SPNEGO Lessons Learned

Was installing IC3011 and integrating with SP2010.  Needed to lay the foundation of IC3011 + Kerberos auth.  Then turned on SPNEGO SSO to allow pass-through auth for browser clients like SP2010 offers.  While setting up SPNEGO, there were a few issues I encountered and wanted to capture them so I remember the next time I need to do this.

Issue 1: Remember to Patch!

IC 3.0.1.1 supports WAS 7.0.0.11 through 7.0.0.21.

http://www-01.ibm.com/support/docview.wss?uid=swg27021342

Be sure to at least reach WAS 7.0.0.15 as there are critical Kerberos fixes that will make your life easier.

Issue 2: Double Check Security

When applying a FixPack post initial installation / configuration, it may revert your security to disabled.  Make sure to turn it back on right after upgrade.

Issue 3: Mind Your User IDs

My initial strategy was to use the same ID for all security related things.  When establishing the SPN for the server that ID needs to be a separate ID than the one setup as the administrative ID within the app server and for the individual features.

http://www-10.lotus.com/ldd/lcwiki.nsf/dx/Mapping_an_Active_Directory_account_to_administrative_roles_ic301 – THIS ID IS SEPARATE FROM

http://www-10.lotus.com/ldd/lcwiki.nsf/dx/Creating_a_service_principal_name_and_keytab_file_ic301 – THIS ID

Issue 4: Sync the Node(s)

Somewhere during all of the installation and patching activities to take a base 3.0.1 installation up to patched 3.0.1.1, the Node fell out of sync with the DM.  I had to manually force the sync for the ISC to report the state of applications and node agents properly.  The sync issue was also causing some of my configurations to not make their way to the running app server.  Periodically run a syncNode from the command line to course correct your node agent.

It’s Official…

http://www.microsoft.com/en-us/news/Press/2012/Jun12/06-25MSYammerPR.aspx

We knew this was coming, but now they are out of the closet.  So… what will this mean for SharePoint social add-ons?  How will NewsGator and the others plan for the next 12mo?  I think it will be very interesting as there is clearly a statement here that is SharePoint is NOT social, and as such, Microsoft is making a purchase that will enable them to bridge that gap.

On a side note, it makes me feel that Connections’ message is more solid than ever.  As the MS partner ecosystem tries to figure out what the new Yammer + SharePoint will mean for them, IBM can continue to develop and evolve their solution just as they have been for quite a few years now.  Businesses can’t deny that IBM has what is obviously a market leader, and also a very mature and stable solution when compared to the new SP landscape.  This will be fun, for sure.

We CAN Move From SharePoint to IBM!

So I have not posted for a while, and for good reason.  I have been working almost exclusively with the same customer since November on a really cool project and it is finally reaching a point that I can talk about it… a bit.  We (Ascendant) partnered with IBM and T-Systems to bring to fruition a working content migration utility that can take content FROM SharePoint and populate it into Connections / Quickr / WCM.  (Yes… any or all of the three mentioned have a native connector for the utility from T-Systems now thanks to our project.)  Beyond just grabbing the content, transforming it, and then pushing it into the correct content area, we are able to maintain content ownership and impersonate other users at migration time without impacting those users.  This is truly a first of it’s kind solution to the best of my knowledge.  Hats off to the whole team we have been working with.  I know I am excited to be part of this, as I am sure most of the other team members are as well.  This brings real choice to the market as people now have the availability to move their content between platforms.

Thank You everyone that made this possible!