Solutions Monkey : Administration

Enterprise portal application functionality overview document

meysun — Wed, 29 Jul 2009 03:22:00 GMT

Jim Brotherton created this very useful document that describes the modules, features and business tasks that user perform in Enterprise Portal http://www.microsoft.com/downloads/details.aspx?FamilyID=0a0abfc4-964f-43ee-ad26-3d5d4c156269&displaylang=en. We have produced lots of good documentation for EP in AX 2009 and continue to look for ways to adding even more. If you have suggestions, please post a comment to this blog post with the topic name.

Move EP site from one machine to another

meysun — Sat, 16 May 2009 03:38:00 GMT

Microsoft Dynamics AX 2009 provides simple way to import your changes to pages into AOT and use the AX xpo mechanism to export/import the page/web control and other aot changes to the other machine and deploy them.

But there amy be cases where you have heavily customized your SharePoint site not just the pages but the theme, added content , links, libraries etc and if you need to take a back of this customzied EP SharePoint site and restore it in another machine for testing, here are the steps

Let us say you are planning to move the site from MachineA to MachineB. In MachineA you have the site with the url http://MachineA/Sites/DynamicsAX and you want to create the same site in MachineB with the url http://MachineB/Sites/AX , then

(1) In Machine A, open up a command prompt and navigate to C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN

(2) Execute the below command

stsadm -o backup -url http://MachineA/Sites/DynamicsAX -filename c:\axep.bak

(3) Copy c:\axep.bak from MachineA to MachineB to c:\

(4) Make sure the AOD files in MachineB are the same as in MachineA

(5) Make sure EP is deployed in MachineB. ( You don't need to create the EP Site, but EP must have been deployed)

(6) Open up AX Client in Machine B And navigate to Administration->Setup->Internet->Enterprise Portal->Web Sites and delete any site entry that may already be there with http://MachineB/Sites/Ax ( Since this is the site url that you are going to use to restore).

(7) In Machine B, open up a command prompt and navigate to C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN

(8) Execute the below command

stsadm -o restore -url http://MachineB/Sites/AX -filename c:\axep.bak

(9) Open up AX Client in Machine B And navigate to Administration->Setup->Internet->Enterprise Portal->Web Sites and Click the "Register Site" button. This will add a new row to the Websites grid. Enter http://MachineB/Sites/Ax as the internal url and external url and Type as "Full". Click on the "General" tab and check the "Company independent" check box ( or uncheck it if you want this site to be specific to a particular company in AX) and save.

(10) Now navigate to http://MachineB/Sites/AX and this should have all the changes that you made in http://MachineA/Sites/DynamicsAX

Integrating EP Web Parts to non-EP SharePoint sites

meysun — Fri, 03 Apr 2009 20:50:00 GMT

If you already have SharePoint sites ( not based on EP site templates) and if you would like to use some of the AX web parts in those sites, it's easily doable in Microsoft Dynamics AX 2009.

Here are the steps to do.

(1) Integrating EP web parts to other sites requires install EP on the SharePoint server. To do that run setup and select Role Centers and Enterprise Portal component and go through the setup wizard. ( Uncheck the Auto create site option) since you don’t need a new site.

(2) Then you need to add a script manager to the master page (for example C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\TEMPLATE\GLOBAL\default.master)of your site.
For example add
<%@ Register Assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" Namespace="System.Web.UI" TagPrefix="asp" %>
Just above the HTML tag ( Search for <HTML)

And add the below just inside the Form tag ( search for <form)
<WebPartPages:SPWebPartManager id="m" runat="Server" />
<asp:ScriptManager ID="ScriptManager1" runat="server" EnablePartialRendering="true" />

If you don’t have permission to change the master page, then you can create a user control that contains this script manager and create a SharePoint feature that adds this UserControl to our AdditionalPageHead delegate control. For example refer to http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.webcontrols.delegatecontrol.aspx

(3) Then Go to AXClient -> Administration->Setup->Internet -> Enterprise Portal and add the website and register the site with type “Web Parts only”. You also need to specify a company.

Once the script manager is added , EP is installed and the Site is registered in AX , then you can start using EP webparts on any SharePoint site.

For example, in the below screenshot, I am using AX web parts ( Cues and Unified worklist) in a wiki SharePoint site

Role Center Security

meysun — Wed, 28 May 2008 10:46:00 GMT

Role Center Security

Forcing NTLM http://blogs.msdn.com/solutions/archive/2008/05/28/forcing-ntlm-on-iiswebsite.aspx
Configuring Kerberos http://blogs.msdn.com/solutions/archive/2008/02/28/enterprise-portal-kerberos-delegation-for-connecting-to-reporting-analysis-services-on-a-different-box.aspx

SharePoint

SSRS

SSAS

Ax

Forcing NTLM on IISWebsite

meysun — Wed, 28 May 2008 10:30:00 GMT

1) Go to IISManager and find the identifier for your Web Site. Click on the web sites folder in IISManager and on the left side you should get the list of web sites and their identifier

(2) Open a command prompt and runt the following 3 commands. Change the <identifier> with the identifier value found in the previous step
cd c:\inetpub\adminscripts
cscript adsutil.vbs set w3svc/<identifier>/root/NTAuthenticationProviders "NTLM"
iisreset

NOTE:

(1) if you want to set NTLM at a virtual direcotry level then use the below command and replace <virtualdirectoryname> with the virutal directory name
cscript adsutil.vbs set w3svc/<identifier>/root/<virtualdirectoryname>/NTAuthenticationProviders "NTLM"

(2) To revert back to Kerberos use "Negotiate,NTLM" as the parameter

(3) To check what is currently set use the below commands
cscript adsutil.vbs get w3svc/<identifier>/root/NTAuthenticationProviders
cscript adsutil.vbs get w3svc/<identifier>/root/<virtualdirectoryname>/NTAuthenticationProviders

EP Architecture

meysun — Wed, 28 May 2008 09:30:00 GMT

Enterprise Portal Kerberos Delegation for connecting to Reporting/Analysis Services on a different box

meysun — Thu, 28 Feb 2008 09:08:00 GMT

Here are the steps that I followed for setting up Kerberos Delegation on For Enterprise Portal connecting to Reporting Services/ Analysis Services on different boxes

1) The first thing to do is to check that your domain controller is operating in Windows 2003 mode. By default you’ll find your system will operate in the Windows 2000 compatible mode. To check this go to active directory users and computers, right click on your domain, and click ‘Raise Domain Functional Level’. If it’s in Windows 2000 compatible mode, then raise it to Windows 2003 mode.

2) Enable Kerberos in SharePoint

a. Open Central Administration

b. Navigation to Application Management > Authentication Providers

c. Choose the web application you wish to configure from the drop-down in the top right corner

d. Click on 'Default'

e. Set the authentication to Negotiate (Kerberos)

f. IISRESET

g. In case of MOSS perform the below additional steps

i. Repeat the steps “c” to “e” until all application pools needed are modified. (Minimum should be the content application and the ssp application)

ii. To set the SSP and Excel Services if you are running them to use Kerberos authentication it is best to run the following two commands:

1. STSADM.EXE –o Set-ECSsecurity –SSP <ssp name> -AccessModel Delegation

2. STSADM.EXE –o SetSharedWebServiceAuthN –negotiate

iii. Optional if SharePoint admin service is enabled – STSADM.EXE –o execadmsvcjobs
If the service is not running the command is needed to propagate the change to additional servers and services.

iv. IISRESET

3) Make sure Reporting server and Report Manager virtual directory has Kerberos enabled. ( By default this is set to Kerberos. So this is an optional step , just to verify and correct)

a. In IIS Manager, right-click the local computer, and then click Properties..

b. Select the Enable Direct Metabase Edit check box, and then click OK.

c. Click Start, click Run, type cmd, and then click OK.

d. At the command prompt, type the following command to change to the directory where the MetaBase.xml file is located:

e. cd %systemroot%\system32\inetsrv

f. To open the file with Notepad, at the command prompt, type the following:

g. notepad MetaBase.xml

h. In the <IISWebServer> section, locate the NTAuthenticationProviders metabase property and modify its setting to read "Negotiate,NTLM".

i. Repeat the same for Reports and ReportServer Virtual directory

j. Save and close the MetaBase.xml file.

k. IISRESET

4) Register the App pool

a. SPNs are configured by using SetSPN.exe (download it from here for Windows 2003 SP1 or SP2) which is a command line provided as part of the Windows 2003 resource kit

b. Run SetSPN for all EP servers and Reporting Servers with the app pool account alias for HTTP ( for each server you have to run twice one with FQDN and another with just host name for each service. So for a given server there will be two commands)

i. Setspn.exe -A HTTP/mey1 redmond\meysun

ii. Setspn.exe -A HTTP/mey1.redmond.corp.microsoft.com redmond\meysun

In the above command, replace
“mey1” with the server name
“redmond.corp.microsoft.com” with the domain name
“redmond\meysun” with the app pool account

c. Add the SSAS service to each account for each Analysis Service machine

i. Setspn.exe -A MSOLAPSvc.3/mey1 ssasaccount

ii. Setspn.exe -A MSOLAPSvc.3/mey1.redmond.corp.microsoft.com ssasaccount

In the above command, replace
“mey1 ” with the server name
“redmond.corp.microsoft.com” with the domain name
“ssasaccount” with the machine name if the SSAS service is running in network service or the domain account which is running this service

5) The user account(s) you want to be delegated must have the "Account Is Sensitive And Cannot Be Delegated" option cleared (i.e. not checked). You'll find this property in "Active Directory Users And Groups", under the "Account" property tab. I believe this is unchecked by default.

6) The app pool accounts should have the" Account Is Trusted For Delegation" option enabled in "Active Directory Users And Groups"->"User"->"Properties"->"Delegation"->"Account is trusted for delegation ".

7) In the odc file stored in Data Connections document library on the EP site, edit the connection string and append the following ";SSPI=Kerberos"

8) Component Services Configuration

a. Open Component Services on the EP server

b. Navigate to Component Services > Computers > My Computer > DCOM Config > IIS WAMREG Admin Service

c. Click on Properties (for IIS WAMREG Admin Service) and navigate to the Security tab

d. Edit Launch and Activate Permissions

e. Grant all application pool account 'Local Activation' permissions (see http://support.microsoft.com/kb/920783). In our example, these accounts would be your network service and app pool account of your EP site.

Note: If you are Windows 2008 Server, then by default Kernel Mode Authentication is enabled and it uses LocalSystem account. So for web sites which use Domain account as App Pool account either you need to configure useAppPoolCredentials in applicationHost.config

Configure the useAppPoolCredentials attribute in system.webServer/security/authentication/Windows-Authentication configuration section to true. For example:

<windowsAuthentication enabled="true" useKernelMode="true" useAppPoolCredentials="true" />

OR disable Kernel-mode authentication for the web site

In IISManager7 , under the Windows Authentication -> Advanced Settings option, uncheck "Enable Kernel Mode authentication"

Installing SQL Reporting Services and MOSS 2007 on the Same port ( default : 80)

meysun — Tue, 30 Oct 2007 01:17:00 GMT

If you have both MOSS 2007 ( Microsoft Office SharePoint Server) and Reporting Services ( not in SharePoint integrated mode) installed on the same IIS virtual server, then you have to make the below updates in web.config for them to work

1) In the Root web.config to comment out the below. Otherwise the reportserver will give sessionState partitionResolver Issue


2) In both Reportserver and ReportManager vdir web.config, the following should be added under appSettings. Otherwise you will get ReportViewer error messages
<remove key="ReportViewerMessages" />

This is because , by default MOSS uses /reports url for it’s report center and it’s the same virtual dir url for native SQL Reporting Services report manager as well.