Configuring Extranet Access for PerformancePoint Services 2010 Abstract This white paper describes the architectural considerations for deploying PerformancePoint Services in an extranet environment. It provides a detailed walkthrough of the recommended architecture that uses Forefront Threat Management Gateway server as a reverse-proxy server, the Kerberos protocol for authentication of service and user accounts, and Microsoft SQL Server and SQL Server Analysis Services as back-end data systems. Prepared for: December 6, 2011 Prepared by: Mark Wuerslin Eric Chad Cooper Leo Furlong Two Concourse Pkwy Atlanta, GA 30328 404.442.8000 fax 404.442.8001 www.intellinet.com
Click OK to accept the settings. Add a Page Library for the Dashboards In the SharePoint site that was created during the previous navigate to Site Actions New Document Library. a name and description for the document library. Specify whether to a link for the document library in the quick launch left navigation pane. Leave version history settings off, as dashboard pages do not require version tracking. For Document Template select the Basic page template. Click Create for the document library to be created. Alternate Access Mappings The following steps walk through the configuration of SharePoint Server Alternate Access Mappings for the web application hosting the sites with PerformancePoint Services dashboards. Alternate Access Mappings are necessary when the URL to access the web application externally is different than the URL to access the web application internally. Add a public URL for the Internet zone In SharePoint Central Administration navigate to System Settings Configure alternate access mappings. By default, all AAM collections are shown. Change the AAM Mapping Collection by clicking the Show All drop-down menu and choosing Change Alternate Access Mapping Collection. Select the collection matching the web application that was created for the dashboards. In our lab this is Northwind Traders Portal. Click the Edit Public URLs link. Add the URL that users will type when browsing for the site on the public Internet to the Extranet field. In our lab the URL is https://portal.nwtraders.com. This will add an Alternate Access Mapping containing “https://portal.nwtraders.com” as both the Internal and Public URLs for the zone. Click Save to accept the settings. Add SSL Certificate to the web application in IIS Windows Server 2008 Obtain a server certificate from a publicly trusted certification authority that matches the published name of your site. For our lab, the certificate is for portal.nwtraders.com.
Kerberos constrained delegation paths Figure - Kerberos constrained delegation paths SharePoint Server logical authentication Authentication in this scenario begins with the client authenticating with Kerberos authentication at the web front end. SharePoint Server 2010 will convert the Windows authentication token into a claims token using the local Security Token Service (STS). The PerformancePoint Services service application will accept the claims token and convert it into a Windows token (Kerberos authentication) using the local Claims to Windows Token Service (C2WTS) that is a part of Windows Identity Framework (WIF). The PerformancePoint Services service application will then use the client’s Kerberos ticket to authenticate with the backend data source. Figure - SharePoint Server logical authentication Step-By-Step Configuration Instructions The following sections specify the required to configure PerformancePoint Services with Claims authentication for SharePoint Server 2010. Active Directory Configuration Create PerformancePoint Services service account As a best practice PerformancePoint Services should run under its own domain identity. To configure the PerformancePoint Services service application, an Active Directory account must be created and registered as a managed account in SharePoint Server 2010. For more information on configuring managed accounts: Configure automatic password change (SharePoint Server 2010) In this example the following account is created and registered later in this scenario: – Performance Point Service Application Settings SharePoint Service IIS App Pool Identity PerformancePoint Services NWTRADERS\_svcSPPerfPointAppID Create an SPN for the Service Account running the PerformancePoint Service on the Application Server This step is necessary because the Service Account running the SharePoint Application Pool is different than the PerformancePoint account. The Active Directory Users and Computers MMC snap-in is typically used to configure Kerberos delegation. To configure the delegation settings within the snap-in, the