Understanding the server security requirements

Following are the security requirements of the SharePoint Server and the Internet Information Services (IIS) server:

• The BlueCielo Web Parts on the SharePoint server and the BlueCielo Web Service on the IIS server both use impersonation to retrieve data on behalf of the user that is logged in to SharePoint Server. To be able to do this, both the SharePoint Server and the IIS server must be trusted for delegation in Active Directory.

• If the BlueCielo Web Service will be run by an account other than NT AUTHORITY\NETWORK SERVICE or the BlueCielo Federated Connector will be used for search integration as described in About using the BlueCielo Federated Connector, then Kerberos authentication must be configured.

  For more information about Kerberos configuration, see the following web resources:

Fun with the Kerberos Delegation website

Kerberos Authentication problems – Service Principal Name (SPN) issues - Part 1

DelegConfig v1 (Delegation / Kerberos Configuration Tool)

SPN Query

• The SharePoint Server authentication provider should be set to Integrated Windows authentication and Negotiate, not NTLM.
• Ensure that the uploads sub-folder of the website folder exists and that impersonated users have Full Control rights to it. This is the folder where documents that users upload for import into the library will reside.
• Confirm that the SharePoint Server web.config file contains the following settings:

<system.web>
 <authentication mode="Windows" />
 <identity impersonate="true" />
 <pages enableSessionState="true" ... >
 </pages>
 <trust level="Full" originUrl="" />
</system.web>

Tip    To aid with configuring these settings, a SharePoint solution is available in the distribution package in the WebConfigModifications Setup folder.