole** (note: it is case
        sensitive)

![](media/image1.png){width="5.991666666666666in"
height="4.638194444444444in"}

2.  Edit the SharePoint web site Web.config file

> Insert the following before the closing tag **\</system.web\>.** Once
> done, login to your Sharepoint application, go to Site Actions/Site
> Settings/People Groups/Add user/use browser to search for
> 'cit_test_user1\*', it should return a local ADAM account
> 'cit_test_user1'. Add that account to your members group.

 

\<membership defaultProvider=\"ADAMMembership\"\>

\<providers\>

> \<add name=\"ADAMMembership\"
> type=\"Microsoft.Office.Server.Security.LDAPMembershipProvider,
> Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral,
> PublicKeyToken=71E9BCE111E9429C\" server=\"nihadam.nih.gov\"
> port=\"5389\" useSSL=\"false\" userDNAttribute=\"distinguishedName\"
> userNameAttribute=\"userPrincipalName\"
> userContainer=\"DC=NIH,DC=GOV\" userObjectClass=\"user\"
> userFilter=\"(ObjectClass=user)\" scope=\"Subtree\"
> otherRequiredUserAttributes=\"sn,givenname,cn\" /\>
>
> \</providers\>

\</membership\>

> \<roleManager defaultProvider=\"LdapRole\" enabled=\"true\"
> cacheRolesInCookie=\"true\" cookieName=\".PeopleDCRole\"\>

\<providers\>

> \<add name=\"LdapRole\"
> type=\"Microsoft.Office.Server.Security.LDAPRoleProvider,
> Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral,
> PublicKeyToken=71E9BCE111E9429C\" server=\"nihadam.nih.gov\"
> port=\"5389\" useSSL=\"false\" groupContainer=\"DC=NIH,DC=GOV\"
> groupNameAttribute=\"cn\" groupMemberAttribute=\"member\"
> userNameAttribute=\"userPrincipalName\"
> dnAttribute=\"distinguishedName\" groupFilter=\"(ObjectClass=group)\"
> scope=\"Subtree\"/\>
>
> \</providers\>

\</roleManager\>

3.  Edit the web.config file on the SharePoint Central Admin Web Site

\<membership defaultProvider=\"ADAMMembership\"\>

\<providers\>

> \<add name=\"ADAMMembership\"
> type=\"Microsoft.Office.Server.Security.LDAPMembershipProvider,
> Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral,
> PublicKeyToken=71E9BCE111E9429C\" server=\"nihadam.nih.gov\"
> port=\"5389\" useSSL=\"false\" userDNAttribute=\"distinguishedName\"
> userNameAttribute=\"userPrincipalName\"
> userContainer=\"DC=NIH,DC=GOV\" userObjectClass=\"person\"
> userFilter=\"(\|(ObjectCategory=group)(ObjectClass=person))\"
> scope=\"Subtree\" otherRequiredUserAttributes=\"sn,givenname,cn\" /\>

\</providers\>

\</membership\>

4.  On SharePoint Central Admin, go to **Policy for Web Application**

    a.  **Add Users**, make sure you select the proper zone. In most
        instances it will be the **default** zone. Click next.

    b.  Enter account name of the administrator of the web site. The
        account name will display the attribute ADAMMembership. Note
        that this user will be the first administrator hence it should
        be given **Full Control**. Subsequent users should be added via
        the Web Site GUI admin console.

5.  Clear browser cache and access your SharePoint App now, it should
    change from windows authentication to forms based authentication.
    Enter the user name 'cit_test_user1' and the password and you will
    be authenticated and authorized.

6.  Next steps: Once the password is synced up from AD to ADAM for NIH
    and NIHEXT accounts, you will be able to login with NH/NIHEXT
    credentials using FBA.