보통 ASP.NET 기반의 Web Application을 개발하다 보면, DLL들을 많이 이용하게 되는데,
만일 그 DLL의 일부 코드 수정을 반영 하려면 IIS 서비스를 다시 시작해야 한다.
그래서 보통 IISRESET.EXE 라는 명령어를 이용해 아예 서비스를 내렸다가,
다시 시작하곤 한다.

그러나 단순 DLL의 로직 몇가지 변경 때문에, IISRESET을 하기에는 비용이 비쌀 수 있다.
Web Publishing에 관련 된 대부분의 서비스를 내렸다가 다시 올리는 작업이기 때문에,
Reset 하는 시간도 많이 걸리는데다, IIS를 통해 데이터를 끌어 올리는 비용도 만만치 않다.

이에 IIS 6.0 대 부터는 Application Pool 이라는 것이 있어, 그 Application Pool 만 
정리해 주면 새로운 DLL로 올려줄 수 있도록 제공하게 된다.

보통은 INETMGR을 띄워 해당하는 Application Pool 에서 오른쪽
버튼을 클릭해서 재생(혹은 Recycle)을 선택하면 되는데, UI 도구를 사용하는 것이라, 조작이 좀 귀찮긴 하다.


이 작업을 명령줄로 실행하는 방법을 사용하게 되면, 시작 -> 실행 -> cmd 해서 나오는 도스창(명령 실행창)에서 실행되게 만들거나 Batch 파일로 만들면 더욱 편하게 작업할 수 있다. 

Recycle 할 때 사용하는 명령 줄은 아래와 같다.

IIS 6.0 : cscript //nologo C:\Windows\system32\iisapp.vbs /a "<웹응용프로그램이름>" /r
      예) cscript //nologo C:\Windows\system32\iisapp.vbs /a "SharePoint - 80" /r

IIS 7.0 : C:\Windows\System32\inetsrv\appcmd recycle apppool /apppool.name:"<웹응용프로그램이름>"
      예) C:\Windows\System32\inetsrv\appcmd recycle apppool /apppool.name:"SharePoint - 80"

저작자표시 비영리 변경금지

'Operation System' 카테고리의 다른 글

PowerShell Snap-in: Creating Web-Sites, Web applications, Virtual Directories and Application Pools  (0) 2011.08.14
Windows 2008 Server 원격 터미널 동시 접속 제한 문제 해결  (0) 2010.06.18
이 네트워크 리소스를 사용할 권한이 없습니다.  (0) 2009.07.01
How to Copy an Assembly From the GAC to the File System  (0) 2009.04.14
Windows Server 2008 Step-By-Step Guide (Korean)  (0) 2009.04.13

I got requests may times and I thought I should write the steps to configuration of FBA with SharePoint 2010. I have detailed the steps in this blog.

SharePoint 2010 supports FBA, Like WSS 3.0 or MOSS 2007. It's a feature of ASP .Net which we use with SharePoint. SharePoint 2010 you can create web applications using Classic Based Authentication or Claims based Authentication. However, FBA can only be configured with web applications created using Claims Based Authentication.

What are the differences between Classic Mode Authentication and Claims based Authentication?

Classic Mode Authentication: It refers to the integrated windows authentication. You cannot configure the Forms based authentication if your web application is using Classic Mode Authentication. You can convert a web application from Classic Mode Authentication to Claims Based Authentication. However, that can only be done using PowerShell commands and its an irreversible process. I have detailed steps to convert the web application from Classic Mode authentication to Claims Based Authentication.

Claims Based Authentication: SharePoint 2010 is built on Windows Identity Foundation. It enables authentication from windows as well as non-windows based systems. This also provides the capability to have multiple authentication in a single URL.

Configuration of FBA with SharePoint 2010 involves 4 major steps. The steps to configure the FBA with SQL membership Provider are below:

I> Create or Convert existing web applications to use Claims Based Authentication

II> Create User IDs in SQL Database

III> Modify web.config file

IV> Give Permissions to users present in SQL database

Note: If you want to configure FBA with LDAP membership Provider then you can refer TechNet article.

Please find the detailed steps below:

I> Create or Convert existing web applications to use Claims Based Authentication

Note: - Web Application has to be created from the Central Administration console or PowerShell, however it should be using Claims Based Authentication.

A. Creating web application using Central administration

      • Open Central Administration Console.
      • Click on Manage Web application Under Application Management.
      • Click on new on the Ribbon.
      • Chose Claims based Authentication From the top of the page.
      • Choose the port no for the web application.
      • Click on Enable Forms Based Authentication (FBA) Under Claims Authentication Types. Windows Authentication is enabled by default and if you dont need windows authentication then you need to remove the check the box.
      • Add the Membership Provider & Role Manager Name
      • As soon as web application has been created please verify the Authentication Provider settings for the web application. I have the screenshot below:

clip_image002

Note:- If you want to use Windows Authentication and Forms Based Authentication in Single URL then you have to select Enable Windows Authentication and Enable Forms Based Authentication.

image

Note:- Just for understanding, i am using Membership Provider as “SQL-MembershipProvider” and Role Manager as “SQL-RoleManager”. You can use different names, however you need to remember the name so that you can refer them in web.config files. These names are case sensitive.

B. What if you already have a Web application created using Classic Mode Authentication or How to convert Web application from Classic Mode authentication to Claims based Authentication?

You don’t have to delete that web application. You can convert that web application from classic mode authentication to claims based authentication. However this can only be done using PowerShell and it’s an irreversible process. Follow PowerShell commands to convert the web application from Classic Mode Authentication to Claims based Authentication:

$App = get-spwebapplication “URL”

$app.useclaimsauthentication = “True”

$app.Update()

Example:-

$App = get-spwebapplication “http://sp1:8000”

$app.useclaimsauthentication = “True”

$app.Update()

Once you have the web application using Claims Based Authentication, you can create a site collection. Now if you access the web application, you can access the site choosing Windows Authentication or Forms Based Authentication as shown in below image.

clip_image004

Choose windows authentication and login to site. When you login your currently logged in credentials will be used. Make sure the account you are logged in with has access to SharePoint site; Otherwise, you will get access denied error.

II> Configure the Membership Provider and Role Manager.

  • On SharePoint 2010 server open the command prompt.
  • Navigate to C:\Windows\Micrsooft .Net\Framework64\v2.0.50727
  • Run “aspnet_regsql.exe”. This will open ASP .Net SQL Server Setup wizard. On this click on NEXT.

clip_image006

  • Click on “Configure SQL Server for Application Services”.
  • Specify the Database name. If you don’t specify the database name then it will create a database call aspnetdb.

clip_image008

  • Use membershipseeder tool to create the users in SQL database. You can find the tool and information on that from codeplex.

Note:- I have specified the database name as “SQL-Auth”.

III> Modify the web.config file for Membership Provider and Role Manager.

We need to modify 3 different web.config files for FBA to work. Web.config of FBA Web application, web.config of Central Administration Site & Web.config of STS.

A. Modify web.config of FBA web application.

  • Add connection String:

<connectionStrings>

<add name="SQLConnectionString" connectionString="data source=SQL;Integrated Security=SSPI;Initial Catalog=SQL-Auth" />

</connectionStrings>

Connection String has to be added after </SharePoint> and Before <system.web>

  • Add membership Provider and Role Manager:

<roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">

<providers>

<add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

<add connectionStringName="SQLConnectionString" applicationName="/" description="Stores and retrieves roles from SQL Server" name="SQL-RoleManager" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />

</providers>

</roleManager>

<membership defaultProvider="i">

<providers>

<add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

<add connectionStringName="SQLConnectionString" passwordAttemptWindow="5" enablePasswordRetrieval="false" enablePasswordReset="false" requiresQuestionAndAnswer="true" applicationName="/" requiresUniqueEmail="true" passwordFormat="Hashed" description="Stores and Retrieves membership data from SQL Server" name="SQL-MembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />

</providers>

</membership>

</system.web>

B. Modify web.config of the Central Administration web application.

  • Add connection String:

<connectionStrings>

<add name="SQLConnectionString" connectionString="data source=SQL;Integrated Security=SSPI;Initial Catalog=SQL-Auth" />

</connectionStrings>

Connection String has to be added after </SharePoint> and before <system.web>

  • Add membership Provider and Role Manager:

<roleManager defaultProvider="AspNetWindowsTokenRoleProvider" enabled="true" cacheRolesInCookie="false">

<providers>

<add connectionStringName="SQLConnectionString" applicationName="/" description="Stores and retrieves roles from SQL Server" name="SQL-RoleManager" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />

</providers>

</roleManager>

<membership defaultProvider="SQL-MembershipProvider">

<providers>

<add connectionStringName="SQLConnectionString" passwordAttemptWindow="5" enablePasswordRetrieval="false" enablePasswordReset="false" requiresQuestionAndAnswer="true" applicationName="/" requiresUniqueEmail="true" passwordFormat="Hashed" description="Stores and Retrieves membership data from SQL Server" name="SQL-MembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />

</providers>

</membership>

C. Modify web.config of STS. You can locate the STS web.config from %programfiles%\common files\Microsoft Shared\web server extensions\14\WebServices\SecurityToken

<connectionStrings>

<add name="SQLConnectionString" connectionString="data source=SQL;Integrated Security=SSPI;Initial Catalog=SQL-Auth" />

</connectionStrings>

<system.web>

<roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">

<providers>

<add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

<add connectionStringName="SQLConnectionString" applicationName="/" description="Stores and retrieves roles from SQL Server" name="SQL-RoleManager" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />

</providers>

</roleManager>

<membership defaultProvider="i">

<providers>

<add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

<add connectionStringName="SQLConnectionString" passwordAttemptWindow="5" enablePasswordRetrieval="false" enablePasswordReset="false" requiresQuestionAndAnswer="true" applicationName="/" requiresUniqueEmail="true" passwordFormat="Hashed" description="Stores and Retrieves membership data from SQL Server" name="SQL-MembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />

</providers>

</membership>

</system.web>

Above has to be added before </configuration>

IV> Give permissions to users in SQL database.

  • Access Central Administration console and click on manage web applications under Application Management.
  • Select the web application and click on user Policy on ribbon.
  • Click on Add user and select Default Zone.
  • Now type the user name, add the user to the web application by defining appropriate permission.

Common Issues:

If you are using multiple service accounts as per TechNet article Administrative and service accounts required for initial deployment (SharePoint Server 2010) then you might not able to resolve the usernames or add the users to the web application. If you are using 3 different accounts (Farm Administrator account, Application pool account for web application and service application account) then you need to make sure that you have access to the SQL membership database (SQL-Auth).

Important:

What happens to FBA when we upgrade WSS 3.0 / MOSS 2007 to SharePoint 2010?

Before upgrading to SharePoint 2010 you need to remove the changes you have done to the web.config file. As soon as the process of upgrading finishes all the web applications will be upgraded; however, those will use Classic Mode Authentication. You can convert those web applications from Classic Mode Authentication to Claims Based Authentication.

저작자표시 비영리 변경금지

'Solution Platform' 카테고리의 다른 글

HOW TO:Forms Based Authentication (FBA) on SharePoint 2010  (0) 2011.06.27
[펌]Hide Button from SharePoint Ribbon  (0) 2011.05.13
Fixing those pesky DCOM event log error 10016 in a SharePoint farm environment  (0) 2011.02.08
using Client Object model SharePoint 2010  (0) 2010.12.24
SharePoint 2010 Document File Open Behavior  (0) 2010.12.09

  • ** Note: This FBA configuration method is based upon the pre-release version of SharePoint 2010 and may change in the final release **

    Setup your SharePoint 2010 site

    1. In Central Admin, create a new site. By default, this will use Windows Authentication. Since we haven’t setup FBA yet, we need to setup the Web Application first as a Windows site.
    2. Create the Web Application
    3. Create a default Site Collection, and make a windows user (below we’ve used the Administrator account) a Site Administrator.

    Setup your User Database

    1. Setup the ASP.NET Membership Database. Note: You can use custom membership stores, DotNetNuke, even Live! credentials. But the .NET membership database is very simple to setup. This requires the SQL Server database. You can use the integrated version that is supplied with SharePoint, Express or a fully featured SQL Server (Standard or Enterprise) Edition.
    2. Find the setup file aspnet_regsql.exe located at either of the following locations depending upon your OS:
      %windir%\Microsoft.NET\Framework\v2.0.5027
      %windir%\Microsoft.NET\Framework64\v2.0.5027
    3. When the ASP.NET SQL Server Setup Wizard appears, select “Configure SQL Server for application services”, then click Next
    4. Enter the SQL Server and Database name.
      sqldb
    5. Above, I have named the database FBADB
    6. Click Next and Finish

    Provide Access to the Membership Database

    As an administrator, you’ll be able to add and modify user accounts. But from the SharePoint runtime, we’ll have to provide access to the membership store. This can be done in two ways. If using SSPI (Integrated Security) for the connectionstring from SharePoint, you’ll need to determine the Service Account that runs the Application Pool. Then you’ll provide access to this windows (or service) account in SQL Server to the FBADB database. Or, if you don’t want to use SSPI, or don’t want to take the time to figure out the startup service account for SharePoint you can simply create a login to the FBADB database. Following are steps for the second approach.

    1. Open SQL Server Management Studio (SSMS 2008) and select Security , then Logins
    2. Right Click Logins and Select “New Login”
    3. Create a SQL Server account. Below, we’d created the account FBAService with password pw
      sqluser2
    4. Select “User Mapping”
    5. Mark the checkbox next to FBADB, and select the row.
    6. In “Database role membership”, make the user a dbo_owner.
      rolemember
    7. Click OK to save the new user.

    Setup IIS 7.0 Defaults

    1. Open up Internet Information Services Manager 
    2. Select the Web Server, then double click Connection Strings
      Cstring
    3. Click Add..
    4. Enter the Server (.), Database (FBADB) and the Credentials for the user FBAService (by clicking the Set button). If you want to use SSPI, simpy select “Use Windows Integrated Security” instead.
      cstring2
    5. Click OK to save
    6. Click to Select the Server from the Connections pane again, and double click Providers.
    7. On the Feature dropdown, select .NET Users. Your machine may take a while to respond while the configuration is read.
    8. On the Actions menu, click Add..
    9. On the Add Provider form, select SqlMembershipProvider as the Type
    10. Provide a name: FBA.
    11. Drop down ConnectionStringName and select FBADB
    12. Set any other parameters you’d like. I set some Password related options for user interaction later.
      provider
    13. Click OK to save
    14. From the Feature dropdown, select .NET Roles, then click Add..
    15. Provide a name: FBARole, and select Type: SqlRoleProvider
    16. Select the ConnectionStringName: FBADB
      roleprovider
    17. Click OK to save the .NET role.

    Setup the FBA Zone in SharePoint 2010

    1.  Browse to SharePoint 4.0 Central Administration, Select Security
      centraladmin
    2. In Application Security, select Specify Authentication Providers
      specificauthent
    3. Select the Web Application.
    4. Click the Default Zone.
      defaultzone
    5. Ensure the Web Application is the correct one on the next page!
    6. Change Authentication Type to Forms
    7. Check Enable Anonymous (* note that this does not immediately enable Anonymous access; it merely makes the option available on the front-end web application *
      zone1
      zone2

    1. Click Save.
    2. When the process is finished, the membership provider should now display FBA.

    What SharePoint has done behind the scenes is make the necessary changes to the IIS website to support Forms based authentication. But we still have a little problem. If we browse to the site right now, we won’t be prompted for Windows credentials anymore. Not only do we NOT have a user in the .NET membership database, but we have no FBA based administrators. Let’s tackle that next.

    IIS 7.0 Web Site Configuration for SharePoint 2010 FBA

    1. In IIS Manager, select the SharePoint site. In this example, we used the default site (80).
    2. Double click the .NET Users icon
    3. Click Set Default Provider from the actions pane on the left and select FBA
      dftuser
    4. Click OK to save.
    5. While we’re here, let’s add our first user. This will be used as an administrative account on the FBA site. Click Add..
      newuser
    6. Select a User, Email and Password. Depending upon parameters you defined earlier you may be prompted with challenge/response questions.
      ** The password may require some strength by default. If you receive an error message that states the “password is invalid”, simply add a number or non-alpha character.
    7. Next, select the SharePoint Central Administation v4 web site from the connections menu in IIS.
    8. Click .Net Users, then in the Actions menu select “Set Default Provider” and set that to FBA.

    Set the User as Site Administrator on the SharePoint 2010 Web Site

    1. In SharePoint Central Admin v4, go to Application Management
    2. In the Site Collections section, select “Change Site Collection Administrators”
      siteadmins
    3. On the next page, select the Site Collection we’ve been using.
    4. You’ll note that the primary site collection administrator has a little red squiggly. Why? We don’t have Windows Authentication enabled for this site and therefore no way to resolve. Delete the Administator account.
    5. In the field type the user created above (we used fbaadmin), then click the Check Names button. You should see a black underline noting that the name was resolved.
      fbaadmin

     

    Test the site

    1. In a Web Browser, when you access the site http://localhost (if that’s what you used), you’ll be presented with the SharePoint login screen, not a Windows login pop-up. (Wow, and you thought SharePoint 2007 had a spartan login screen. Get a load of this !)
      login
    2. Login with the fbaadmin credentials and you should be able to access the site.
      homepage2

     

    Add the reference to the user friendly people picker

    You know the picker…so you can easily find those needles in the haystack. For that to work in Central Admin and this site against your .NET membership database, you need to add a reference to the provider.

    1. In IIS Manager, browse to the Central Admin web application. Explore the folder and find the web.config file. Open in Notepad.
    2. Find the <PeoplePickerWildcards> node and use the following:

     

    <PeoplePickerWildcards>
    <clear />
    <add key=”FBA” value=”%” />
     </PeoplePickerWildcards>

     

    Final Note

    If you plan to use the same membership database for multiple sharepoint sites AND you choose to encrypt the passwords, you’ll need to add one final step. In IIS 7,  on the first site, select the Machine Keys icon. Copy those keys. In the next site that you create, you’ll need to use the same machine keys and disable “Automtically Generate” and disable “Generate Unique Key”. This is crucial as the machine key is used to determine the encrypted password that is passed back to the .NET membership database.

저작자표시 비영리 변경금지

'Solution Platform' 카테고리의 다른 글

Configure Forms Based Authentication (FBA) with SharePoint 2010  (0) 2011.06.27
[펌]Hide Button from SharePoint Ribbon  (0) 2011.05.13
Fixing those pesky DCOM event log error 10016 in a SharePoint farm environment  (0) 2011.02.08
using Client Object model SharePoint 2010  (0) 2010.12.24
SharePoint 2010 Document File Open Behavior  (0) 2010.12.09

+ Recent posts

티스토리툴바