Page History
Table of Contents |
---|
SharePoint 2013 Aspire Components Installation
PowerShell Script Signing
In some cases, depending on the windows script execution policy, running PowerShell scripts will require them to be signed, additional information here. There are several solutions for this:
- Remove the script execution restrictions by running Set-ExecutionPolicy. See details here and usage here. For this you'll need to have administrator rights in the machine.
- Paste the script code (including referred scripts) in the PowerShell command line and execute from there. This however might not be practical if the scripts are long.
- Sign the certificates by following these steps:
- Make sure 'makecert.exe' from the Windows SDK is in the path and can be accessed from PowerShell. You might need to install the SDK relevant to the Windows version here.
- You'll need a Certificate Authority (CA) on which to sign the scripts. Either use one of yours or run the following steps to create and register one:
Create the CA certificate:
Code Block language text theme FadeToGrey makecert -n "CN=<the name of the CA>" -r -sv <the name of the CA>.pvk <the name of the CA>.cer
- Register the CA certificate to your Trusted Root Certification Authorities:
- Open certmgr.msc
- Under CurrentUser>Trusted Root Certification Authorities, right click Certificates
- Select All Tasks > Import
- Find the file you just created, import it
- Create a personal certificate and use the new CA cert to sign the new personal certificate:
Run the following:
Code Block language text theme FadeToGrey makecert -sk <Certificate name> -iv <CA Certificate name>.pvk -n "CN=<Certificate name>" -ic <CA Certificate name>.cer <Certificate name>.cer -sr currentuser -ss CRT
- The certificate should be now under CurrentUser>Personal>Certificates, if not, import it as you did with the CA (but under personal this time).
- Configure Windows to run signed scripts:
- Run the following and confirm (y). You might need to specify a scope (see the command documentation):
Code Block language text theme FadeToGrey set-executionpolicy allsigned
- Run the following and confirm (y). You might need to specify a scope (see the command documentation):
Confirm the certificate is up:
Code Block language text theme FadeToGrey gci cert:\CurrentUser\CRT -codesigning
Sign your script (signtool should be in the same path as makecert):
Code Block language text theme FadeToGrey signtool sign /v /n "<Certificate name>" <your script>.ps1
- In some cases signtool doesn't find the private key and fails signing the file. If that is the case, run the following steps:
Create a different client certificate with this:
Code Block language text theme FadeToGrey makecert -pe -n "CN=<Certificate name>" -ss CRT2 -a sha1 -eku 1.3.6.1.5.5.7.3.3 -iv <CA Certificate name>.pvk -ic <CA Certificate name>.cer
Get the certificate:
Code Block language text theme FadeToGrey $cert = @(Get-ChildItem cert:\CurrentUser\CRT2 -CodeSigning)[0]
Sign the file:
Code Block language text theme FadeToGrey Set-AuthenticodeSignature .\<your script>.ps1 $cert
- Open your script and find the encrypted string in it. You should be able to run your script now.
Publisher Installation
Single Server Installation
- Download the latest version of the installation files from our repository
- Log in to a SharePoint 2013 server
- Copy the installation package (Deploy file) to that server
- Extract it to some directory (i.e.: C:\Deploy)
- Fill up the configurationParameters.xml
- Start PowerShell as administrator
- cd to scripts directory (cd “C:\Deploy\scripts”)
Run
Code Block language text theme FadeToGrey .\DeployPublisher.ps1 -configurationFilePath ..\config\configurationParameters.xml
(Optional) Install the Security Trimmer. Run
Code Block language text theme FadeToGrey .\DeployAspireSecurityTrimmer.ps1 -configurationFilePath ..\config\configurationParameters.xml
- Reboot the server to ensure security group memberships are updated
- Deploy and configure Aspire component (SharePoint 2013 Publisher Configuration TutorialHow to configure)
Multi-Server Installation
- Download the latest version of the installation files from our repository
- Install the intermediate repository
- Log in to the server that you plan to install the intermediate repository
- Copy the installation package Deploy File to that server
- Extract it to some directory (C:\DeployRepository)
- Fill up the configurationParameters.xml
- Start PowerShell as administrator
- cd to scripts directory (cd “C:\ DeployRepository\scripts”)
Run
Code Block language text theme FadeToGrey .\DeployIntermediateRepository.ps1 -configurationFilePath ..\config\configurationParameters.xml
- Reboot the server to ensure security group memberships are updated
- Deploy Aspire BDC Service
- Copy the extracted installation folder content (C:\DeployRepository\...) with updated configuration file, from Intermediate Repository server
- Log in to the server that you planned to install Aspire Service, and paste copied content to some directory (C:\DeployAspireService)
- Make sure the configuration file has been updated from the previous installation and filled piped parameters inside Aspire BDC Service inputs.
- Start PowerShell as administrator
- cd to scripts directory (cd “C:\DeployAspireService\scripts”)
Run
Code Block language text theme FadeToGrey .\DeployAspireBDCService.ps1 -configurationFilePath ..\config\configurationParameters.xml
- Reboot the server to ensure security group memberships are updated
- Deploy Notification Service
- Copy the installation package (C:\DeployAspireService) with updated configuration file, from Aspire Service server
- Log in to any SharePoint server that you planned to install Notification Service, and paste copied content to some directory (C:\DeployEndpoint)
- Make sure the configuration file has been updated from the previous installation and filled piped parameters inside Notification Service inputs.
- Start PowerShell as administrator
- cd to scripts directory (cd “C:\DeployEndpoint\scripts”)
Run
Code Block language text theme FadeToGrey .\DeployNotificationService.ps1 -configurationFilePath ..\config\configurationParameters.xml
- Reboot the server to ensure security group memberships are updated
- Deploy and Configure Aspire Component
- See SharePoint 2013 Publisher Configuration TutorialHow to configure
Security Trimmer Installation
- Fill up the configurationParameters.xml
- Start the SharePoint Management Shell as Administrator.
- cd to scripts directory (cd “C:\DeployEndpoint\scripts”).
Run
Code Block language text theme FadeToGrey .\DeployAspireSecurityTrimmer.ps1 -configurationFilePath ..\config\configurationParameters.xml
- RESTART The SharePoint Search Host Controller service
Configuration Parameters Example
The configuration file is found here "..\Deploy\config\configurationParameters.xml".
The next is an example on how to fill up the configuration file using the QA\spadmin for all the services.
Code Block | ||||
---|---|---|---|---|
| ||||
<?xml version="1.0"?> <parameters> <security> <usersGroupName>AspireUsers</usersGroupName> <ldapGroupQuery>CN=Users,DC=QA,DC=local</ldapGroupQuery> </security> <users> <AspireBDCServiceAppPool>QA\spadmin</AspireBDCServiceAppPool> <contentAccess>QA\spadmin</contentAccess> <aspirePropertyRepositoryUser>QA\spadmin</aspirePropertyRepositoryUser> <aspirePropertyEndpointUser>QA\spadmin</aspirePropertyEndpointUser> </users> <repository> <inputs> <folderPath>C:\Repository</folderPath> <shareName>IntermediateRepository</shareName> </inputs> <outputs> <repositorySharePath></repositorySharePath> </outputs> </repository> <aspireService> <inputs> <folderPath>C:\inetpub\wwwroot\AspireService</folderPath> <repositorySharePath piped="true"></repositorySharePath> </inputs> <outputs> <aspireServiceUrl></aspireServiceUrl> </outputs> </aspireService> <notificationEndpoint> <outputs> <notificationEndpointUrl></notificationEndpointUrl> </outputs> </notificationEndpoint> <securityTrimmer> <inputs> <groupExpansionService>http://localhost:50505/groupExpansion</groupExpansionService> <groupExpansionTimeout>15000</groupExpansionTimeout> <useDomain>false</useDomain> <claimIssuer>aspire</claimIssuer> <searchApplicationName>Search Service Application</searchApplicationName> <id>1</id> <assemblyVersion>2.2.0.2</assemblyVersion> </inputs> </securityTrimmer> </parameters> |
Section Description
Security
Code Block | ||
---|---|---|
| ||
<security> <usersGroupName>AspireUsers</usersGroupName> <ldapGroupQuery>CN=Users,DC=QA,DC=local</ldapGroupQuery> </security> |
The security section is an initial approach to have the users group name configurable. Right now it is hardwired to AspireUsers and cannot be changed due to code limitations.
Right now this configuration is used to determine if the AspireUsers group exists as an Active Directory group and if not, it will create it locally.
Field | Description |
---|---|
Users Group Name | User group to which the users must belong to. |
LDAP Group Query | The LDAP query (minus the group name) that will be used to check for the existence of the group. |
Users
Code Block | ||
---|---|---|
| ||
<users> <aspireServiceAppPool>QA\spadmin</aspireServiceAppPool> <contentAccess>QA\spadmin</contentAccess> <aspirePropertyRepositoryUser>QA\spadmin</aspirePropertyRepositoryUser> <aspirePropertyEndpointUser>QA\spadmin</aspirePropertyEndpointUser> </users> |
The users section specifies the users for each component.
Field | Description |
---|---|
Aspire Service app pool user | User who runs the app pool of Aspire BDC Service |
Content access user | SharePoint default content access account |
Aspire property repository user | Intermediate Repository user, which is specified in Aspire PublishToSP2013 application properties. This can be any domain user |
Aspire property endpoint user | Endpoint user, which is specified in Aspire PublishToSP2013 application properties. This can be any domain user |
Repository
Code Block | ||
---|---|---|
| ||
<repository> <inputs> <folderPath>C:\Repository</folderPath> <shareName>IntermediateRepository</shareName> </inputs> <outputs> <repositorySharePath></repositorySharePath> </outputs> </repository> |
The Repository section defines the directory where the batches that Aspire generates will be stored until SharePoint crawls them and then get cleaned up.
Note |
---|
Only the properties under the inputs node must be defined. |
Field | Description |
---|---|
Folder Path | Location used to map the Shared folder |
Share Name | Name of the Shared folder that will be exposed to the smb protocol |
Aspire BDC Service
Code Block | ||
---|---|---|
| ||
<aspireService> <inputs> <folderPath>C:\inetpub\wwwroot\AspireBDCService</folderPath> <repositorySharePath piped="true"></repositorySharePath> </inputs> <outputs> <aspireServiceUrl></aspireServiceUrl> </outputs> </aspireService> |
The Aspire BDC Service section defines the destination of the service's assemblies and the url to the intermediate repository.
Note |
---|
Only the properties under the inputs node that don't have the piped attribute as true must be defined. |
Field | Description | ||
---|---|---|---|
Folder Path | Destination of the service's assemblies | ||
Repository Share Path | The repository's url.
|
Notification Service
Code Block | ||
---|---|---|
| ||
<notificationService> <inputs> <webAppUrl></webAppUrl> </inputs> <outputs> <notificationServiceUrl></notificationServiceUrl> </outputs> </notificationService> |
The Notification Service section defines the SharePoint web application where the Notification Service will be deployed.
Note |
---|
Only the properties under the inputs node can be defined. |
Field | Description |
---|---|
Web App Url | Optional. Defines the SharePoint web application where the notification service will be deployed. If no web app is defined it will deploy in all web apps in the farm. It can be deployed in the central admin as long as a Web Front End service is enabled in that server. |
Security Trimmer
Code Block | ||
---|---|---|
| ||
<securityTrimmer> <inputs> <groupExpansionService>http://localhost:50505/groupExpansion</groupExpansionService> <groupExpansionTimeout>15000</groupExpansionTimeout> <useDomain>false</useDomain> <claimIssuer>aspire</claimIssuer> <searchApplicationName>Search Service Application</searchApplicationName> <id>1</id> <assemblyVersion>2.2.0.2</assemblyVersion> </inputs> </securityTrimmer> |
The Security Trimmer section defines the properties that the Trimmer component needs to access the group expansion service in order to verify the claims of a user requesting documents.
Field | Description |
---|---|
Group Expansion Service | Url of the Aspire Group Expansion service |
Group Expansion Timeout | Timeout to wait for Group Expansion response |
Use Domain | Use domain in security trimmer |
Claim Issuer | If you are using "Use Aspire" option in the SharePoint2013 Publisher, type "aspire" |
Search Application Name | Name of the Seach Application |
Id | The trimmer instance Id in SharePoint. Default is 1. |
Assembly Version | Version of the trimmer dll registered on the GAC |
Installation Verification
Repository
Check in your drive that the folder was created. The location can be found in the output parameter <repositorySharePath>.
Aspire BDC Service
- Go to IIS.
- On the left side (on the Connections Panel).
- Expand in your server, the "Sites" folder.
- Check that "AspireBDCService" is in there.
- Right click on it -> Manage WebSite -> Browse.
- You should see something like this:
Notification Service
- Go to http://<sp2013_server>/_vti_bin/AspireNotificationService/AspireNotificationService.svc
- Verify that the URL provided by the Notification Service installation is the correct one. In some cases you'll have to use the fully quallified DNS name instead of hostname only or change the URL protocol (http/https). It should be the root site of an existing web application or the Central Administration web application site.
- You should see something like:
Security Trimmer
- Open SharePoint 2013 Management Shell
- Run the following command: Get-SPEnterpriseSearchServiceApplication -Identity MySSA | Get-SPEnterpriseSearchSecurityTrimmer
- You should see something like this: