how to configure sharepoint online

SAP COMMUNITY NETWORK SDN - sdn.sap.com | BPX - bpx.sap.com | BA - boc.sap.com | UAC - uac.sap.com

© 2013 SAP AG 1

How to Configure SharePoint

Online

Applies to:

Duet Enterprise 2.0 SP1

Summary

This guide describes the architecture of SharePoint Online and provides detailed steps on how you can configure Duet Enterprise 2.0 Online.

Author: Shilpa K.Chakravarthy

Company: SAP

Created on: 10 January 2013

Author Bio

Shilpa is an information developer with the Duet Enterprise team.

How to Configure SharePoint Online


© 2013 SAP AG 2

Table of Contents

Overview and Architecture .................................................................................................................................. 3

SharePoint Online Configurations ................................................................................................................... 4 Configurations in the DMZ Zone .................................................................................................................................. 4

Configurations on SharePoint on Premise Server 15 ................................................................................................. 10

Configurations on SAP NetWeaver Gateway System ................................................................................................ 12

Configurations in Microsoft SharePoint Online DMZ Zone ........................................................................... 12 Create Secret Key and share with SAP admin ........................................................................................................... 12

Create secure store entry for reverse proxy‟s client authentication ............................................................................ 13

Create connection settings for appropriate service url ............................................................................................... 14

Import model from manage connections page ........................................................................................................... 15

Add permission .......................................................................................................................................................... 15

Trusting SharePoint for Workflow .............................................................................................................................. 16

Related Content ................................................................................................................................................ 17

Copyright........................................................................................................................................................... 18



© 2013 SAP AG 3

Overview and Architecture

Duet Enterprise Online for Microsoft SharePoint and SAP is a jointly developed product from SAP and Microsoft that enables interoperability between SAP applications and SharePoint Server 2013 Preview Enterprise Edition. Duet Enterprise Online Preview empowers employees to consume and extend SAP processes and information from within SharePoint Server 2013 Preview and Outlook 2013 Preview. Information that is stored in SAP applications is not moved into SharePoint. Instead the information stays in the SAP applications and is surfaced in SharePoint. That is, based on an individual user‟s permissions, the user can view and change information stored in SAP application from within SharePoint sites.

The following picture illustrates the main architecture elements of the Duet Enterprise 2.0 SharePoint Online and its interaction with the other system components:

SAP Business Suite

SAP NW 7.02

SAP NW GW 2.0

Content Add-On

Design Time tools

Duet Enterprise 2.0

SOAP

Enablement

oData

Enablement

Browser Office ClientWindows

Phone

Other

Phones

SharePoint On Cloud

Duet Enterprise Foundation

Duet Enterprise

Foudnation

Content

Building

blocks

oAuth Client

ACS

Reverse Proxy

Internet Facing

Customer Firewall

SharePoint On Premise

Duet SSO

Provider

SAP Business Suite / SAP Application Platform - SAP Business platform systems providing the business functionality exposed to Duet Enterprise 2.0 applications.



© 2013 SAP AG 4

In Duet Enterprise 2.0 Microsoft Exchange Server becomes an optional component. It will be used for some of the Duet Enterprise 2.0 scenarios, while others (like Word or Excel) won‟t require the usage of Exchange.

SAP NW GW 2.0 SP5 – is an ABAP add-on to a SAP NetWeaver 7.02 release, which optimizes standard SAP web services and is implemented on top of well-established techniques and standards such as REST, ATOM and OData for consumption of data in Duet Enterprise 2.0.

SAP NW 2.0 SP8 content – is an ABAP add-on to a SAP NetWeaver 7.02 release, which harmonizes the access to the SAP Business contents.

Duet Enterprise 2.0 - is an ABAP add-on to a SAP NetWeaver 7.02 release, which provides the support for SOAP & OData consumption in Microsoft SharePoint. It also provides the support for the Duet Enterprise 2.0 Foundation services like Reporting, Workflow, Role Sync and so on.

Duet Enterprise 2.0 foundation – This is the framework layer build by Microsoft to support the consumption of the oData4SAP based data feeds in SharePoint. Duet Enterprise 2.0 foundation surfaces the business data from SAP Business Suite (via SAP NetWeaver Gateway) into the Office application by leveraging Microsoft Office Business Applications Framework capabilities. Duet Enterprise 2.0 application runs on top of .NET Framework 4.0 runtime.

SharePoint On Cloud - Microsoft SharePoint Online is a commercial software plus services offer from Microsoft Corporation that includes Microsoft Office suite of desktop applications plus hosted versions of Microsoft's Server products (including Exchange Server, SharePoint Server) delivered and accessed over the Internet.

Azure Access Control Service (ACS) - This service provides authentication services for not only the Azure based cloud services, but also the local services. It provides a foundation for federated identity across the Internet.

Active Directory Federation Services (ADFS)

ADFS provides the logic to authenticate users in several ways. The ADFS issuer instances can be customized to authenticate users with Kerberos, forms authentication or certificates. This is known as an Identity federation. After the user is authenticated, the issuer creates a Claims about the user and issues a security token.

SharePoint Online Configurations

This involves configurations in the DMZ zone, SAP NetWeaver Gateway system and on SharePoint on premise server.

Configurations in the DMZ Zone

Ensure you have set-up a reverse proxy server in the DMZ zone in your landscape. Connect this reverse proxy server to Microsoft SharePoint On-Premise server.

Note: Below is an example of the set-up used at SAP for internal testing purposes. The reverse proxy server used is

Apache, installed on a Windows Server 2008. .

The below steps are based on Windows Server 2008. 1. Contact your IT team

a. Order a new Windows Server 2008 system for Reverse Proxy System in the DMZ zone.

b. To enable internet access on Reverse Proxy System, enable default ports (say port 80 (http)

and 443 (https)) on the provided Windows Server 2008.

c. To establish connection between Reverse Proxy System and SharePoint on Premise sever

i. Say on SharePoint on Premise server you have created site at port 10000

ii. Try to telnet from Reverse Proxy System to SharePoint on Premise server. For

example,. open the command prompt and telnet <hostname>:<port> or telnet <ip

address>:<port>

d. Enable alias name for Reverse Proxy System. E.g. www.yyy.com

2. Install Apache with open SSL at Reverse Proxy System



© 2013 SAP AG 5

a. Download Apache with open SSL from the link

http://httpd.apache.org/download.cgi#apache22 and install it.

http://httpd.apache.org/download.cgi#apache22



© 2013 SAP AG 8

Once installed try to test this from the machine http://localhost and then from the internet.

b. Update the openssl.cnf file as follows:

i. Go to Location <drive>:\Program Files (x86)\Apache Software

Foundation\Apache2.2\conf

ii. Edit openssl.cnf and add the below contents at end of the file:

[ server ]

basicConstraints = CA:FALSE

keyUsage = digitalSignature, keyEncipherment, dataEncipherment

extendedKeyUsage = serverAuth

nsCertType = server

[ client ]

basicConstraints = CA:FALSE

keyUsage = digitalSignature, keyEncipherment, dataEncipherment

extendedKeyUsage = clientAuth

nsCertType = client

c. Create Server Certificate:

i. Go to the folder location from command prompt <drive>:\Program Files

(x86)\Apache Software Foundation\Apache2.2\bin

ii. Create Server certificate

1. openssl genrsa -des3 -out privkey.pem 2048

2. openssl rsa -in "privkey.pem" -out "server.key"

3. openssl req -new -key privkey.pem -config "D:\Program Files (x86)\Apache

Software Foundation\Apache2.2\conf\openssl.cnf" -out server.csr

4. openssl x509 –in "server.csr" -out "server.crt" -req –signkey "server.key" -

days 7000

http://localhost/



© 2013 SAP AG 9

5. Copy all the 4 files which we created above from bin directory to conf

directory <drive>:\Program Files (x86)\Apache Software

Foundation\Apache2.2\conf

6. Trust the certificate (which was created at step 3) with CA for public access.

E.g . www.google.com

iii. Create Client Certificate. This is required as so that no one hacks your site. If the

client certificate is there on your desktop/laptop then only the site opens.

1. openssl req -config "D:\Program Files (x86)\Apache Software

Foundation\Apache2.2\conf\openssl.cnf" -newkey rsa:2048 -nodes -keyform

PEM -keyout ca.key -x509 -days 3650 -extensions v3_ca -outform PEM -out

ca.cer

2. openssl genrsa -out server.key 2048

a. openssl req -config "D:\Program Files (x86)\Apache Software

Foundation\Apache2.2\conf\openssl.cnf" -new -key server.key -out

server.req

b. openssl x509 -req -in server.req -CA ca.cer -CAkey ca.key -

set_serial 100 -extfile "D:\Program Files (x86)\Apache Software

Foundation\Apache2.2\conf\openssl.cnf" -extensions server -days

3650 -outform PEM -out server.crt

3. openssl genrsa -out client.key 2048

a. openssl req -config "D:\Program Files (x86)\Apache Software

Foundation\Apache2.2\conf\openssl.cnf" -new -key client.key -out

client.req

b. openssl x509 -req -in client.req -CA ca.cer -CAkey ca.key -

set_serial 101 -extfile "D:\Program Files (x86)\Apache Software

Foundation\Apache2.2\conf\openssl.cnf" -extensions client -days

3650 -outform PEM -out client.crt

c. openssl pkcs12 -export -inkey client.key -in client.crt -out client.pfx

4. Copy client.pfx and save it your desktop.

d. Update httpd.conf file located at <drive>:\Program Files (x86)\Apache Software

Foundation\Apache2.2\bin

i. Uncomment the following lines:

1. LoadModule ssl_module modules/mod_ssl.so

2. LoadModule cache_module modules/mod_cache.so

3. LoadModule deflate_module modules/mod_deflate.so

4. LoadModule disk_cache_module modules/mod_disk_cache.so

5. LoadModule headers_module modules/mod_headers.so

6. LoadModule mem_cache_module modules/mod_mem_cache.so

7. LoadModule proxy_module modules/mod_proxy.so

8. LoadModule proxy_ajp_module modules/mod_proxy_ajp.so

9. LoadModule proxy_balancer_module modules/mod_proxy_balancer.so

10. LoadModule proxy_connect_module modules/mod_proxy_connect.so

11. LoadModule proxy_ftp_module modules/mod_proxy_ftp.so

12. LoadModule proxy_http_module modules/mod_proxy_http.so

13. LoadModule proxy_scgi_module modules/mod_proxy_scgi.so

14. LoadModule rewrite_module modules/mod_rewrite.so

15. LoadModule vhost_alias_module modules/mod_vhost_alias.so

16. Include conf/extra/httpd-default.conf

17. Include conf/extra/httpd-ssl.conf



© 2013 SAP AG 10

ii. Change the following line:

1. Listen 80 to Listen 443

iii. Refer to the link for the file httpd.doc. Save the file as httpd.conf. You can then

compare it.

e. Update httpd-ssl.conf file located at <drive>:\Program Files (x86)\Apache Software

Foundation\Apache2.2\bin

i. Change the line from shmcb:D:/Program Files (x86)/Apache Software

Foundation/Apache2.2/logs/ssl_scache(512000) to

shmcb:D:/PROGRA\~2/Apache Software

Foundation/Apache2.2/logs/ssl_scache(512000)

ii. Change the line from Listen 80 to Listen <ip address>:443

iii. At line 28 add “SSLRandomSeed connect builtin”

iv. Comment all the lines from <VirtualHost _default_:443> till end of the file

v. Refer to the link for the file httpd-ssl.doc. Save the file as httpd-ssl.conf. You can

then compare it.

Configurations on SharePoint on Premise Server 15

1. Install Duet server bits.

2. Create new web app and site collection.

3. Add end users to the web app.

4. Exchange and import certificates between SAP NetWeaver Gateway and SharePoint on Premise

Server and vice versa.

5. Try to import a BDC model and delete it afterwards.

6. Do Alternate Access Mapping in Central Administration:

Navigate Central Administration -> System Settings -> Farm Management -> Configure Alternate

Access Mappings

7. Also update user profile service in Central Administration i.e Map external id

a. Navigate to Central Administration -> Application Management -> Manage Service

Applications -> User Profile Service Application -> Manage User Profiles

b. Open the SharePoint PowerShell and execute the below commands. You can add the users

and update external id. Kindly change the URL and users in it.

$site = Get-SPSite https://<Reverse Proxy System URL>

$context = Get-SPServiceContext -Site $site

$profSubtypeManager =

[Microsoft.Office.Server.UserProfiles.ProfileSubtypeManager]::Get($context)

$defaultProfileSubtypeName=[Microsoft.Office.Server.UserProfiles.ProfileSubtypeM

anager]::GetDefaultProfileName([Microsoft.Office.Server.UserProfiles.ProfileType]::

User)

http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/c0b52871-1a41-3010-37b9-9fc015ee68af

http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/c0b52871-1a41-3010-37b9-9fc015ee68af



© 2013 SAP AG 11

$profSubtype =

$profSubtypeManager.GetProfileSubtype($defaultProfileSubtypeName)

$upn = $profSubtype.Properties | where { $_.Name -eq "SPS-UserPrincipalName" }

$upn.IsUserEditable = $true

$upn.Commit()

$upm=New-Object -type Microsoft.Office.Server.UserProfiles.UserProfileManager -

argumentlist $context

$userprofile = $upm.CreateUserProfile("<domain>\<user>")

$upnValue = "<SPO tenant user>@<SPO tenant domain name>"

$userprofile["SPS-UserPrincipalName"].Value = $upnValue

$userprofile.commit()

8. Copy the below code onto notepad and save as abc.ps1.

//This is a code

[CmdletBinding()]

Param (

[Parameter(Mandatory = $true)]

[ValidateNotNullOrEmpty()]

[String] $TenantUrl

)

Write-Host "Retrieving the realm..."

try

{

$req=[System.Net.Webrequest]::create("$TenantUrl/_vti_bin/client.svc")

$req.Headers.Add("Authorization","Bearer")

$req.Accept="*"

$res=$req.GetResponse()

Write-Host "Error occurred while retrieving the realm."

}

catch [System.Net.WebException]

{

try

{

$headers=$_.Exception.Response.Headers

$auth=$headers["WWW-Authenticate"]

$splits=$auth.Split('"')

$realm=$splits[1]

Write-Host Realm is $realm

}

catch

{


}

}

catch

{




© 2013 SAP AG 12

}

9. Get the Realm ID by running the above power shell script. Pass the parameter SharePoint Online

tenant URL

10. For Authentication from SharePoint online -> SharePoint OnPremise execute the below commands

(SharePoint Powershell). Change the URL and Realm ID

$site = Get-SPSite https://<Reverse Proxy system name>

$context = Get-SPServiceContext -Site $site

Set-SPAuthenticationRealm -ServiceContext $context –Realm <update Realm ID from step

9>

New-SPTrustedSecurityTokenIssuer -Name "ACS_new" -MetadataEndPoint

https://accounts-int-sn1-004.accesscontrol.aadint.windows-int.net/metadata/json/1 -

IsTrustBroker:$true

Configurations on SAP NetWeaver Gateway System

1. Make sure SPO tenant link is accessible via Gateway box

2. Add certificates CA + spo.cer in SSL Standard Client (anonymous) node

3. Do user mapping for tenant users with SAP user

4. Do user mapping for Rolesync i.e. from section 7.g section CN=00000003-0000-0ff1-ce00-

000000000000@<Realmid>

5. Create an RFC to SPO box and also maintain Proxy info @ Gateway box

6. User Mapping needs to be done at Gateway box for SPO users.

7. Do the following configurations:

a. Go to T-Code SIMGH -> Duet Enterprise Implementation Guide

b. Configuration -> Specify Sharepoint Installations

c. Configuration -> Configure OAuth Credentials for Sharepoint Installation

Configurations in Microsoft SharePoint Online DMZ Zone

1. Create Secret key and share with SAP admin

2. Created secure store entry for reverse proxy‟s client authentication

3. Create connection settings for appropriate service url

4. Import model from manage connections page

5. Add Permissions

6. Creating trust on SharePoint tenant for workflow

Create Secret Key and share with SAP admin

1. Click duet enterprise in the left pane

2. Click Manage Security.

3. Click Create Active Secret.



© 2013 SAP AG 13

a. Copy Identifier (App ID) and Secret key. Share this with SAP Administrator.

4. Click the box at permissions Enable SAP to connect to SharePoint.

5. In the Duet Service Account field enter a user.

Create secure store entry for reverse proxy‟s client authentication

1. On Tenant admin page go to the secure store settings page.

2. Create a secure store target app, fill usual values and change so that the fields we have used are:

Certificate and Certificate Password (note: don‟t choose just Password). Make tenant admin the

admin of this target app and add all Duet users (which can be „All Users‟). Check the image below



© 2013 SAP AG 14

3. Set certificate and the password for the secure store application created

Create connection settings for appropriate service url

In BCS page create connection setting by selecting “Manage connections to on-premises services” and fill following values:

Service address: The url for sap service

Title: this can be any name like Reporting, Workflow or whatever

Authentication: as below

Custom extension provider name: OBA.Server.Canary.ObaOdataServerExtensionProvider,

OBA.Server.SSOProvider, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c

Internet facing URL: Url of reverse proxy server

https://<Reverse_Proxy_System_IP/Alias_name>/_vti_bin/client.svc

Secure Store Target Application Id: The application which was created above



© 2013 SAP AG 15

Import model from manage connections page

On Tenant admin page Click Duet Enterprise -> Manage connections

Select the appropriate connection and connection settings and import the model

Add permission

1. On Tenant admin page Click BCS -> Manage BDC models and External Content Types

2. Click set Metadata store Permissions and add end users.

3. Open Tenant site page and Add end users to site



© 2013 SAP AG 16

Trusting SharePoint for Workflow

1. Open the URL = https://duetextranet01.spolabs.com/_layouts/15/appinv.aspx

2. In the APP ID field = dea1d015-969c-496d-90fd-7e0d133dfd87 and click lookup

3. In Apps permission Request XML =

<AppPrincipal>

<RemoteWebApplication ClientId="dea1d015-969c-496d-90fd-7e0d133dfd87"/>

</AppPrincipal>

<AppPermissionRequests AllowAppOnlyPolicy="true">

<AppPermissionRequest Right="FullControl" Scope="http://sharepoint/content/sitecollection"/>

</AppPermissionRequests>

4. Click create

5. In the next screen click trust it.

https://duetextranet01.spolabs.com/_layouts/15/appinv.aspx

http://sharepoint/content/sitecollection



© 2013 SAP AG 17

Related Content

How to Install and Configure Duet Enterprise 2.0

http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/902d536e-1b21-3010-0b83-c12b6008e87c



© 2013 SAP AG 18

Copyright

© Copyright 2013 SAP AG. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.

Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.

Microsoft, Windows, Excel, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation.

IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x, System z, System z10, System z9, z10, z9, iSeries, pSeries, xSeries, zSeries, eServer, z/VM, z/OS, i5/OS, S/390, OS/390, OS/400, AS/400, S/390 Parallel Enterprise Server, PowerVM, Power Architecture, POWER6+, POWER6, POWER5+, POWER5, POWER, OpenPower, PowerPC, BatchPipes, BladeCenter, System Storage, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, Parallel Sysplex, MVS/ESA, AIX, Intelligent Miner, WebSphere, Netfinity, Tivoli and Informix are trademarks or registered trademarks of IBM Corporation.

Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems Incorporated in the United States and/or other countries.

Oracle is a registered trademark of Oracle Corporation.

UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.

Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc.

HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C®, World Wide Web Consortium, Massachusetts Institute of Technology.

Java is a registered trademark of Oracle Corporation.

JavaScript is a registered trademark of Oracle Corporation, used under license for technology invented and implemented by Netscape.

SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP Business ByDesign, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries.

Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects S.A. in the United States and in other countries. Business Objects is an SAP company.

All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary.

These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

how to configure sharepoint online

Documents