Agent for SharePoint Guide › Advanced Configuration Options › Enable SSL

Enable SSL

The procedure for enabling Secure Sockets Layer (SSL) communications on the CA SiteMinder® Agent for SharePoint has the following parts:

• Configuring SSL for the ClaimsWS
  • Protecting the ClaimsWS service with SSL
  • Configuring the mutual trust relationship between the ClaimsWS and the CA SiteMinder® claims provider.
  • Registering the Claim Search Service
• Configuring the CA SiteMinder® Agent for SharePoint (reverse proxy) server for SSL.

The following graphic describes these procedures:

Follow these steps:

1. Enable SSL for the ClaimsWS service with the following steps:
   1. Verify the prerequisites.
   2. Create the JCEKS key store and private key.
   3. Create a certificate signing request and submit it to a certificate authority.
   4. Generate the certificates by processing the request at the certificate authority.
   5. Download and import the certificate chain.
   6. Define the Key Store and the SSL ports.
   7. Generate an SSLConfig.properties file.
   8. Restart the CA SiteMinder® Agent for SharePoint.
   9. Add a trusted root authority to your SharePoint farm.
2. Configure the mutual trust relationship between the CA SiteMinder® claims provider and the ClaimsWS service with the following steps:
   1. Request a client authentication certificate.
   2. Generate the client authentication certificate.
   3. Verify your certificate approval and install the client authentication certificate.
   4. Add the certificate snap-ins.
   5. Export the client authentication certificate from the current user certificate store.
   6. Import the client authentication certificate into the local computer certificate store.
   7. Install the client certificate on your SharePoint servers.
   8. Grant application pool identities for sharepoint web applications permissions to the client certificate.
3. Register the Claims WS service with the following steps:
   1. Register the claims search service end point on all web front-end (WFE) servers.
   2. Install the client authentication certificate on your CA SiteMinder® Agent for SharePoint.
   3. Update the SSLConfig.properties file.
   4. Restart the CA SiteMinder® Agent for SharePoint.
4. Configure the CA SiteMinder® Agent for SharePoint server for SSL with the following steps:
   1. Modify the SSL configuration file for your CA SiteMinder® Agent for SharePoint.
   2. Generate a private unencrypted RSA server key for each virtual site.
   3. Generate and submit certificate signing requests.
   4. Download and install the certificates from your certificate authority.
   5. Accommodate your SSL sites by modifying the proxy rules.
   6. Enable SSL on your CA SiteMinder® Agent for SharePoint.
   7. Run the connection wizard.
   8. Create alternate access mappings for your port-based virtual sites.
   9. Modify your authentication scheme.
   10. Restart the CA SiteMinder® Agent for SharePoint.

Verify the Prerequisites

The first step in protecting the ClaimsWS service is verifying the prerequiites.

Verify the following prerequisites before protecting the Claims WS service with SSL:

• Farm administrator privileges and local administrator privileges for each SharePoint server in the farm.
• The java_home variable in your environment points to the proper JDK installation directory.
  For example, if you are using Java 1.6, your java_home variable must point to the installation directory for the Java 1.6 JDK.
• For UNIX/Linux operating environments, verify the following conditions:
  • The CA SiteMinder® Agent for SharePoint environment variables are exported to your environment. Run the following script:

    Agent-for-SharePoint_home\ca_sps_env.sh
    

Create the JCEKS Key Store and Private Key

The next step in protecting the ClaimsWS service is creating a JCEKS key store and private key.

The JCEKS key store is a repository for the certificates and their related private keys. The certificates that you create are stored in the JCEKS key store. Creating a key store also creates a server certificate. This process requires the following information:

• An alias (nickname) for the server certificate you are requesting.
• A password for the JCEKS key store.
• The fully qualified domain name of the server hosting your CA SiteMinder® Agent for SharePoint
• The name of your organizational unit (department or group)
• The name of your organization.
• The locality of your organization.
• The two-letter state and country codes for your organization.

Follow these steps:

1. Log in to the system hosting your CA SiteMinder® Agent for SharePoint.
2. Open a command-line window.
3. Navigate to the following directory:

   Agent_for_SharePoint_home\SSL\keys
   

   Agent-for-SharePoint_Home

   Indicates the directory where the CA SiteMinder® Agent for SharePoint is installed.

   Default: (Windows) [32-bit] C:\Program Files\CA\Agent-for-SharePoint

   Default: (Windows) [64-bit] C:\CA\Agent-for-SharePoint
   Default: (UNIX/Linux) /opt/CA/Agent-for-SharePoint

4. Run the following command:

   keytool -genkeypair -keyalg RSA -keystore .\ServerCert.jceks -alias Alias_Name -storetype JCEKS -storepass keystore_password
   

   The following table lists the prompts from the JCEKS keytool utility and sample responses:

The keytool utility displays a confirmation resembling the following example:

Is the following correct: cn=agentforsharepointserver.example.com,ou=support,o=example,l=Your City,st=YS,c=YC

1. Enter yes.

   The keystore and private key are created.

2. Leave the command-line window open, and continue with the next step of creating a certificate request.

Create a Certificate Signing Request and Submit It to a Certificate Authority

The next step in protecting the ClaimsWS service involves creating a certificate signing request for the server certificate in your JCEKS key store.

A signing request submits the certificate to a certificate authority. The certificate authority validates (signs) the certificate. Certificates that are signed third-party certificate authorities are considered more secure than self-signed certificates.

Self-singed certificates are acceptable for evaluation or testing environments.

To submit a certificate signing request, you need the following information:

• The alias of your server certificate for the CA SiteMinder® Agent for SharePoint.
• A file name for your certificate request (.csr file).
• The password for your JCEKS key store.

Follow these steps:

1. Create a certificate signing request with the following command:

   keytool -certreq -v -alias Alias_Name -sigalg MD5withRSA -file .\file_name_of_certificate_request.csr -keypass keystore_password -keystore ServerCert.jceks -storepass keystore_password -storetype JCEKS
   

   The keytool utility produces a certificate signing request similar to the following example:

   -----BEGIN NEW CERTIFICATE REQUEST-----
   MIIBrzCCARgCAQAwbzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1BMRMwEQYDVQQHEwpGcmFtaW5n
   aGFtMQswCQYDVQQKEwJDQTEPMA0GA1UECxMGU01URVNUMSAwHgYDVQQDExdzbXNwczIwMTAuc210
   ...
   ...
   ...
   dsrZKqtNaqym7DrkSql7LsUGcsACUp1K4PU6t3P16CKvagspJ18zwTqTRpkGtbu6emvEwpcQveuW
   k27YooCZ4XDzFxtpAnv9EIl7L4N4QHHxXCa8kIULOdGtJ4vD
   -----END NEW CERTIFICATE REQUEST-----
   

2. Copy the entire certificate signing request.
3. Close the command-line window.
4. Submit the certificate signing request to a certificate authority with the following steps:

   Note: This procedure demonstrates submitting a request to a Microsoft Active Directory Certificate Services certificate authority.

   1. Open your Web browser, and then navigate to the following URL:

      https://fully_qualilfied_domain_name_of_server_running_active_directory_certificate_services/certsrv
      

      Note: An example of such a URL is http://certificateauthority.example.com/certsrv.

   2. Click Request a certificate.
   3. Click the advanced certificate request link.
   4. Click the Create and submit a request to this CA.
   5. An Advanced Certificate Request form appears.
   6. Complete the form by doing the following tasks:
      • Submitting a request for a PKCS # 7 file.
      • Copying your certificate signing request into the field

      Note: Under the type of certificate needed drop-down list, verify that Client Authentication Certificate appears.

   7. Click Submit.

      A confirmation dialog appears.

   8. Click Yes.

      The request is submitted. Note your request ID for future reference.

Generate the Certificates by Processing the Request at the Certificate Authority

The next step in protecting the ClaimsWS service is having a certificate authority process your request.

After the certificate authority receives your certificate signing request, they will process the request and will return the signed certificate.

Some organizations use third-party certificate authorities to sign their certificate requests. Other organizations could possibly have an internal group that operates a certificate authority.

The following procedure demonstrates the process for approving a certificate with Microsoft Active Directory Certificate services:

Certificate administrators approve or reject certificate requests. Certificate administrator privileges are separate from the Administrator privileges in the Windows operating environment. Not all users who have accounts on the computer hosting Active Directory Certificate services have sufficient privileges to approve or reject certificates.

Use this procedure if you have certificate administrator privileges. Otherwise, ask the certificate administrator in your organization to issue the certificate for you.

Follow these steps:

1. Log in to the web server hosting the Active Directory Certificate services using an account with Certificate administrator privileges.
2. Click Start, Administrative Tools, Certification Authority.

   The certsrv snap-in appears.

3. Click the name of the certification authority, and then click the pending request folder.

   A list of pending certificate requests appears.

4. Right-click the request ID associated with the request for the client certificate.
5. From the context menu, select All Tasks, Issue.

   The certificate is issued. Continue with the next step of downloading and importing the certificate.

Download and Import the Certificate Chain

The next step in protecting the ClaimsWS service is downloading and importing the certificate chain.

After your certificate has been signed, download and install the following items to the server hosting your CA SiteMinder® Agent for SharePoint:

• The signed certificate.
• The certificate chain (any additional certificate-authority certificates that your certificate-authority issued).

The certificate chain validates your certificate to the web browsers of your users.

This process requires the following information:

• The alias (nickname) of the server certificate you are requesting.
• The password for the JCEKS key store.

Follow these steps:

1. Log in to the server hosting your CA SiteMinder® Agent for SharePoint.
2. Download the following files with the same Web browser from which sent the certificate signing request:
   • certnew.cer (your signed certificate)
   • certnew.p7b (the certificate chain)
3. Move the files that you downloaded in Step 2 to the following directory:

   Agent_for_SharePoint_home/SSL/keys
   

4. Import the certificate chain into the keystore with the following command;

   keytool -importcert -v -noprompt -alias Alias_Name -file .\certnew.p7b -keypass keystore_password -keystore ServerCert.jceks -storepass keystore_password -storetype JCEKS
   

5. Continue with the next step of defining the claims store and the SSL ports.

Define the KeyStore and the SSL Ports

The next step in protecting the ClaimsWS service is defining the key store and SSL ports.

After downloading and importing the certificate chain to the server hosing the CA SiteMinder® Agent for SharePoint, add the following settings:

• The local SSL port number (defined when you ran the SharePoint Connection wizard).
• The path to the key store on the server that is hosting the CA SiteMinder® Agent for SharePoint.

These settings are defined in the server.conf file.

Follow these steps:

1. Open the following file with a text editor:

   Agent_for_SharePoint_home\proxy-engine\conf\server.conf
   

   Locate the following section of the file:

   <localapp>
   

2. In the <localapp> section, locate the following line:

   #local.https.port=port_number
   

3. Remove the # from the beginning of the previous line.
4. Verify that the port number following the equal sign matches what you entered for the Claims WS service SSL port in the SharePoint connection wizard. If you defined port number 2525 for your connection, the edited line would match the following example:

   local.https.port=2525
   

5. Locate the following line:

   #local.https.keyStoreFileName="tomcat.keystore"
   

6. Remove the # from the beginning of the previous line.
7. Replace the tomcat.keystore with the relative path to the keystore you created for the keys and certificates that are associated with the Claims WS service. If the relative path to your keystore is ServerCert.jceks, then the edited line would match the following example:

   local.https.keyStoreFileName="ServerCert.jceks"
   

8. Save the file and close text editor.
9. Continue with the next step of generating an SSLConfig.properties file.

Generate an SSLConfig.properties File

The next step of protecting the ClaimsWS service involves generating an SSLConfig.properties file for the keystore.

Follow these steps:

1. On the server hosting your CA SiteMinder® Agent for SharePoint, open a command-line window.
2. If you have not yet created the TrustStore, run the following command:

   GenerateSSLConfig -keystorepass keystore_password
   

3. When prompted, enter the following values:
   • keystore_password (keystore password)
   • false (Enable Client Authentication)

   Important! Do not enable client authentication yet.

Restart the CA SiteMinder® Agent for SharePoint

Starting or stopping the CA SiteMinder® Agent for SharePoint involves the following separate procedures:

1. Changing the value of EnableWebAgent in the WebAgent.conf file.
2. Changing the state of the related services on the computer running the CA SiteMinder® Agent for SharePoint.

Change the Value of the EnableWebAgent Parameter

Change the value of the EnableWebAgent parameter to accomplish either of the following tasks:

• Start the CA SiteMinder® Agent for SharePoint when the related services start.
• Stop the CA SiteMinder® Agent for SharePoint when the related services start.

Follow these steps:

1. Open the following file with a text editor:

   Agent-for-SharePoint_home\proxy-engine\conf\defaultagent\WebAgent.conf
   

2. Locate the following line:

   EnableWebAgent="NO"
   

3. Change the value inside the quotation marks to one of the following values:
   • YES to start the CA SiteMinder® Agent for SharePoint after the services start. Your resources are protected.
   • NO to stop the CA SiteMinder® Agent for SharePoint after the services start. Your resources are not protected.
4. Change the state of the related services on your CA SiteMinder® Agent for SharePoint.

Change the States of the Services

You can change the states of the related services on your CA SiteMinder® Agent for SharePoint.

Note: To start or stop your CA SiteMinder® Agent for SharePoint, change the value of the EnableWebAgent parameter first.

Follow these steps:

1. To change the states of the related services, select one of the following procedures:
   • For Windows operating environments, go to Step 2.
   • To start the CA SiteMinder® Agent for SharePoint on UNIX operating environments, go to Step 3.
   • To stop the CA SiteMinder® Agent for SharePoint on UNIX operating environments, go to Step 4.
2. For Windows operating environments, do the following steps:
   1. From the Windows Start menu navigate to Administrative Tools, Services.

      The Services dialog appears.

   2. Scroll down the list of services and select SiteMinder CA SiteMinder® Agent for SharePoint.
   3. From the Action menu, select All Tasks and select the command that you want.
   4. Repeat Step b for SiteMinder Agent for SharePoint Proxy Engine.

      The states of the services and CA SiteMinder® Agent for SharePoint are changed.

3. To start the CA SiteMinder® Agent for SharePoint on UNIX operating environments, do the following steps.
   1. Log in as a root user.
   2. Navigate to the following directory:

      Agent-for-SharePoint_home/proxy-engine
      

   3. Run the following command:

      ./sps-ctl start
      

      The service and the CA SiteMinder® Agent for SharePoint start. The CA SiteMinder® Agent for SharePoint stops or starts according to the value you set in the EnableWebAgent parameter.

4. To stop the CA SiteMinder® Agent for SharePoint on a system running UNIX, do the following steps:
   1. Navigate to the following directory:

      Agent-for-SharePoint_home/proxy-engine
      

   2. Run the following command:

      ./sps-ctl stop
      

      The service and the CA SiteMinder® Agent for SharePoint stop.

Add a Trusted Root Authority to your SharePoint Farm

The next step in protecting the ClaimsWS service is adding a trusted root authority to your SharePoint farm.

Your SharePoint farm requires a new trusted root authority to identify and authenticate the information that it receives from the claims service. Create a trusted root authority on your SharePoint 2010 central administration server.

Follow these steps:

1. Copy the certificates for the ClaimsWS service from the system hosting your CA SiteMinder® Agent for SharePoint, to a directory on your SharePoint central administration server. Include the signed certificate that you downloaded from your certificate authority (certnew.cer file) and all the certificates in the certificate chain (certnew.p7b).
2. Open the SharePoint 2010 central administration site.
3. Click Security.
4. Under General Security, click Manage trust.
5. Click New.

   The Create Trusted Relationship dialog appears.

6. Enter a name for the trust relationship.
7. Click the Browse button next to the Root Authority Certificate, and then locate the certificate that you copied over in Step 1.
8. Click OK.
9. Repeat Steps 1 through 8 for each Certificate Authority certificate in your certificate chain. For example, if your certificate chain includes three certificates, repeat this step three times.

   The trusted root authority is created.

10. Continue by configuring the mutual trust relationship between the CA SiteMinder® claims provider and the ClaimsWS.

Request a Client Certificate

A mutual trust relationship between the following components is required for secure communications:

• The SharePoint claims search service.
• The CA SiteMinder® claims provider.

The first step in creating this relationship is requesting a client authenticate certificate. This certificate is installed on all SharePoint web front-end (WFE) servers. The client authentication certificate allows the ClaimsWS service to verify the identities of the WFE servers.

Several third-party tools are available for creating certificates. This procedure provides one possible example using Active Directory Certificate services and IIS 7.

If your organization uses different tools or procedures to create client certificates, use those tools or procedures instead.

If you already have a client authentication certificate, skip this procedure.

Follow these steps:

1. Open a Web browser (from a system running an IIS web server).
2. Navigate to the following URL:

   https://fully_qualilfied_domain_name_of_server_running_active_directory_certificate_services/certsrv
   

   An example of such a URL is http://certificateauthority.example.com/certsrv.

3. Click Request a certificate.

   The Request a certificate screen appears.

4. Click the advanced certificate request link.
5. Click the Create and submit a request to this CA.

   An Advanced Certificate Request form appears.

6. Complete the form, using the following examples as a guide:

   Name: SiteMinderClaimsProvider
   E-Mail: admin@support.example.com
   Company: Example
   Department: Support
   City: your_city
   State: your_state
   Country/Region your_country
   Type of Certificate Needed: Client Authentication Certificate
   Mark keys as exportable: ENABLED
   Friendly Name: SiteMinderClaimsProvider
   

   Note: Under the type of certificate needed drop-down list, verify that Client Authentication Certificate appears.

7. Click Submit.

   A confirmation dialog appears.

8. Click Yes.

   The request is submitted.

9. Note the following items for future reference:
   • Your request ID.
   • Verify the status of your request using the same browser within ten days.

Generate the Client Authentication Certificate

The next step in configuring a mutual trust relationship between the claims search service and the claims provider is generating the client authentication certificate.

The next step in protecting the ClaimsWS service is having a certificate authority process your request.

After the certificate authority receives your certificate signing request, they will process the request and will return the signed certificate.

Some organizations use third-party certificate authorities to sign their certificate requests. Other organizations could possibly have an internal group that operates a certificate authority.

The following procedure demonstrates the process for approving a certificate with Microsoft Active Directory Certificate services:

Certificate administrators approve or reject certificate requests. Certificate administrator privileges are separate from the Administrator privileges in the Windows operating environment. Not all users who have accounts on the computer hosting Active Directory Certificate services have sufficient privileges to approve or reject certificates.

Use this procedure if you have certificate administrator privileges. Otherwise, ask the certificate administrator in your organization to issue the certificate for you.

Follow these steps:

1. Log in to the web server hosting the Active Directory Certificate services using an account with Certificate administrator privileges.
2. Click Start, Administrative Tools, Certification Authority.

   The certsrv snap-in appears.

3. Click the name of the certification authority, and then click the pending request folder.

   A list of pending certificate requests appears.

4. Right-click the request ID associated with the request for the client certificate.
5. From the context menu, select All Tasks, Issue.

   The certificate is issued. Continue with the next step of downloading and importing the certificate.

Verify Your Certificate Approval and Install Your Client Authentication Certificate

The next step in creating a mutual trust relationship is verifying your approval and installing your client authentication certificate. Your IIS web server must have the client authentication certificate installed first before installing it on any SharePoint central administration or web front-end (WFE) servers.

Verify the status of your certificate request using the same IIS web server and Web browser from which you submitted the request. If your certificate is approved, install the certificate on your IIS web server first.

Follow these steps:

1. Open the same Web browser that you used to request your certificate on your system hosting an IIS web server.
2. Navigate to the following URL:

   https://fully_qualilfied_domain_name_of_server_running_active_directory_certificate_services/certsrv
   

   An example of such a URL is https://certificateauthority.example.com/certsrv.

3. Click View the status of a pending certificate request.

   A list of your certificate requests appears.

4. Click the link for your certificate request.

   The Certificate Issued screen appears. If it does not, contact the certificate administrator in your organization for more information.

5. Click the Install Certificate link.

   A confirmation dialog appears.

6. Click Yes.

   The certificate is installed under My User Account on your IIS web server. Continue with the next step of installing the certificate snap-ins on your IIS web server.

Add the Certificate Snap-ins

The next step for creating a mutual trust relationship between the Claims WS and the CA SiteMinder® claims provider is adding the certificate snap-ins.

The following accounts on your IIS web server require the certificate snap-in:

• Local computer
• My user account

Follow these steps:

1. Click Start, Run.

   The Run dialog appears.

2. Type mmc in the Open field, and then click OK.

   The Microsoft Management console appears.

3. Click File, Add/Remove Snap-in.

   The Add or Remove Snap-ins dialog appears.

4. In the Available snap-ins list, click Certificates, and then click Add.

   The Certificates snap-in dialog appears.

5. Select the Computer account option button, and then click Next.
6. Select the Local computer option button, and then click Finish.

   The Certificates snap-in dialog closes. The Certificates snap-in appears in the Selected snap-ins list.

7. Click Certificates n the Available snap-ins list, and then click Add.

   The Certificates snap-in dialog appears.

8. Select the My User Account option button, and then click Finish.
9. Click OK.

   The Add or Remove Snap-ins dialog closes. The certificate snap-ins are added.

10. Save your instance of the console for future use. Otherwise, the snap-ins do not appear in the future.

Export the Client Authentication Certificate from the Current User Certificate Store

The next step for creating the mutual trust relationship is exporting the client certificate from the current user certificate store.

The Windows operating environment uses several different locations within the same computer to store certificates. These locations vary depending on the user account type. Installing your client authentication certificate on your IIS web server placed it in the following store:

• Certificates, Current User, Personal, Certificates

Export the certificate from the current user certificate store so it can be added to the other certificate stores on the computer.

Follow these steps:

1. Click Start, Run.

   The Run dialog appears.

2. Type mmc In the Open field, and then click OK.

   The Microsoft Management console appears.

3. Expand the console root folder, and then click "Certificates - Current User".
4. Expand "Certificates - Current User/Personal", and then double-click the 'Certificates' folder corresponding to where the certificate is stored.

   A list of certificates appears.

5. Right-click your client authentication certificate, and then select All Tasks, Export.

   The certificate export wizard opens.

6. Export the certificate using the Personal Information Exchange - PKCS #12 (.PFX) format with the following options:
   • Include all certificates in the certification path if possible
   • Export all extended properties
7. Click Next.
8. Enter and confirm a password to protect the private key and click Next.
9. Specify the name of the certificate file to export and click Next.
10. Note the certificate filename and verify the other settings and click Finish.

The client certificate is exported. Continue with the next step of importing the certificate into the local computer certificate store.

Import the Client Authentication Certificate into the Local Computer Certificate Store

The next step for creating the mutual trust relationship is importing the client authentication certificate into the local computer certificate store.

Import the client authentication certificate into the following certificate store on your IIS web server.

• Certificates, Local computer

Follow these steps:

1. Copy the client authentication certificate that you exported from the current user store to a directory on your IIS web server.
2. Click Start, Run.

   The Run dialog appears.

3. Type mmc in the Open field, and then click OK.
4. Expand Certificates (LocalComputer)
5. Expand Personal.

   The certificates folder appears.

6. Right-click the certificates folder, and then click All Tasks, Import.
7. Import the certificate.

   The certificate appears.

8. Double-click the client certificate. Verify that the General tab is selected.
9. Note the value in the Issued to field. You need this name to register the endpoint for the claims search service.

Install the Client Authentication Certificate on your SharePoint Servers

The next step in establishing the mutual trust relationship is installing the client-authentication certificate on more servers.

Install the client authentication certificate that you exported from your IIS web server on the following servers in your SharePoint environment:

• Your SharePoint central administration server.
• All web front-end (WFE) servers in your SharePoint farm.

Follow these steps:

1. Copy the exported client authentication certificate to a directory on your server.
2. Click Start, Run.

   The Run dialog appears.

3. In the Open field, type mmc and then click OK.
4. Expand Certificates — Local Computer.
5. Expand Personal.
6. The certificates folder appears.

   Right-click the certificates folder, and then click All Tasks, Import.

7. Import the client certificate.

   The certificate appears.

8. Double-click the client certificate. Verify that the General tab is selected.
9. Note the value in the Issued to field. You need this name to register the endpoint for the claims search service.
10. Repeat Steps 1 through 9 on each server in your environment (your SharePoint central administration server and on each WFE server). For example, if you have one SharePoint central administration server and five WFE servers, perform this procedure six times.

    The client authentication certificate is installed. Continue with the next step of granting permissions to the application pools.

Grant Application Pool Identities for SharePoint Web Applications Permissions to the Client Certificate

All application pool identities that are associated with protected SharePoint web applications need read-only permissions to the client authentication certificate. Perform this procedure on all the following servers in your environment:

• Your SharePoint central administration server.
• All web front end (WFE) servers in your SharePoint farm.

Follow these steps:

1. To obtain the application pool identities, do the following steps:
   1. In IIS Manager, go to the Application Pools section and click SharePoint Web Application Pool.
   2. Click Advanced Settings and locate the application pool identity.
   3. Make a note of the application pool identities.
2. To start the Microsoft Management console, do the following steps:
   1. Click Start, Run.

      The Run dialog appears.

   2. In the Open field, type mmc and then click OK.

      The Microsoft Management console appears.

3. Expand the console root folder, and then click Certificates — Local Computer.
4. Locate and right-click your client certificate, then select All tasks, Manage Private keys.

   The permissions dialog appears.

5. Grant each application pool identity that you noted in Step 1 read access to the client certificate.
6. Repeat Steps 1 through 5 on the SharePoint central administration server and all the WFE servers in your SharePoint farm. For example, if you have one SharePoint central administration server and five WFE servers, perform this procedure six times.

   The permissions are granted. Continue with the next step of registering the claims search service endpoint on all WFE servers.

Register the Claims Search Service Endpoint on all WFE Servers

The next step in establishing the mutual trust relationship is registering the claims search service endpoint on all WFE servers in your SharePoint farm.

Registering a new end point for the claims search service associates the secure connection with the client authentication certificate. A PowerShell script that is installed with the claims provider automates the registration process. Register the new end point for all of the web front end (WFE) servers in your SharePoint environment.

Follow these steps:

1. Remove any previously registered CA SiteMinder® claims services from the WFE server by running the following script:

   SharePointClaimsProvider_directory\scripts\Remove-SMClaimSearchService.ps1 -WebApplication "url_of_SharePoint_web_application"
   

   The following example describes removing the registration of a previous claims search service endpoint for the following web applications:

   • SharePoint_webapplication.support.example.com:8189/ (runs on port 8189)
   • SharePoint_webapplication.support.example.com:8286/ (runs on port 8286)

     .\Remove-SMClaimSearchService.ps1 -WebApplication "http://SharePoint_webapplication.support.example.com:8189/"
     

     .\Remove-SMClaimSearchService.ps1 -WebApplication "http://SharePoint_webapplication.support.example.com:8286/"
     

2. Repeat Step 1 for each SharePoint web application on the WFE server
3. Gather the following information:

   –WebApplication url_of_SharePoint_web application

   Specifies the URL associated with a SharePoint web application.
   Example: http://SharePoint_webapplication.support.example.com:/ (runs on the default port).

   Example: http://SharePoint_webapplication.support.example.com:81/ (runs on port 81).

   Example: http://SharePoint_webapplication.support.example.com:82/ (runs on port 82).

   -ClaimSearchService claims_search_service_URL

   Specifies the URL of the claims search service.

   Limits: If the claim search service uses SSL, specify the https: protocol.

   Example: https://claim_search_service.support.example.com:8002/ClaimsWS/services/WSSharePointClaimsServiceImpl

   –ClientCertificateName

   Specifies the value in the Issued To: field of your client authentication certificate. This client certificate protects the Claims WS (web service).

   Example: SiteminderClaimsProvider

4. Open the SharePoint 2010 Management Shell.
5. Navigate to the following directory:

   SharePointClaimsProvider_directory\scripts
   

6. Enter the following command for your first web application:

   .\Add-SMClaimSearchService.ps1 -WebApplication url_of_web_application url  -ClaimSearchService https://claims_search_service_url -EnableSSLClientAuthentication -ClientCertificateName name_in_Issued-To:_field_of_Certificate
   

   The first end point is registered.

7. Repeat Step 4 for each SharePoint web application on the WFE server. The following example describes registering a claims search service endpoint for the following web applications:
   • SharePoint_webapplication.support.example.com:81 (runs on port 81)
   • SharePoint_webapplication.support.example.com:82 (runs on port 82)

     .\Add-SMClaimSearchService.ps1 -WebApplication http://SharePoint_webapplication.support.example.com81/ -ClaimSearchService
     

     https://claim_search_service.support.example.com:8002/ClaimsWS/services/WSSharePointClaimsServiceImpl -EnableSSLClientAuthentication
     

     -ClientCertificateName SiteminderClaimsProvider
     

     .\Add-SMClaimSearchService.ps1 -WebApplication http://SharePoint_webapplication.support.example.com:82/ -ClaimSearchService
     

     https://claim_search_service.support.example.com:8002/ClaimsWS/services/WSSharePointClaimsServiceImpl-EnableSSLClientAuthentication
     

     -ClientCertificateName SiteminderClaimsProvider
     

8. Restart your WFE server.
9. Repeat Steps 1 through 8 on all of the web front end (WFE) servers in your SharePoint environment.

   The claims serach service endpoint is registered. Continue with the next step of creating a trusted store for the root certificate authority certificate.

Create a Trusted Store for the Root Certificate Authority Certificate

The server on which your CA SiteMinder® Agent for SharePoint runs also requires a separate trusted store for the root certificate authority certificates. If you use certificates signed by a third-party certificate authority, import the certificate authority certificate signed by the third party into this trusted store. If you are using a self-signed certificate import either the self-signed certificate or the associated public key into this trusted store.

Important! Do not use self-signed certificates in production environments. We recommend using self-signed certificates in test environments only.

Follow these steps:

Note: This procedure provides one possible example of how to configure this feature using third-party tools. CA Technologies did not develop nor provide these tools. These tools are subject to change at any time by the third party without notice. Use this procedure as a guide for configuring this feature in your specific environment. The actual steps that are required in your situation could be different from the steps that are shown here.

1. Copy your certificate to the server on which your CA SiteMinder® Agent for SharePoint runs.
2. Open a Command Prompt window.
3. Create a trusted store with the following command:

   Keytool -importcert -alias alias_name -file path_to_root_certificate -trustcacerts -keystore relative_path_to_trusted_store -storepass trusted_store_password -storetype JCEKS
   

   Note: We recommend using a relative location under the Agent-for-SharePoint_home\SSL\keys directory

Update the SSLConfig.properties File

The next step of the process of creating a mutual trust relationship is updating the SSLConfig.properties file.

The server that runs your CA SiteMinder® Agent for SharePoint requires a password-protected location (trust store) for the client authentication certificate. Specify a password for the trust store when creating it.

Follow these steps:

1. Run the following command on the server that runs your CA SiteMinder® Agent for SharePoint:

   GenerateSSLConfig -keystorepass keystore_password -truststore TrustStore.jceks -truststorepass truststore_password
   

   A confirmation prompt for your trust store password appears.

2. Re—enter your trust store password.

   A confirmation prompt for client authentication appears.

3. Enter yes.

   The SSLConfig.properties file is updated. Continue with the next step of restarting your CA SiteMinder® Agent for SharePoint.

Restart the CA SiteMinder® Agent for SharePoint

Starting or stopping the CA SiteMinder® Agent for SharePoint involves the following separate procedures:

1. Changing the value of EnableWebAgent in the WebAgent.conf file.
2. Changing the state of the related services on the computer running the CA SiteMinder® Agent for SharePoint.

Change the Value of the EnableWebAgent Parameter

Change the value of the EnableWebAgent parameter to accomplish either of the following tasks:

• Start the CA SiteMinder® Agent for SharePoint when the related services start.
• Stop the CA SiteMinder® Agent for SharePoint when the related services start.

Follow these steps:

1. Open the following file with a text editor:

   Agent-for-SharePoint_home\proxy-engine\conf\defaultagent\WebAgent.conf
   

2. Locate the following line:

   EnableWebAgent="NO"
   

3. Change the value inside the quotation marks to one of the following values:
   • YES to start the CA SiteMinder® Agent for SharePoint after the services start. Your resources are protected.
   • NO to stop the CA SiteMinder® Agent for SharePoint after the services start. Your resources are not protected.
4. Change the state of the related services on your CA SiteMinder® Agent for SharePoint.

Change the States of the Services

You can change the states of the related services on your CA SiteMinder® Agent for SharePoint.

Note: To start or stop your CA SiteMinder® Agent for SharePoint, change the value of the EnableWebAgent parameter first.

Follow these steps:

1. To change the states of the related services, select one of the following procedures:
   • For Windows operating environments, go to Step 2.
   • To start the CA SiteMinder® Agent for SharePoint on UNIX operating environments, go to Step 3.
   • To stop the CA SiteMinder® Agent for SharePoint on UNIX operating environments, go to Step 4.
2. For Windows operating environments, do the following steps:
   1. From the Windows Start menu navigate to Administrative Tools, Services.

      The Services dialog appears.

   2. Scroll down the list of services and select SiteMinder CA SiteMinder® Agent for SharePoint.
   3. From the Action menu, select All Tasks and select the command that you want.
   4. Repeat Step b for SiteMinder Agent for SharePoint Proxy Engine.

      The states of the services and CA SiteMinder® Agent for SharePoint are changed.

3. To start the CA SiteMinder® Agent for SharePoint on UNIX operating environments, do the following steps.
   1. Log in as a root user.
   2. Navigate to the following directory:

      Agent-for-SharePoint_home/proxy-engine
      

   3. Run the following command:

      ./sps-ctl start
      

      The service and the CA SiteMinder® Agent for SharePoint start. The CA SiteMinder® Agent for SharePoint stops or starts according to the value you set in the EnableWebAgent parameter.

4. To stop the CA SiteMinder® Agent for SharePoint on a system running UNIX, do the following steps:
   1. Navigate to the following directory:

      Agent-for-SharePoint_home/proxy-engine
      

   2. Run the following command:

      ./sps-ctl stop
      

      The service and the CA SiteMinder® Agent for SharePoint stop.

Modify the SSL Configuration File

This section describes configuring secure communications between your CA SiteMinder® Agent for SharePoint reverse proxy and the Public URLs of your SharePoint web applications.

The first step in configuring the reverse proxy for secure communications is modifying the SSL configuration file.

The SSL configuration file requires the following modifications:

• Add listening directives for each SSL port.
• Add virtual host sections for each port-based virtual host.

Follow these steps:

1. Log in to the server hosting your CA SiteMinder® Agent for SharePoint:
2. Open the following file with a text editor:

   Agent-for-SharePoint_home\httpd\conf\extra\httpd-ssl.conf
   

   Agent-for-SharePoint_Home

   Indicates the directory where the CA SiteMinder® Agent for SharePoint is installed.

   Default: (Windows) [32-bit] C:\Program Files\CA\Agent-for-SharePoint

   Default: (Windows) [64-bit] C:\CA\Agent-for-SharePoint
   Default: (UNIX/Linux) /opt/CA/Agent-for-SharePoint

3. Add the appropriate number of 'Listen' directives for your environment. Use the following examples as a guide:
   • Listen 443 #(for the default http port 80)
   • Listen 481 #(for http port 81)
   • Listen 482 #(for http port 82)

   The previous example assumes that you already have three web applications listening for HTTP requests on ports 80, 81 and 82. The previous example shows how to add HTTPS ports 443, 481 and 482 respectively.

4. Add a section for each port-based virtual host, using the following examples as a guide:

   <VirtualHost _default_:443>
   # General setup for the virtual host
   DocumentRoot "C:/CA/Agent-for-SharePoint/httpd/htdocs"
   ServerName SMSPA2010.smtest.ca.com:443
   ServerAdmin Admin@smtest.ca.com
   # ErrorLog logs/error_log.log
   # TransferLog logs/access_log.log
   SSLEngine on
   SSLCertificateFile "C:/CA/Agent-for-SharePoint/SSL/certs/smspa2010.smtest.ca.com.cer"
   SSLCertificateKeyFile "C:/CA/Agent-for-SharePoint/SSL/keys/smspa2010.smtest.ca.com.key"
   </VirtualHost>
   <VirtualHost *:481>
   DocumentRoot "C:/CA/Agent-for-SharePoint/httpd/htdocs/481smspa2010"
   ServerName smspa2010.smtest.ca.com
   ServerAdmin Admin@smtest.ca.com
   ErrorLog logs/481smspa2010_error_log.log
   TransferLog logs/481smspa2010_access_log.log
   SSLEngine on
   SSLCertificateFile C:/CA/Agent-for-SharePoint/SSL/certs/smspa2010.smtest.ca.com.cer
   SSLCertificateKeyFile C:/CA/Agent-for-SharePoint/SSL/keys/smspa2010.smtest.ca.com.key
   CustomLog logs/cipher_log_481smspa2010 \
   "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
   </VirtualHost>
   <VirtualHost *:482>
   DocumentRoot "C:/CA/Agent-for-SharePoint/httpd/htdocs/482smspa2010"
   ServerName smspa2010.smtest.ca.com
   ServerAdmin Admin@smtest.ca.com
   ErrorLog logs/482smspa2010_error_log.log
   TransferLog logs/482smspa2010_access_log.log
   SSLEngine on
   SSLCertificateFile C:/CA/Agent-for-SharePoint/SSL/certs/smspa2010.smtest.ca.com.cer
   SSLCertificateKeyFile C:/CA/Agent-for-SharePoint/SSL/keys/smspa2010.smtest.ca.com.key
   CustomLog logs/cipher_log_482smspa2010 \
   "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
   </VirtualHost>
   

   The previous example describes the virtual host entries that are created to match the port settings in Step 2.

5. Save the file and close the text editor.

   The SSL Configuration file is modified. Continue with the next step of generating certificates and keys for each unique server (FQDN) in your environment.

Generate a Private Key

The next step in configuring the reverse proxy for secure communications is to generate a private (Windows) RSA Key (server key) for each virtual site with a fully qualified domain name (FQDN). Do one of the following procedures:

• Generate a private unencrypted RSA server key for each virtual site
• Generate a private encrypted RSA server key for each virtual site

Generate a Private Unencrypted RSA Server Key for Each Virtual Site

Generate a private key for each virtual site with a fully qualified domain name (FQDN). This procedure describes how to generate an unencrypted private key.

Follow these steps:

1. Open a command-line window.
2. Navigate to the following directory

   Agent-for-Sharepoint_home\SSL\bin
   

   Agent-for-SharePoint_Home

   Indicates the directory where the CA SiteMinder® Agent for SharePoint is installed.

   Default: (Windows) [32-bit] C:\Program Files\CA\Agent-for-SharePoint

   Default: (Windows) [64-bit] C:\CA\Agent-for-SharePoint
   Default: (UNIX/Linux) /opt/CA/Agent-for-SharePoint

3. Generate the keys by running the following commands:

   .\openssl genrsa -out ..\keys\server_FQDN.key [numbits]
   

   server_FQDN

   Specifies the fully qualified domain name of the server.

   numbits

   (Optional) Specifies the size of the private key to generate in bits.

   Default: 512

   Range: 512 - 2048

   The following example describes creating a 2048-bit key for a server named smspa2010:

   .\openssl genrsa -out ..\keys\smspa2010.example.com.key 2048
   

4. Repeat Step 3 for each virtual server.

   The private unencrypted server keys are created. Continue with the next step of generating a certificate signing request.

Generate a Private Encrypted RSA Server Key for Each Virtual Site

Generate a private key for each virtual site with a fully qualified domain name (FQDN). This procedure describes how to generate an encrypted private key.

Follow these steps:

1. Open a command-line window.
2. Navigate to the following directory

   Agent-for-Sharepoint_home\SSL\bin
   

   Agent-for-SharePoint_Home

   Indicates the directory where the CA SiteMinder® Agent for SharePoint is installed.

   Default: (Windows) [32-bit] C:\Program Files\CA\Agent-for-SharePoint

   Default: (Windows) [64-bit] C:\CA\Agent-for-SharePoint
   Default: (UNIX/Linux) /opt/CA/Agent-for-SharePoint

3. Generate the keys by running the following commands:

   .\openssl genrsa -des3 -out ..\keys\server_FQDN.key [numbits]
   

   server_FQDN

   Specifies the fully qualified domain name of the server.

   numbits

   (Optional) Specifies the size of the private key to generate in bits.

   Default: 512

   Range: 512 - 2048

   The following example describes creating a 1024-bit key for a server named smspa2010:

   .\openssl genrsa-des3 -out ..\keys\smspa2010.example.com.key 1024
   

4. Repeat Step 3 for each virtual server.

   The private encrypted server keys are created and written to the specified key output file.

The key output file will be in encrypted ASCII PEM (from “Privacy Enhanced Mail") format.

Because the file is encrypted, you will be prompted for a pass-phrase to protect it and decrypt it later if you want. If you do not want your key to be protected, do not use the -des3 argument in the command line.

To view the details of this RSA key, enter the following command:

openssl rsa -noout -text -in server.key

Generate and Submit Certificate Signing Requests

The next step in configuring the reverse proxy for secure communications is generating the certificate signing requests for each of the virtual servers.

Follow these steps:

1. Open a command-line window.
2. Generate the certificate signing requests by running the following command:

   .\openssl req -config .\openssl.cnf -new -key ..\keys\server_FQDN .key -out ..\keys\server_FQDN.csr
   

   The following example describes creating a certificate request for a server named smspa2010 on the support.example.com domain:

   .\openssl req -config .\openssl.cnf -new -key ..\keys\smspa2010.support.example.com.key -out ..\keys\smspa2010.support.example.com.csr
   

3. Create your certificate request by adding the information at each prompt, as shown in the following example:

   Country: Your_Country
   State: Your_State
   Locality: Your_Town
   Organization: Example
   Org. Unit: support
   CN: smspa2010.support.example.com
   E-Mail: admin@support.ca.com
   Challenge Pwd: firewall
   Optional name: blank
   

   Note: The value for the common name (CN) must match the fully qualified domain name (FQDN) of the web server.

   The system generates a certificate request with the certificate file name and a request number, as shown in the following example:

   smspa2010.support.example.com.csr 8
   

4. Record the file name and certificate signing request for future reference.
5. Repeat Steps 2 through 4 for the other virtual servers.
6. Submit your certificate signing requests to the certificate authority that your organization uses.

   The certificate signing requests are generated and submitted. Continue with the next step of downloading your certificates from your certificate authority.

Download and Install the Certificates from your Certificate Authority

The next step in configuring the reverse proxy for secure communications is downloading the signed certificates from the certificate authority.

The virtual host sections in your SSL configuration file specify a certificate location for each virtual host. The SSLCertificateFile line in the following example specifies the location for the spa2010.support.example.com server:

SSLCertificateFile "Agent-for-SharePoint_home/SSL/certs/smspa2010.support.example.com.cer

Agent-for-SharePoint_Home

Indicates the directory where the CA SiteMinder® Agent for SharePoint is installed.

Default: (Windows) [32-bit] C:\Program Files\CA\Agent-for-SharePoint

Default: (Windows) [64-bit] C:\CA\Agent-for-SharePoint
Default: (UNIX/Linux) /opt/CA/Agent-for-SharePoint

Follow these steps:

1. Log in to your CA SiteMinder® Agent for SharePoint server from which you issued the certificate requests.
2. Review the SSL configuration file for the SSLCerfificateFile lines.
3. Copy a certificate file to its respective location that is specified in the SSL Configuration file.
4. Repeat Step 3 for each unique server running a virtual host.

   The certificates are downloaded. Continue with the next step of accommodating your SSL sites by modifying the proxy rules.

Accommodate Your SSL Sites by Modifying the Proxy Rules

The next step in configuring the reverse proxy for secure communication is modifying the proxy rules for the server on which your CA SiteMinder® Agent for SharePoint runs.

Note: Even if you are using only SSL, the proxy rules files require rules for both HTTP and HTTPS protocols.

Follow these steps:

1. Open the following file with a text editor:

   Agent-for-SharePoint_home\proxy-engine\conf\proxyrules.xml
   

   Agent-for-SharePoint_Home

   Indicates the directory where the CA SiteMinder® Agent for SharePoint is installed.

   Default: (Windows) [32-bit] C:\Program Files\CA\Agent-for-SharePoint

   Default: (Windows) [64-bit] C:\CA\Agent-for-SharePoint
   Default: (UNIX/Linux) /opt/CA/Agent-for-SharePoint

2. Modify the ProxyRules.xml file for the SSL sites by adding proxy rules that include the SSL port and the related web application. The following example shows the new rules in bold:

   <nete:proxyrules xmlns:nete="http://smspa2010.smtest.ca.com/" debug="yes">
   <nete:cond type="host" criteria="endswith">
   <nete:case value="81">
   <nete:forward>http://w2k8r2.smtest.ca.com:14056$0</nete:forward>
   </nete:case>
   <nete:case value="82">
   <nete:forward>http://w2k8r2.smtest.ca.com:31415$0</nete:forward>
   </nete:case>
   <nete:case value="481">
   <nete:forward>http://w2k8r2.smtest.ca.com:14056$0</nete:forward>
   </nete:case>
   <nete:case value="482">
   <nete:forward>http://w2k8r2.smtest.ca.com:31415$0</nete:forward>
   </nete:case>
   <nete:default>
   <nete:forward>http://w2k8r2.smtest.ca.com:31567$0</nete:forward>
   </nete:default>
   </nete:cond>
   </nete:proxyrules>
   

3. Save the file and close the text editor.

   The proxy rules are modified. Continue with the next step of enabling SSL on your CA SiteMinder® Agent for SharePoint.

Enable SSL on Your Proxy Server

The next step in configuring the reverse proxy for secure communication is enabling SSL on the server that runs your CA SiteMinder® Agent for SharePoint.

To enable SSL on your CA SiteMinder® Agent for SharePoint, do one of the following procedures, as appropriate.

• Enable SSL for an unencrypted private key on Windows
• Enable SSL for an unencrypted private key on UNIX
• Enable SSL for an encrypted private key

Enable SSL for an Unencrypted Private Key on Windows

To enable SSL for an unencrypted private key on Windows, generate an spsapachessl.properties file.

Follow these steps:

1. Open a command-line window with administrative privileges.
   Navigate to the following directory:

   Agent-for-SharePoint_home\httpd\bin
   

2. Run the following script file:

   configssl.bat -enable
   

   Note: If an overwrite warning appears, confirm that you want to overwrite the existing spsapachessl.properties file.

Enable SSL for an Unencrypted Private Key on UNIX

To enable SSL for an unencrypted private key on UNIX, edit the spsapachessl.properties located in the following location:

Agent-for-Sharepoint_home/httpd/conf/spsapachessl.properties

Follow these steps:

1. Open the spsapachessl.properties file in a text editor.
2. Search for the following line:

   apache.ssl.enabled=
   

3. Do one of the following tasks:
   • If the previous line does not exist, add it to the file. Then go to step 4.
   • If the previous line exists, go to Step 4.
4. Edit the line as follows:

   apache.ssl.enabled=Y
   

5. Save the changes to the spsapachessl.properties file and close the text editor.

Enable SSL for an Encrypted Private Key

To enable SSL for an encrypted private key, generate an spsapachessl.properties file.

Follow these steps:

1. Open a command-line window with administrative privileges.
   Navigate to the following directory:
   • (Windows) Agent-for-SharePoint_home\httpd\bin
   • (UNIX) Agent-for-SharePoint_home/httpd/bin
2. Run one of the following script files:
   • (Windows) configssl.bat -enable passphrase
   • (UNIX) configssl.sh passphrase

   Note: If an overwrite warning appears, confirm that you want to overwrite the existing spsapachessl.properties file.

Run the Connection Wizard

The next steps in configuring the reverse proxy for secure communications involve the following tasks:

• Running the connection wizard to change the protocol of the Authentication URL to HTTPS.
• Changing the SignIn URL on your SharePoint central administration server using several PowerShell commands.

Follow these steps:

1. Edit the existing connection using the Connection Wizard with the following steps:
   1. Log in to the server that runs your CA SiteMinder® Agent for SharePoint.
   2. Navigate to the following directory:

      Agent-for-SharePoint_home/sharepoint_connection_wizard
      

   3. Do the appropriate step for your operating environment:
      • Windows: Right-click the executable and then select Run as administrator.
      • Solaris: sh ./ca-spconnect-12.0-sp3-sol.bin
      • Linux: sh ./ca-spconnect-12.0-sp3-rhel30.bin

      The SharePoint Connection wizard starts.

   4. Click Next.

      The Login Details screen appears.

   5. Enter the following login for the Policy Server.

      Policy Server Name

      Specifies the Policy Server name or IP address.

      Username

      Specifies the Policy Server administrator username.

      Password

      Specifies the Policy Server administrator password.

      Agent Name

      Specifies the Agent-4x. The connection with the Policy Server is established using the details given in the Agent Name.

      Shared Secret Key

      Specifies the shared secret key that is associated with the Agent.

   6. Click Next

      The Select Action screen appears.

   7. Select Edit a SharePoint Connection option.
   8. Click Next.

      The SharePoint Connection Properties screen appears.

   9. Change the protocol of the Authentication URL to HTTPS in the SharePoint Connection Properties screen.
   10. Click Install in the Commit Details screen.

       The Save Complete screen appears.

   11. Click Done.

   The partnership details are saved, the SharePoint Connection is modified, and the wizard closes.

2. Modify the SignInUrl of the CA SiteMinder® Trusted Identity Token Issuer with the following steps:
   1. Log in to your SharePoint central administration server.
   2. Click Start, All Programs, Microsoft SharePoint 2010 Products, SharePoint 2010 Management Shell.
   3. Verify the following settings by running the Get-SPTrustedIdentityTokenIssuer command:
      • The name of the provider
        (such as LDAP-Claims)
      • The current SignInUrl
        (such as http://smspa2010.support.example.com/affwebservices/public/wsfeddispatcher).
   4. Run the Set-SPTrustedIdentityTokenIssuer command as shown in the following example:

      Set-SPTrustedIdentityTokenIssuer "LDAP-Claims" -SignInUrl
      https://smspa2010.support.example.com/affwebservices/public/wsfeddispatcher
      

   5. Run the Get-SPTrustedIdentityTokenIssuer command again to verify the change to the SigInUrl.

      Note: For more information about the Set-SPTrustedIdentityTokenIssuer command, see http://technet.microsoft.com/en-us/library/ff607792.aspx

   The protocol is changed. Continue with the next step of creating alternate access mappings for your port-based virtual sites.

Create Alternate Access Mappings for Your Port-Based Virtual Sites

The next step in configuring the reverse proxy for secure communication is creating alternate access mappings on your SharePoint server for the port-based virual hosts on your CA SiteMinder® Agent for SharePoint.

Port-based proxy rules require the following alternate access mappings on your SharePoint central administration server:

• Set the public URL for the zone to the URL of your virtual host on your CA SiteMinder® Agent for SharePoint that is associated with the web application.
• Set the internal URL to the SharePoint server to which the requests from the virtual host on the CA SiteMinder® Agent for SharePoint are forwarded.

Follow these steps:

1. Open your SharePoint central administration site
2. Click Application Management.
3. Under Web Applications, click Configure Alternate Access Mappings..
4. Use the examples in the following table as a guide to edit your public URLs and Add Internal URLs:

The alternate access mappings are created. Continue with the next step of modifying the ConfigSLL.bat file.

Modify Your Authentication Scheme

The next step in configuring the reverse proxy for secure communication is modifying your CA SiteMinder® authentication scheme to use SSL.

Authentication schemes use HTTP unless you specify HTTPS when creating the authentication scheme.

Follow these steps:

1. Login to the Administrative UI.
2. Click Infrastructure, Authentication, Authentication Schemes.
3. Click the link of the authentication scheme that you want.
4. Click Modify.
5. Select the Use SSL Connection check box.
6. Click Submit.

   A confirmation screen appears.

7. Click OK.

   The authentication scheme is modified. Continue with the next step of restarting your CA SiteMinder® Agent for SharePoint.

Restart the CA SiteMinder® Agent for SharePoint

Starting or stopping the CA SiteMinder® Agent for SharePoint involves the following separate procedures:

1. Changing the value of EnableWebAgent in the WebAgent.conf file.
2. Changing the state of the related services on the computer running the CA SiteMinder® Agent for SharePoint.

Change the Value of the EnableWebAgent Parameter

Change the value of the EnableWebAgent parameter to accomplish either of the following tasks:

• Start the CA SiteMinder® Agent for SharePoint when the related services start.
• Stop the CA SiteMinder® Agent for SharePoint when the related services start.

Follow these steps:

1. Open the following file with a text editor:

   Agent-for-SharePoint_home\proxy-engine\conf\defaultagent\WebAgent.conf
   

2. Locate the following line:

   EnableWebAgent="NO"
   

3. Change the value inside the quotation marks to one of the following values:
   • YES to start the CA SiteMinder® Agent for SharePoint after the services start. Your resources are protected.
   • NO to stop the CA SiteMinder® Agent for SharePoint after the services start. Your resources are not protected.
4. Change the state of the related services on your CA SiteMinder® Agent for SharePoint.

Change the States of the Services

You can change the states of the related services on your CA SiteMinder® Agent for SharePoint.

Note: To start or stop your CA SiteMinder® Agent for SharePoint, change the value of the EnableWebAgent parameter first.

Follow these steps:

1. To change the states of the related services, select one of the following procedures:
   • For Windows operating environments, go to Step 2.
   • To start the CA SiteMinder® Agent for SharePoint on UNIX operating environments, go to Step 3.
   • To stop the CA SiteMinder® Agent for SharePoint on UNIX operating environments, go to Step 4.
2. For Windows operating environments, do the following steps:
   1. From the Windows Start menu navigate to Administrative Tools, Services.

      The Services dialog appears.

   2. Scroll down the list of services and select SiteMinder CA SiteMinder® Agent for SharePoint.
   3. From the Action menu, select All Tasks and select the command that you want.
   4. Repeat Step b for SiteMinder Agent for SharePoint Proxy Engine.

      The states of the services and CA SiteMinder® Agent for SharePoint are changed.

3. To start the CA SiteMinder® Agent for SharePoint on UNIX operating environments, do the following steps.
   1. Log in as a root user.
   2. Navigate to the following directory:

      Agent-for-SharePoint_home/proxy-engine
      

   3. Run the following command:

      ./sps-ctl start
      

      The service and the CA SiteMinder® Agent for SharePoint start. The CA SiteMinder® Agent for SharePoint stops or starts according to the value you set in the EnableWebAgent parameter.

4. To stop the CA SiteMinder® Agent for SharePoint on a system running UNIX, do the following steps:
   1. Navigate to the following directory:

      Agent-for-SharePoint_home/proxy-engine
      

   2. Run the following command:

      ./sps-ctl stop
      

      The service and the CA SiteMinder® Agent for SharePoint stop.