SharePoint 2013 Aspire Components Installation

PowerShell Script Signing

In some cases, depending on the windows script execution policy, running PowerShell scripts will require them to be signed, additional information here.  There are several solutions for this:

1. Remove the script execution restrictions by running Set-ExecutionPolicy.  See details here and usage here.  For this you'll need to have administrator rights in the machine.
2. Paste the script code (including referred scripts) in the PowerShell command line and execute from there.  This however might not be practical if the scripts are long.
3. Sign the certificates by following these steps:
   1. Make sure 'makecert.exe' from the Windows SDK is in the path and can be accessed from PowerShell.  You might need to install the SDK relevant to the Windows version here.
   2. You'll need a Certificate Authority (CA) on which to sign the scripts.  Either use one of yours or run the following steps to create and register one:

      1. Create the CA certificate: 

         makecert -n "CN=<the name of the CA>" -r -sv <the name of the CA>.pvk <the name of the CA>.cer

      2. Register the CA certificate to your Trusted Root Certification Authorities:
         1. Open certmgr.msc
         2. Under CurrentUser>Trusted Root Certification Authorities, right click Certificates 
         3. Select All Tasks > Import
         4. Find the file you just created, import it
      3. Create a personal certificate and use the new CA cert to sign the new personal certificate:
         

         1. Run the following: 

            makecert -sk <Certificate name> -iv <CA Certificate name>.pvk -n "CN=<Certificate name>" -ic <CA Certificate name>.cer <Certificate name>.cer -sr currentuser -ss CRT

         2. The certificate should be now under CurrentUser>Personal>Certificates, if not, import it as you did with the CA (but under personal this time).
      4. Configure Windows to run signed scripts:
         1. Run the following and confirm (y). You might need to specify a scope (see the command documentation): 

            
            

            set-executionpolicy allsigned

      5. Confirm the certificate is up: 

         gci cert:\CurrentUser\CRT -codesigning

      6. Sign your script (signtool should be in the same path as makecert): 

         signtool sign /v /n "<Certificate name>" <your script>.ps1

      7. Open your script and find the encrypted string in it.  You should be able to run your script now.

Publisher Installation

Single Server Installation

1. Download the latest version of the installation files from our repository  
2. Log in to a SharePoint 2013 server
3. Copy the installation package (Deploy file) to that server
4. Extract it to some directory (i.e.: C:\Deploy)
5. Fill up the configurationParameters.xml
6. Start PowerShell as administrator
7. cd to scripts directory (cd “C:\Deploy\scripts”)

8. Run 

   .\DeployPublisher.ps1 -configurationFilePath ..\config\configurationParameters.xml

9. (Optional) Install the Security Trimmer. Run 

   .\DeployAspireSecurityTrimmer.ps1 -configurationFilePath ..\config\configurationParameters.xml

10. Reboot the server to ensure security group memberships are updated
11. Deploy and configure Aspire component (SharePoint 2013 Publisher How to configure)

Multi-Server Installation

1. Download the latest version of the installation files from our repository  
2. Install the intermediate repository
   1. Log in to the server that you plan to install the intermediate repository
   2. Copy the installation package Deploy File to that server
   3. Extract it to some directory (C:\DeployRepository)
   4. Fill up the configurationParameters.xml
   5. Start PowerShell as administrator
   6. cd to scripts directory (cd “C:\ DeployRepository\scripts”)

   7. Run

      .\DeployIntermediateRepository.ps1 -configurationFilePath ..\config\configurationParameters.xml

   8. Reboot the server to ensure security group memberships are updated
3. Deploy Aspire BDC Service
   1. Copy the extracted installation folder content (C:\DeployRepository\...) with updated configuration file, from Intermediate Repository server
   2. Log in to the server that you planned to install Aspire Service, and paste copied content to some directory (C:\DeployAspireService)
   3. Make sure the configuration file has been updated from the previous installation and filled piped parameters inside Aspire BDC Service inputs.
   4. Start PowerShell as administrator
   5. cd to scripts directory (cd “C:\DeployAspireService\scripts”)

   6. Run 

      .\DeployAspireBDCService.ps1 -configurationFilePath ..\config\configurationParameters.xml

   7. Reboot the server to ensure security group memberships are updated
4. Deploy Notification Service
   1. Copy the installation package (C:\DeployAspireService) with updated configuration file, from Aspire Service server
   2. Log in to any SharePoint server that you planned to install Notification Service, and paste copied content to some directory (C:\DeployEndpoint)
   3. Make sure the configuration file has been updated from the previous installation and filled piped parameters inside Notification Service inputs.
   4. Start PowerShell as administrator
   5. cd to scripts directory (cd “C:\DeployEndpoint\scripts”)

   6. Run 

      .\DeployNotificationService.ps1 -configurationFilePath ..\config\configurationParameters.xml

   7. Reboot the server to ensure security group memberships are updated
5. Deploy and Configure Aspire Component
   1. See SharePoint 2013 Publisher How to configure

Security Trimmer Installation

1. Fill up the configurationParameters.xml
2. Start the SharePoint Management Shell as Administrator.
3. cd to scripts directory (cd “C:\DeployEndpoint\scripts”).

4. Run 

   .\DeployAspireSecurityTrimmer.ps1 -configurationFilePath ..\config\configurationParameters.xml

5. RESTART The SharePoint Search Host Controller service

Configuration Parameters Example

The configuration file is found here "..\Deploy\config\configurationParameters.xml".

The next is an example on how to fill up the configuration file using the QA\spadmin for all the services.

<?xml version="1.0"?>
<parameters>
  <security>
    <usersGroupName>AspireUsers</usersGroupName>
    <ldapGroupQuery>CN=Users,DC=QA,DC=local</ldapGroupQuery>
  </security>
  <users>
    <AspireBDCServiceAppPool>QA\spadmin</AspireBDCServiceAppPool>
    <contentAccess>QA\spadmin</contentAccess>
    <aspirePropertyRepositoryUser>QA\spadmin</aspirePropertyRepositoryUser>
    <aspirePropertyEndpointUser>QA\spadmin</aspirePropertyEndpointUser>
  </users>
  <repository>
    <inputs>
      <folderPath>C:\Repository</folderPath>
      <shareName>IntermediateRepository</shareName>
    </inputs>
    <outputs>
      <repositorySharePath></repositorySharePath>
    </outputs>
  </repository>
  <aspireService>
    <inputs>
      <folderPath>C:\inetpub\wwwroot\AspireService</folderPath>
      <repositorySharePath piped="true"></repositorySharePath>
    </inputs>
    <outputs>
      <aspireServiceUrl></aspireServiceUrl>
    </outputs>
  </aspireService>
  <notificationEndpoint>
    <outputs>
      <notificationEndpointUrl></notificationEndpointUrl>
    </outputs>
  </notificationEndpoint>
  <securityTrimmer>
    <inputs>
      <groupExpansionService>http://localhost:50505/groupExpansion</groupExpansionService>
      <groupExpansionTimeout>15000</groupExpansionTimeout>
      <useDomain>false</useDomain>
      <claimIssuer>aspire</claimIssuer>
      <searchApplicationName>Search Service Application</searchApplicationName>
      <id>1</id>
      <assemblyVersion>2.2.0.2</assemblyVersion>
    </inputs>
  </securityTrimmer>
</parameters>

Section Description

Security

 <security>
   <usersGroupName>AspireUsers</usersGroupName>
   <ldapGroupQuery>CN=Users,DC=QA,DC=local</ldapGroupQuery>
 </security>

The security section is an initial approach to have the users group name configurable. Right now it is hardwired to AspireUsers and cannot be changed due to code limitations.

Right now this configuration is used to determine if the AspireUsers group exists as an Active Directory group and if not, it will create it locally.

Users

<users>
   <aspireServiceAppPool>QA\spadmin</aspireServiceAppPool>
   <contentAccess>QA\spadmin</contentAccess>
   <aspirePropertyRepositoryUser>QA\spadmin</aspirePropertyRepositoryUser>
   <aspirePropertyEndpointUser>QA\spadmin</aspirePropertyEndpointUser>
 </users>

The users section specifies the users for each component.

Repository

<repository>
   <inputs>
     <folderPath>C:\Repository</folderPath>
     <shareName>IntermediateRepository</shareName>
   </inputs>
   <outputs>
     <repositorySharePath></repositorySharePath>
   </outputs>
 </repository>

The Repository section defines the directory where the batches that Aspire generates will be stored until SharePoint crawls them and then get cleaned up.

Aspire BDC Service

<aspireService>
   <inputs>
     <folderPath>C:\inetpub\wwwroot\AspireBDCService</folderPath>
     <repositorySharePath piped="true"></repositorySharePath>
   </inputs>
   <outputs>
     <aspireServiceUrl></aspireServiceUrl>
   </outputs>
 </aspireService>

The Aspire BDC Service section defines the destination of the service's assemblies and the url to the intermediate repository.

Notification Service

  <notificationService>
	<inputs>
	  <webAppUrl></webAppUrl>
	</inputs>
    <outputs>
      <notificationServiceUrl></notificationServiceUrl>
    </outputs>
  </notificationService>

The Notification Service section defines the SharePoint web application where the Notification Service will be deployed.

Security Trimmer

 <securityTrimmer>
   <inputs>
     <groupExpansionService>http://localhost:50505/groupExpansion</groupExpansionService>
     <groupExpansionTimeout>15000</groupExpansionTimeout>
     <useDomain>false</useDomain>
     <claimIssuer>aspire</claimIssuer>
     <searchApplicationName>Search Service Application</searchApplicationName>
     <id>1</id>
     <assemblyVersion>2.2.0.2</assemblyVersion>
   </inputs>
 </securityTrimmer>

The Security Trimmer section defines the properties that the Trimmer component needs to access the group expansion service in order to verify the claims of a user requesting documents.

Installation Verification

Repository

Check in your drive that the folder was created. The location can be found in the output parameter <repositorySharePath>.

Aspire BDC Service

1. Go to IIS.
2. On the left side (on the Connections Panel).
3. Expand in your server, the "Sites" folder.
4. Check that "AspireBDCService" is in there.
5. Right click on it -> Manage WebSite -> Browse.
6. You should see something like this:

Notification Service

1. Go to http://<sp2013_server>/_vti_bin/AspireNotificationService/AspireNotificationService.svc
   1. Verify that the URL provided by the Notification Service installation is the correct one.  In some cases you'll have to use the fully quallified DNS name instead of hostname only or change the URL protocol (http/https). It should be the root site of an existing web application or the Central Administration web application site.
2. You should see something like:

Security Trimmer

1. Open SharePoint 2013 Management Shell
2. Run the following command: Get-SPEnterpriseSearchServiceApplication -Identity MySSA | Get-SPEnterpriseSearchSecurityTrimmer
3. You should see something like this: