Kerberos constrained delegation paths Figure - Kerberos constrained delegation paths SharePoint Server logical authentication Authentication in this scenario begins with the client authenticating with Kerberos authentication at the web front end. SharePoint Server 2010 will convert the Windows authentication token into a claims token using the local Security Token Service (STS). The PerformancePoint Services service application will accept the claims token and convert it into a Windows token (Kerberos authentication) using the local Claims to Windows Token Service (C2WTS) that is a part of Windows Identity Framework (WIF). The PerformancePoint Services service application will then use the client’s Kerberos ticket to authenticate with the backend data source. Figure - SharePoint Server logical authentication Step-By-Step Configuration Instructions The following sections specify the required to configure PerformancePoint Services with Claims authentication for SharePoint Server 2010. Active Directory Configuration Create PerformancePoint Services service account As a best practice PerformancePoint Services should run under its own domain identity. To configure the PerformancePoint Services service application, an Active Directory account must be created and registered as a managed account in SharePoint Server 2010. For more information on configuring managed accounts: Configure automatic password change (SharePoint Server 2010) In this example the following account is created and registered later in this scenario: Performance Point Service Application Settings – SharePoint Service IIS App Pool Identity PerformancePoint Services NWTRADERS\_svcSPPerfPointAppID Create an SPN for the Service Account running the PerformancePoint Service on the Application Server This step is necessary because the Service Account running the SharePoint Application Pool is different than the PerformancePoint account. The Active Directory Users and Computers MMC snap-in is typically used to configure Kerberos delegation. To configure the delegation settings within the snap-in, the
Kerberos constrained delegation paths Figure - Kerberos constrained delegation paths SharePoint Server logical authentication Authentication in this scenario begins with the client authenticating with Kerberos authentication at the web front end. SharePoint Server 2010 will convert the Windows authentication token into a claims token using the local Security Token Service (STS). The PerformancePoint Services service application will accept the claims token and convert it into a Windows token (Kerberos authentication) using the local Claims to Windows Token Service (C2WTS) that is a part of Windows Identity Framework (WIF). The PerformancePoint Services service application will then use the client’s Kerberos ticket to authenticate with the backend data source. Figure - SharePoint Server logical authentication Step-By-Step Configuration Instructions The following sections specify the required to configure PerformancePoint Services with Claims authentication for SharePoint Server 2010. Active Directory Configuration Create PerformancePoint Services service account As a best practice PerformancePoint Services should run under its own domain identity. To configure the PerformancePoint Services service application, an Active Directory account must be created and registered as a managed account in SharePoint Server 2010. For more information on configuring managed accounts: Configure automatic password change (SharePoint Server 2010) In this example the following account is created and registered later in this scenario: – Performance Point Service Application Settings SharePoint Service IIS App Pool Identity PerformancePoint Services NWTRADERS\_svcSPPerfPointAppID Create an SPN for the Service Account running the PerformancePoint Service on the Application Server This step is necessary because the Service Account running the SharePoint Application Pool is different than the PerformancePoint account. The Active Directory Users and Computers MMC snap-in is typically used to configure Kerberos delegation. To configure the delegation settings within the snap-in, the
ConfiguringExtranetAccessForPerformancePointServices2010.docx