Kerberos and SharePoint 2007 notes

Recently we had cause to do a whole lot of research ourselves and end up calling Microsoft to get our implementation vetted and troubleshot (it was not working – all or almost all connections that should have been Kerberos connections were degrading back to NTLM).

Here are the salient notes and facts about troubleshooting and achieving the ultimate goal (having Kerberos working with our systems).

MOSS 2007 – Setting up a Search Center as a subsite to a Team Site-based Site Collection

Creating a Search Center as a subsite Search Center for a Team Site site collection didn’t seem to create or properly hook up a People Search Results page within that Search Center for the People Search Scope. Doing a People search after having ONLY created a Search Center and set the Site Collection to use it for “richer results” comes up with an HTTP 404 error on the People Search results page.

Here’s how to create that full functional pipeline WITHOUT SharePoint Designer (to create the people search results page where SharePoint’s expecting it to be), thank you very much.

This may help you with defining additional site scopes and dedicated landing pages for their results too, assuming you also have a Search Center deployed.

WARNING: If you do this, you will end up renaming the Home tab in your horizontal nav bar to whatever your top level site’s name is, and the only way to get it back (short of SharePoint Designer) will be to disable the Office SharePoint Server Publishing Infrastructure feature at the Site Collection level. This may be okay with you and your users or not, depending on how much tweaking you intend to do through that feature/interface.

  1. (Optional) Create Site Collection with Team Site top level site. Do this if you just want to proof it out. Otherwise, if you already have a site collection you want to do this with, start at steps 2 or 3 below, depending on what you’re starting with.
    1. Do this operation in the Application Management tab of Central Administration.
    2. Under the SharePoint Site Management section, click the “Create site collection” link and follow the prompts from there.
  2. (Optional) Create Search Center Subsite (w/o Tabs). This assumes you haven’t already got a Search Center subsite or site collection to work with.
    1. Do this operation within the top level site you just created. This may work in other contexts too, but I have not tested those.
    2. Choose the “Search Center” option under the Enterprise tab when choosing a site definition.
    3. I chose not to list the subsite in the Quick Launch, but I did choose to list it in horizontal navigation and to use the parent site’s horizontal navigation. If you choose different settings, know these may affect your site collection’s behavior.
  3. Assign Search Center as Search Center target for top level site.
    1. Do this operation within the top level site you just created.
    2. Go to Site Actions -> Site Settings, then click Search settings under the Site Collection Administration section all the way to the right.
    3. Provide the path starting with the end of the FQDN to the search center’s simple URL (e.g. if the top level site iat, then input /sites/tls/sc into the textbox.
    4. Click OK button.
  4. NOTE: If you’re starting with the same assumptions I am and you test the People search scope now, you should receive a 404 error, regardless of whether your crawls are working. This indicates the lack of a proper results web part page for the results to go into.
  5. Enable Office SharePoint Server Publishing Infrastructure Feature and Office SharePoint Search Web Parts Feature (not entirely sure this is required) on Site Collection.  (Enabling the first feature here will change your Home Tab in horizontal navigation to the Top Level site name.)
    1. From top level site, choose Site Actions -> Site Settings.
    2. In Site Collection Administration section, click the “Site collection features” link.
    3. Click “Activate” button to right of Office SharePoint Server Publishing Infrastructure Feature item.
    4. Click “Activate” button to right of Office SharePoint Server Search Web Parts Feature item.
  6. (Optional) If you don’t want the potentially confusing changes to the Site Actions menu to impact the top level site, immediately disable the Office SharePoint Server Publishing Feature on the top level site.
    1. In the top level site, go to Site Actions->Site Settings->Modify All Site Settings.
    2. Under the Site Administration (NOT the Site Collection Administration) section, click the “Site Features” link.
    3. Click the “Deactivate” button to the right of the Office SharePoint Server Publishing Feature item.
  7. (Optional) Enable Office SharePoint Server Publishing Feature on Search Center Site. You may not have to do this, as it may be auto-enabled when the Site Collection Features are enabled. An easy way to tell whether this feature is activated on a site or subsite is by looking at the Site Actions menu. If it’s just 2 or 3 items (depending on the page you access it from): Create, sometimes Edit Page, and Site Settings, then you know this feature is not enabled. If instead it’s a huge menu with multiple fly-out submenus, then you know the feature is already enabled on that site.
    1. Go to Search Center site.
    2. Click Site Actions -> Site Settings and in Site Administration section, click Site features link.
    3. Click “Activate” button to right of Office SharePoint Server Publishing Feature.
  8. Create new page in Search Center for People Search Results.
    1. Click Site Actions -> Create Page
    2. Create a page called peoplesearchresults.aspx. Save it where the dialogue lets you save it. Probably Pages/*.aspx.
    3. Choose the “(Welcome Page) Blank Web Part Page” Page Layout.
    4. Click “Create” button.
  9. Add appropriate People Search result web parts to new page.
    1. On created page, if not already in page edit mode, choose Site Actions -> Edit Page
    2. Add appropriate web parts, put them on the page in appropriate places and modify their web part settings to suit. I chose:
      • Header: People Search Box
      • Center: Search Statistics, Search Paging [1], Search High Confidence Results, People Search Core Results, Search Paging [2]
      • Center Right: Search Best Bets
    3. Click Publish button to finalize edits to web part page.
  10. Edit Search Scopes on Site Collection.
    1. Go to your top level site.
    2. Choose Site Actions -> Site Settings.
    3. In the Site Collection Administration section, click “Search scopes” link.
  11. Copy “People” Search Scope (default) to a copy for the Site Collection.
    1. Use drop-down menu on “People” Search Scope and choose “Make Copy”
  12. Edit the “Copy of People” Search Scope to set proper results page URL and change name (can’t just be “People” as that name’s already taken).
    1. Use drop-down menu on Copy of People and choose “Edit Properties”.
    2. Click “Change scope settings” link on next page.
    3. Change Title to something descriptive that isn’t “People”.
    4. Enable or Disable the Display groups you want for this scope.
    5. Specify the target results page you just created. Start relative url at the search center’s root. So if, for example, the search center is at and your results page ias at, use the value “/Pages/peoplesearchresults.aspx” in the Target results page textbox.
    6. Click the “OK” button.
  13. Remove default “People” Search Scope from Site’s selectable scopes.
    1. Go to the Search Scopes settings page in the top level site (Site Actions -> Site Settings -> Site Collection Administration -> Search Scopes)
    2. If you’re using default Display Groups, you should have “Search Dropdown” and “Advanced Search”
    3. For each display group click the hyperlinked name of the group in the grey bar, labelled “Display Group” (e.g. for Search Dropdown, click the hyperlinked Search Dropdown in the phrase “Display Group: Search Dropdown (3)” (or some other number) in the grey title bar just above the list of scopes active for that display group).
    4. In the Edit Scope Display group page, uncheck the Display checkbox to the left of the People scope name.
    5. Click the OK button.
    6. Repeat this for any other applicable Display Group you have in Search Scopes.
  14. Let your crawls happen. The settings you made won’t be reflected in your sites until after the next crawl. If you have access to the SSP, you can reinitiate crawls to try to rush the process and make it happen immediately.
  15. Retest. Hopefully you’re all hooked up now.
  16. If everything is hooked up and you don’t want the publishing infrastructure and you want your Home tab back, you can now disable the Site Collection feature.
    1. Go to your top level site. Go to site settings (Site Actions -> Site Settings).
    2. Under the Site Collection Administration section, click the “Site collection features” link.
    3. Click the “Deactivate” button to the right of the Office SharePoint Server Publishing Infrastructure Feature.

If not, don’t come crying to me!

Actually, I’ll be happy to try to help, but keep in mind that I don’t have a lot of spare time.

MOSS 2007 server farm architecture links

All in all, it looks like MOSS 2007 server farms consist of:

  1. Front End Web Servers – (low storage, hosting IIS, SharePoint and any custom web parts/custom site definitions/templates – this is a guess)
  2. Application Servers – (high storage, hosing IIS, SharePoint and indexes for search – again a guess)
  3. Database Server – (hosting the content and configuration databases)

Sounds like MOSS 2007 is in general way more flexible and configurable in Server Farms than SPS 2003 (with its three major themes of “supported configurations”).

Don’t miss all the planning you should be doing vis a vis Server Farm Architecture as you design your environments:
Planning worksheets for Office SharePoint Server 2007

Also, the configurations of the Shared Service Provider(s) give you a lot of flexibility.

Unfortunately, it looks like most of the Technet articles are still TBD (to be written), but I found one that was decent:
Determine hardware and software requirements (Office SharePoint Server)

Also, my Systems Engineer homie at my workplace sent me a lot of very interesting seeming audio-briefing links:
TechNet Events: Supporting Materials

Creating new My Site hosts for MOSS 2007

If you should happen to recreate your SSP or your MySite host in MOSS 2007, you may find that the wizard that helped you out the first time with properly configuring your MySites host may have flown the coop and you’re left at sea about how to proceed. I know I was.

On trying to create a new My Site (for a user that doesn’t already have one), typical error messages will tell you that Self-Service Site Creation is disabled, or that there was an error in creating your personal site. Both error messages will entreat you to contact your administrator.

Here’s the full scoop on creating a My Site host in MOSS 2007 by hand from the ground up (i.e. at Web application creation on up):

Prepare new web application to take up My Site host duties:

  1. Create a new web application (e.g. http://mossdev1:25000/)
  2. Inspect Managed Paths for the new web application. You should already have:
    1. (root) - Explicit inclusion
    2. sites - Wildcard inclusion
  3. Delete managed paths:
    1. sites - Wildcard inclusion
  4. Create managed paths:
    1. personal - Wildcard inclusion
    2. mysite - Explicit inclusion
  5. End state for managed paths should be:
    1. (root) - Explicit inclusion (thanks to imsaurabh for catching this!)
    2. personal - Wildcard inclusion
    3. mysite - Explicit inclusion
  6. Create a site collection at /mysite/ managed path. This will use a My Site Host template:
    1. Choose correct web application (e.g. http://mossdev1:25000/)
    2. Title: My Site Host (doesn’t matter, really)
    3. URL: http://mossdev1:25000/mysite (no fill-in because path is explicit in managed paths)
    4. Template: Enterprise (tab) -> My Site Host
    5. Specify primary and secondary administrators.
    6. Click OK.
  7. Create a blank site collection at the / managed path to enable self-service site creation:
    1. Choose correct web application (e.g. http://mossdev1:25000/)
    2. Title: Blank site (doesn’t matter, really)
    3. URL: http://mossdev1:25000/ (no fill-in because path is explicit in managed paths)
    4. Template: Collaboration (tab) -> Blank Site
    5. Specify primary and secondary administrators.
    6. Click OK.
  8. Enable Self-Service Management. Choose from Application Management -> Application Security.

Now that you’ve created the host, here’s how to make sure it works properly in the SSP’s My Site Settings:

  1. Navigate to My Site Settings (go to your SSP’s admin pages, it’s the 3rd link in the 1st section).
    1. For form’s sake, inspect the Preferred Search Center entry. This URL should end in /SearchCenter/Pages/.
    2. Set Personal Site Services to http://mossdev1:25000/mysite/. Note that this points to the URL for the explicit inclusion path and My Site Host Template site collection you created above.
    3. Set Personal site Location into just personal. Note that this points to the URL (after SharePoint puts context to it) for the Wildcard inclusion managed path you created above.
    4. Choose the 2nd Site Naming Format: User name (resolve conflicts by using domain_username).
    5. Enable Allow user to choose the language of their personal site.
    6. Disable My Site to support global deployments.
    7. Default Reader Site Group: NT AUTHORITY\authenticated users.

Now try to navigate to your MySite link and you should be golden. Creation should go just fine.

Good luck!