In this session we will go through new and extended functions in the User Profile area. We will cover the planning and implementation from the organizational to the technical perspective, not only in theory but also in the live demo. Aleksandar Drašković

1. IDENTITY MANAGEMENT IN
SHAREPOINT 2013
ALEKSANDAR DRAŠKOVIĆ, MCM SHAREPOINT 2010
SHAREPOINT AND PROJECT CONFERENCE ADRIATICS 2013
ZAGREB, NOVEMBER 27-28 2013

2. sponsors

3. Aleksandar Drašković
Solution Architect
•
•
•
•
Microsoft Certified Master for SharePoint 2010
Over 6 years in SharePoint business
Over 15 years in the Enterprise IT
Expertise in various other products and technologies
•
•
•
•
Active Directory
Exchange
TMG / UAG
Etc.

4. Agenda
•
•
•
•
Identity Management
User Profile Service
User Profile Synchronization
Approach for a successful implementation

5. IDENTITY MANAGEMENT

6. Identity management
• Handling with user profiles is not only configuring SharePoint
• Work with and talk to the administrators of the identity
management system
• Most time identity management is not really a technical
challenge, it often is more a political one
• Improper handling might break the social networking
functionality in the SharePoint environment

7. Data quality
Who is the owner of the data?
Can we get the necessary data?
Is the data up to date?

8. Connect to the data
• Are the IDM systems accessible?
• How can we connect to the IDM system?
• Do we have to connect to any other external system?
• Are we able to write back information to the IDM system?

9. USER PROFILE SERVICE

10. User Profile Service in SharePoint 2013
Important for all social features
Workflow Manager 1.0 (SharePoint 2013 Workflows)
Translation Service Application
Work Management Service
Needs an associated Managed Metadata Service
Application

11. Databases
• Profile Database
• User profile data, activities, audiences
• Social Database
• Social stuff, e.g. ratings, tags and comments
• Sync Database

12. Create a User Profile Service Application
• Think about how to handle the site names for the My Content
sites of the users
• Create the MySite host and check the Managed Path for the
MyContent sites
• Do not use more than one User Profile Service Application in
your farm
• As best practice approach use PowerShell scripting to create
the User Profile Service Application, but be aware of the
database schema

13. Active Directory import
One-way
No write-back to the
Active Directory
No BCS connections
for synchronization
Very fast
Active Directory to SharePoint
It ist just an import
Only connections to Active
Directory
Due to the direct connection to
Active Directory

14. User Profile Synchronization
•
•
•
•
•
Set "Replicating Directory Changes" permission
Configure synchronization settings
Configure synchronization connection(s)
Start a synchronization
Configure incremental synchronization

15. APPROACH FOR THE SUCCESSFULL
IMPLEMENTATION

16. Start of the implementation process
Sit down and THINK!
Think about the source
system and source
information
Think about how the data
should be represented in
SharePoint
Think about writing
data back
Think about operating
the profile
synchronization

17. Configure and start UPA
Prerequisites
PowerShell
Separate
Test
Have the Managed Metadata
ServiceApplication up and
running
Use a PowerShell script to
configure and start the user profile
service application
Separate adding and starting user
profile service application from
configuring and starting
sychronization
T this step before the
est
synchronization is configured and
started

18. Set permissions
Replicating Directory
Changes
Local Adminstrator
Set the "Replicating Directory
Changes" permission for the sync
account in the domain
Make the farm account local
administrator on the machine,
where the synchronization should
be started
Write back
Reboot
Set the "Create Child Objects"
and "WriteAll Properties"
permission for the sync account,
when write back is necessary
Reboot the machine that was
choosen as the sync host, so that
the new permissions become
active

19. Domain permissions
Replicating Directory Windows 2003
Changes
domain controller
NetBIOS domain
name not FQDN
Need to export to
Active Directory
Must be set in the domain, no
matter which Windows version
the domain controller is using
Grant Replicating Directory
Changes permission to the
synchronization account to the
cn=configuration container
Grant the synchronization account
the Create Child Objects and the
WriteAll Properties permissions
on the organization unit you are
synchronizing
Add synchronization account to
the Pre-Windows-2000
CompatibleAccess group

20. Optional:
NetBIOSDomainNamesEnabled
• Necessary, when the NetBIOS name of the domain is not equal
to the full qualified domain name
Example:
full qualified domain name: corporation.int
NetBIOS domain name: CORP

21. Configure and start UPS
Powershell
Use farm account
Run as Administrator Be patient
Use a PowerShell script to
configure and start the user profile
synchronization service
Log in as the farm account, before
you try to start the synchronization
Run the SharePoint
Management Shell as
Administrator
Even under normal
circumstances this operation
might take some time

22. Profile properties and timer job
• Configure any additional profile properties you need
• Configure export of profile properties if necessary (remember
the "Create Child Objects" permission)
• Use Central Administration to configure synchronization
connection, not the PowerShell cmdlets
• Configure all necessary connections

23. Profile properties and timer job (contd.)
• From Central Administration run a full synchronization
• Set the interval in which the incremental sync should run
• Denote the farm account from the local admin role on the sync
host

24. ADDITIONAL TIPS

25. Best practices
•
•
•
•
•
Clean up your directory service
Specify the domain controller to synchronize with
Make friends with the directory service administrator
Restart the sync service after installing updates
Check timer job settings

26. Troubleshooting
• Check permissions
• Most problems when deploying user profile synchronization are caused by wrong
permission settings
• Event Log
• The Windows Event Log might contain additional information about what is going
wrong
• ULS Log
• Use the ULS logs (in conjunction with an ULS Viewer) to find proper error
messages
• MIISClient
• Use C:Program FilesMicrosoft Office Servers15.0Synchronization
ServiceUIShellmiisclient.exe on the synchronization host to see FIM messages.

27. A couple of things you should you never do...
• Use the Farm Configuration Wizard to configure and start the
user profile service application in STAGE and PROD
environments
• Start or stop the FIM services manually
• Do any changes to the FIM services using the services applet
• Use the MIISClient to do any changes
• Use farm account as a synchronization account

28. Summary
• Identity Management
• Is the starting point for the implementation of the User Profile
Synchronization.
• User Profile Service Application
• Depends on the Managed Metadata Service Application and is necessary
lot of services and functionalities in SharePoint 2013
• User Profile Synchronization
• All in all a straight forward process, but depends on the correct
permission settings and the account you are using to activate
synchronization.
• Best practices

29. questions?
WWW.ADRIT.DE/BLOG
@ADRASKOVIC

30. thank you.
SHAREPOINT AND PROJECT CONFERENCE ADRIATICS 2013
ZAGREB, NOVEMBER 27-28 2013