Microsoft SharePoint Portal Server 2001 Resource Kit

On This Page

	Deployment Tasks
	Proxy Settings on the Server
	DNS Entry Creation
	Web Site Creation
	Web Discussions
	Security Settings
	Proxy Server Settings
	Extranet Testing from the Intranet
	Extranet Testing from the Internet
	E-Mail Notifications
	Secure Sockets Layer
	Internal FQDN Mapping
	Settings for Crawling Web Sites on the Internet
	Settings for Crawling Another SharePoint Portal Server Site on the Internet
	Troubleshooting
	Extranet Features
	Summary

This chapter provides the procedures for deploying Microsoft^® SharePoint™ Portal Server 2001 across an extranet. This chapter defines an extranet as intranet resources that are accessible from the Internet, usually through a firewall. These procedures apply to a SharePoint Portal Server computer with one network interface card (NIC). The extranet deployment is not supported for dual-homed servers.

This chapter also defines the key terms used to describe deploying SharePoint Portal Server in an extranet environment, the various ways to access a workspace on your SharePoint Portal Server computer, and the tasks necessary to deploy SharePoint Portal Server in an extranet environment.

Deployment Tasks

The chapter organizes this procedure into multiple sections according to the tasks in the following list. Optional tasks are labeled as such.

In addition to the tasks specified previously, the following sections are provided:

Understanding Key Terms

This chapter uses following terms:

Internal and external FQDNs must be unique, as described here:

Accessing SharePoint Portal Server

The following table shows different ways to access a workspace on your SharePoint Portal Server computer. Examples use a workspace name of Marketing.

Workspace Access Points 

Top of page

Proxy Settings on the Server

The dashboard site uses a special server-side object called ServerXMLHTTP to make Hypertext Transfer Protocol (HTTP) requests. These requests are necessary to return the correct page to the client. The ServerXMLHTTP object has its own proxy settings. If the dashboard site is behind a proxy server, you must configure the ServerXMLHTTP object with the proxy server name to access data that is located beyond the intranet. The proxy settings are important when the dashboard site must access resources on a different server, such as when you use the Content management page to import new Web Parts.

Note For more information about changing proxy settings on the server, see Chapter 11, "Installing SharePoint Portal Server."

Specifying the Bypass List

When you configure the proxy settings on your server, you can specify a bypass list. This section reviews the most common options that you can choose. If the virtual directory for the workspace has NTLM enabled, you must set the proxy server and bypass list. The ServerXMLHTTP object attempts NTLM authentication against the virtual directory for the workspace.

You can separate multiple bypass addresses with a semicolon. A bypass address is an address for which you do not want to use the specified proxy server.

If You Are Using a Proxy Server

If you are using a proxy server, run:

proxycfg –d –p proxy_name:port_number "root_domain_name;<local>" 

In the preceding line, root_domain_name is the bypass address. Root_domain_name is the FQDN of the base root domain in which the computer is a member, with a wildcard exception prefixed to the root_domain_name. The bypass address is in the form *domain, such as *adventure-works.com. Include the brackets <> around local when you type the command.

Example. If your proxy server name is Proxy1, the port number is 80, and you want to bypass the proxy server for the SharePoint Portal Server computer in the domain adventure-works.com, type proxycfg –d –p Proxy1:80 "*adventure-works.com;<local>"

If You Are Not Using a Proxy Server

If are not using a proxy server in your environment, you must specify a fake proxy server to force SharePoint Portal Server to use integrated Windows 2000 authentication. Integrated Windows 2000 authentication is most commonly used in an intranet environment. If you do not specify a fake proxy server, network components on your SharePoint Portal Server computer default to Basic authentication. As a result, SharePoint Portal Server does not work correctly. To configure a fake proxy server, you must configure both the dashboard site and Microsoft Internet Explorer.

Note If you are using Basic or Anonymous authentication methods, you do not need to specify the proxy settings.

To configure the proxy settings on your SharePoint Portal Server computer, run:

proxycfg -d -p fake_proxy_name:80 "*;<local>" 

Example. If you do not have a proxy, specify any non-existent proxy and bypass for all addresses by using the wildcard (*). To do so, type:

proxycfg –d –p FakeProxy1234:80 "*;<local>" 

Testing has indicated that this option works for most customers and that the preceding syntax should be used first, if you are not using a proxy. However, further options are provided later in this section.

To configure the proxy settings for Internet Explorer:

"*root_domain_name" or "internal_FQDN" 

*adventure-works.com 

AdvWks.corp.adventure-works.com 

Note You must configure the proxy settings for Internet Explorer on all client computers that access the server by using an FQDN (not the computer name) and integrated Windows 2000 authentication. You can configure all your client computers to use these proxy settings by using the Internet Explorer Administration Kit. If you do not configure each client computer, each user will be prompted for authentication for each session.

If you are not using a proxy server, and if the configuration specified earlier does not work for you, you can run one of the following configurations as an option:

proxycfg –d –p fake_proxy_name:80 "<local>" 

proxycfg –d –p fake_proxy_name:80 "*microsoft.com;<local>" 

proxycfg –d –p fake_proxy_name:80 "*;<local>" 

proxycfg –d 

Caution Running a computer directly on the extranet with no proxy server has inherent security vulnerabilities, and is therefore not recommended. However, using Basic authentication with SSL enabled on the new Web site in IIS is the most secure SharePoint Portal Server configuration available when the computer runs directly on the extranet.

Configuring the Proxy Settings on the Server

During the SharePoint Portal Server installation, the setup process automatically configures the proxy settings for ServerXMLHTTP by using the proxy settings specified for the server. If you need to change these proxy settings at some time after installation, or if you want to use SharePoint Portal Server across the extranet without a proxy server, use the following procedure.

To configure the proxy settings:

D:\Program Files\SharePoint Portal Server\Bin. 

Important SharePoint Portal Server does not support direct Internet connectivity out of the box. By default, SharePoint Portal Server is initially configured for use with a proxy server.

Top of page

DNS Entry Creation

You must create a DNS entry for the external server name. The procedure for this varies, depending on the DNS server software. If DNS is running on a computer running Windows 2000 Server, use the following procedure. For more information about DNS, see Appendix B, "For More Information."

Before performing the following procedure, you must have a static external IP address that you can assign to your SharePoint Portal Server computer. This is not the same IP address as the static internal IP address for the server. You receive a range of static external IP addresses when you first establish Internet access through Network Solutions or through another company authorized by the Internet Corporation for Assigned Names and Numbers (ICANN).

The external static IP address is used when you map the external static IP address to the internal static IP address on the proxy server to create a "server publish." For more information, see the "Proxy Server Settings" section later in this chapter.

Note You should not need to create a DNS entry if the SharePoint Portal Server computer is on the Internet with no proxy server. If the server is directly on the Internet, the domain controller should already have an entry for the NetBIOS name. In this case, the NetBIOS name is also the external (host) name.

To create a DNS entry on a Windows 2000 server:

Top of page

Web Site Creation

You must create a new Web site for each authentication model that you want to use. For example, if you want to have both Anonymous access and Basic authentication, you must create two Web sites. On one Web site, you specify Anonymous access, and on the other site, you specify Basic authentication.

Note You should not modify settings on the Default Web Site. Specifically, SharePoint Portal Server requires the Default Web Site to use port 80 as the TCP port. Do not change the port to an alternative HTTP port (such as 8000 or 8080) after installation. Ensure that you specify port 80 and that it remains the primary port for the server.

To create a new Web site:

D:\Progra~1\ShareP~1\Bin\msdmisap.dll 

Top of page

Web Discussions

To use Web discussions on your SharePoint Portal Server computer from the extranet, you must modify the registry.

You can use Web discussions to discuss a document with other users. Web discussions allow users to add remarks about a document without modifying the document. Discussions are threaded, which means that replies to a discussion remark appear directly underneath the original remark. In addition, multiple discussions about the same document can occur simultaneously. SharePoint Portal Server consolidates comments in a single location, allowing you to review them easily. For detailed information about using Web Discussions with SharePoint Portal Server, see Chapter 10, "Planning for Web Discussions."

To enable discussions on the new Web site:

Top of page

Security Settings

By default, SharePoint Portal Server uses NTLM authentication (on the Default Web Site in IIS). To use SharePoint Portal Server on the extranet, you must modify the security settings on the new Web site to Basic authentication or Anonymous access.

Caution Do not specify both Basic authentication and Anonymous access on the same Web site. If you want Basic authentication and Anonymous access, create two Web sites.

If you want to use Basic authentication and Anonymous access, configure the security settings as follows:

SharePoint Portal Server does not support both NTLM and Anonymous authentication on the same Web site. If you modify the security setting to Anonymous access, users cannot create subscriptions from the dashboard site.

Caution Do not run the Windows 2000 Internet Server Security Tool after installing SharePoint Portal Server. Running this tool may disable the dashboard site.

To modify the security settings on the new Web site:

If you use Anonymous access, you must also assign the Internet Guest Access account to the reader role on each workspace for which you want Anonymous access. If you are configuring Basic authentication only, you do not need to assign the Internet Guest Access account to the reader role.

To assign the Internet Guest Access account to the reader role:

If you close the Properties page, open it, and then click the Security tab, SharePoint Portal Server lists the account you just entered as Internet Guest Account.

Important SharePoint Portal Server licensing requires that all devices accessing the server have a valid license. Nothing in this chapter waives or modifies any rights or requirements under the end user license agreement or other applicable license agreement for SharePoint Portal Server.

Top of page

Proxy Server Settings

If you want to use SharePoint Portal Server across the extranet and you have a proxy server, you must:

If you are not using ISA Server, you must configure your proxy server as follows:

Before performing the following procedures, you must know the static external IP address that is assigned to your SharePoint Portal Server computer. This is not the same IP address as the static internal IP address for the server. You must also have a subnet mask. You receive a range of static external IP addresses and a subnet mask when you first establish Internet access through Network Solutions or through another company authorized by the ICANN.

The following procedures apply if you are using ISA Server as your proxy server. Note that the following steps assume that you have already enabled the firewall and reverse proxy for ISA Server. Additionally, your ISA Server must allow internal users to access the Internet by using the proxy server without authentication. If you have a proxy server that requires a server to provide authentication to access the Internet from your intranet, you cannot download a Web part from the Internet. This is because the ServerXMLHTTP object cannot access the Internet if authentication is required.

To ensure that the external static IP address of your server is added to the proxy server:

You have now successfully added the external static IP address of your server to the proxy server.

To map an external IP address to an internal IP address:

If the mapping has not taken effect within 30 minutes after this procedure, restart the proxy server.

Top of page

Extranet Testing from the Intranet

Use this procedure to confirm that you have set up your server correctly to access it from the extranet.

Important Perform the following procedure from the server.

To test the extranet from your intranet:

If you can access the server, you have specified the external FQDN correctly. If you cannot access the server, ensure that the Web site started.

To ensure that the Web site started:

If you still cannot access the server, see the section "Troubleshooting" later in this chapter. After you successfully access the extranet from your intranet, you should test access from the Internet.

Top of page

Extranet Testing from the Internet

Use this procedure to confirm that you have set up your server correctly to access it from the Internet.

Important Perform the following procedures from a computer that is not connected to your corporate LAN or WAN, either directly or by dialing in to the network.

To test the extranet from the Internet:

If you cannot access the dashboard site, see the section "Troubleshooting" later in this chapter.

Top of page

E-Mail Notifications

SharePoint Portal Server sends e-mail notifications for document approval requests and subscription notifications. The URLs in the notification mails can use the NetBIOS name, the internal FQDN, or the external FQDN of the server. If you are using FQDN without WINS, SharePoint Portal Server cannot automatically choose which form of the server name is appropriate for a particular e-mail recipient.

For example, assume you are in one domain and you approve a document by accessing the document through the NetBIOS name. The next person to receive the approval e-mail is in another domain (either a parent domain or another domain entirely). The link this person receives in the approval e-mail contains the NetBIOS name for the link (href). Because the recipient is in another domain, the name used in the link does not resolve and the recipient cannot access the document by clicking the link.

SharePoint Portal Server allows administrators to control the form of the name by adding a property to the folder that contains all the workspaces on the server. You can edit this property by using Web Storage System Explorer in the Web Storage System Software Development Kit (SDK). For more information about the Web Storage System SDK, see Appendix B, "For More Information." The administrator can specify that the URL use the internal FQDN or the external FQDN.

To specify the URL of the server name:

Top of page

Secure Sockets Layer

If you want to secure your transmissions over the extranet, you must enable SSL. After enabling SSL, you must access the workspace by using https://external_server_name.external_domain_name/workspace_name. 

You should ensure that http:// is working properly before enabling SSL.

Enabling SSL requires several steps:

The following procedures provide the steps for completing this process.

To request a new certificate:

You have now completed the certificate request process. Submit the text file that you generated to your SSL vendor.

After you receive the certificate file from your vendor, you must install the certificate.

To install the certificate that you receive from your vendor:

To assign a certificate to the Default Web Site:

This step enables you to remove port 443 from Multiple SSL identities for this Web Site in a later step. If you do not remove port 443, SharePoint Portal Server may experience unexpected behaviors because the Default Web Site and any new Web sites you create are trying to use port 443.

To specify the secure bindings value to include the host header for the new Web site:

If you do not remove port 443 from Default Web Site, SharePoint Portal Server may experience unexpected behaviors because the Default Web Site and any new Web sites you create are trying to use port 443.

To remove port 443 from Multiple SSL identities for this Web Site on the Default Web Site:

To require SSL:

You must choose to require SSL before you can access SharePoint Portal Server by using https://.

You should now test access to the extranet from your intranet by using https:// instead of http://.

Top of page

Internal FQDN Mapping

If you want to use SharePoint Portal Server on your intranet with an internal FQDN, you must map the internal FQDN of the server to an IP address. If you do not want to enable internal FQDN support, you can skip this section.

To map the SharePoint Portal Server computer name to an IP address:

If your network does not natively support FQDN, you are running WINS, or users experience errors navigating to the dashboard site by using FQDN, each user and the server administrator must perform an additional step.

Each user and the server administrator can configure the proxy server settings by using the following procedure. This procedure applies when your browser is Internet Explorer 5. To do this on other browsers, consult the browser documentation.

To configure Internet Explorer 5 to bypass the proxy server for local addresses:

Top of page

Settings for Crawling Web Sites on the Internet

If you want SharePoint Portal Server to crawl Web sites on the Internet, it is recommended that you modify the time-out settings both for connecting to a Web site or server and for waiting for request acknowledgment. Specify 60 seconds for the wait time for connecting to a Web site or server, and specify 30 seconds for the wait time for request acknowledgment from a Web site or server. You can modify these settings from SharePoint Portal Server Administration.

If you have a proxy server that requires authentication to access the Internet from your intranet, SharePoint Portal Server cannot crawl sites on the Internet.

To modify the time-out settings:

Depending on the connection speed and other factors, such as Internet loss, Internet latency, and Internet jitter, you may need to increase the previous settings.

Top of page

Settings for Crawling Another SharePoint Portal Server Site on the Internet

There may be instances when you want to expose your server, by using HTTP, to the Internet to allow other sites to crawl your server. The instructions in this section enable a SharePoint Portal Server computer with access to the Internet to crawl another SharePoint Portal Server computer across the Internet. Currently, SharePoint Portal Server only supports HTTP crawling. HTTPS crawling is not supported.

SharePoint Portal Server cannot use the default content access account to access another SharePoint Portal Server over the Internet. You can only specify an NTLM trusted domain account as the default content access account, and you cannot use NTLM for Internet crawls. You must specify an access account for the site path to the SharePoint Portal Server you want to crawl.

Important If the workspace you want to crawl has enabled Anonymous access (the Internet Guest Account is assigned to the reader role on the workspace), you do not need to use Basic authentication and do not need to perform the following procedure. You need only create a content source to the workspace on the other server. For information about assigning the Internet Guest Account to the reader role on a workspace, see the section, "Security Settings" earlier in this chapter.

To configure the server to crawl another SharePoint Portal Server computer across the Internet:

After completing the preceding steps, create a content source to the workspace on the SharePoint Portal Server computer that you want to crawl.

Top of page

Troubleshooting

This section describes specific error messages or issues you may encounter when deploying SharePoint Portal Server across an extranet. It also provides suggestions for how to address each issue.

Features Do Not Function

For a table showing features of SharePoint Portal Server that are available when you deploy the server across an extranet, see the section "Extranet Features" earlier in this chapter.

Server Access Denied

If you cannot access the server, ensure that you have specified security on the new Web site. Until you specify either Anonymous access or Basic authentication, you cannot access the server from the extranet.

Error 401

If you have specified Anonymous access on the new Web site, you may receive error 401 (Unauthorized) when attempting to access the dashboard site. If this happens, ensure that the Internet Guest Access account is a reader on the hidden Portal folder in the workspace. For the procedure to add the Internet Guest Account as a reader on the workspace, see the section "Security Settings" earlier in this chapter.

Note If the Portal folder in the workspace does not inherit the security settings of the parent folder, you must add the Internet Guess Access account as a reader on the Portal folder.

Error 424

If you receive error 424 when attempting to access the dashboard site, try the following:

You may receive error 424 when trying to navigate to the dashboard site by using HTTPS, but you might not receive the error when using HTTP. In this case, on the new Web site, ensure that you specify IIS Application Protection as low for the virtual directory for the workspace.

To specify IIS Application Protection:

Error 500

If you receive error 500 (internal server error) on the dashboard site, ensure that you have not selected the Check that file exists check box when configuring the Public and YourWorkspace virtual directories on the new Web site. If the Check that file exists check box is selected, clear the check box, and then restart IIS Admin Service.

To restart the IIS Admin Service:

Error 503

If you attempt to access the dashboard site and you receive error 503 (Service Unavailable), the server is restarting and the services have not yet started. Wait several minutes and try accessing the dashboard site again.

Error 519

If you receive error 519 when attempting to discuss a document, ensure that you have enabled discussions on the new Web site. To use Web discussions on your SharePoint Portal Server computer from the extranet, you must modify the registry. For the procedure to modify the registry, see the section "Web Discussions" earlier in this chapter. For detailed information about using Web discussions with SharePoint Portal Server, see Chapter 10, "Planning Web Discussions."

Unable to Map Web Folder to Workspace

If you are unable to map a Web folder to the workspace, ensure that you have not selected the Check that file exists check box when configuring the Public and YourWorkspace virtual directories on the new Web site. If the Check that file exists check box is selected, clear the check box and restart IIS Admin Service.

To restart the IIS Admin Service:

Discussion Error

If you see a server execution or server unavailable error inside a discussion panel, ensure that the execute permissions are set to Scripts and Executables on the virtual directory for MSOffice on the new Web site.

To set permissions on the virtual directory:

Script Execution Error

If you receive a script execution error, the custom header name (MicrosoftTahoeServer) for the new Web site is either not specified or specified incorrectly. For information about specifying the custom header name, see the section "Web Site Creation" earlier in this chapter.

No Access Externally

If you cannot access the SharePoint Portal Server computer from the extranet, try the following:

If this test succeeds, the problem is possibly in the proxy server configuration for server publishing. For more information about server publishing, see the section "Proxy Server Settings" earlier in this chapter.

Host Not Found

If you receive error 11004 (host not found), ensure that your DNS server has an entry for the host you are trying to access.

If the entry exists, check the spelling of the URL that you are typing in the browser.

Page Cannot Be Displayed

If SSL is enabled and you receive this error, run adsutil.vbs. For more information, see the section "Secure Sockets Layer" earlier in this chapter.

Dashboard Site Settings Cannot Be Saved

If you cannot save settings on the dashboard site, you may not have write permissions on the workspace.

To specify write permissions:

Blank Page Displays

If a blank page displays when attempting to access the dashboard site from the extranet:

Crawling a Web Site Fails

If you cannot crawl a Web site on the Internet, you may need to reconfigure the time-out settings or the proxy settings. For more information, see the sections, "Settings for Crawling Web Sites on the Internet" and "Proxy Server Settings" earlier in this chapter.

Subscriptions Do Not Function Properly

You cannot subscribe to folders by using the collaboration toolbar from Microsoft Office or Internet Explorer in the extranet scenario. You must subscribe to the folder from the dashboard site.

Server URL in E-Mail Notifications Is Incorrect

You can modify the URL that SharePoint Portal Server uses in e-mail notifications by following the procedure shown in the section "E-mail Notifications" earlier in this chapter.

If SharePoint Portal Server does not display the modified URL as expected, ensure that you have:

Access Problems When Using HTTPS – Client Certificate Issues

If you have enabled SSL and are accessing the dashboard site of SharePoint Portal Server by using https://external_FQDN/workspace_name, you might experience sporadic functionality failure such as navigation failures or access violations. This indicates a possible problem with the security certificate—specifically, you may need to install the full certificate chain.

You may need to install the full certificate chain on the client computers if either of the following applies:

To confirm that the security certificate is the problem: