MOSS Single Sign On Setup Step-By-Step SharePoint

With a TechNet article titled "Configure single sign-on (Office SharePoint Server)" one might wonder why I'd feel the need to write a blog post on how to setup Single Sign-On. The answer is that the TechNet article is incomplete (as of this publishing) and obtuse. So my hope is to walk through the process with screen shots so that you can see exactly what to setup and what the values should be.
There are seven main activities that we need to do:
  1. Create the SSO service account -- This is the account that the service will run under.
  2. Create the SSO groups -- These groups are used to control who has the ability to administer SSO (export the master key) and who has the ability to manage it (add/remove application definitions.)
  3. Configure the SSO Service - Set SSO to start and get it to use the service account.
  4. Configure SQL Server - Authorize the SSO service account to SQL server.
  5. Manage SSO - Setup SSO in MOSS including the groups and the database.
  6. Manage the encryption key -- Create the encryption key that will be used for protecting the username and password information on the system.
  7. Manage settings for enterprise application definitions -- Define what initial applications SSO will be setup to manage passwords for.
In each of the next sections, I'll walk you through dialog-by-dialog what you need to select and what to do in order to get a working setup.

Create the SSO Service Account 

 

We need to create an account for the "Microsoft Single Sign-on Service" (SSO Service) to run as. This account has to be a domain account that has local administrative privileges for the front end web servers, must be a member of the SharePoint group Farm Administrators, must have db_creator and security administrator roles in SQL Server, and must be a member of the group that is defined as SSO administrators. Obviously this is a few requirements. We'll work on the getting this account and the appropriate groups setup over the next several major steps. In this section we'll concentrate on getting the account setup.
In the following steps I'm going to add the user to the Domain Admins group in order to get the local administrator privileges requirement met. If you are working on a production installation, I'd recommend creating a group for SharePoint Farm Administrators and add that group to the local administrators group of each of the front end web servers -- as well as the index server. If you do this, use your farm administrators group rather Domain Admins in the steps below.
Let's get started.
  1. From the Start Menu click Administrative Tools-Active Directory Users and Computers
  2. In the left hand pane on the Users folder right click and select New-User from the menu that appears. If your organization places service accounts in a different organizational unit (OU) you can certainly add this account to that location.
  3. Enter the First Name (SharePoint SSO), Last Name (Service), and User logon name (SharePointSSOSvc) fields and click the Next button. You can name the account anything you want, however, these values make it clear what the account is used for.
  4. Enter the a password into the Password and Confirm password fields. Uncheck the User must change password at next logon checkbox. Check the User cannot change password and Password never expires checkboxes. Click the Next button. This sets the account up to be a service account.
  5. Click the Finish button.
  6. On the user that was just created, right click and select Properties.
  7. Click the Member Of tab.
  8. Click the Add button
  9. Enter the group name Domain Admins and click Check Names then click OK. As mentioned above, if you're using another group to provide local administrator access to the farm servers, use that group here.
  10. Click the OK button.
With the user account created and added to a group that will have administrative access to the farm servers. Next we need to create the groups that we'll add the users capable of managing SSO into.

Create the SSO Groups

There are two important groups for SSO. The first group is the administrative group which includes those users capable of administering SSO. This includes the ability to backup and restore the encryption key -- because of this they can effectively decrypt all user credentials in the SSO database and thus membership to this group should be severely limited. The second group, a managers group, is used to manage the application profiles in the SSO system. This group doesn't directly have access to passwords but could inadvertently delete all of the stored passwords. In the following steps we'll create both groups and add the SSO service account we created above into the administrators group.
  1. In Active Directory Users and Computers (still open from the last set of steps) from the left pane right-click Users and select New-Group. As before if your organization requires that groups be placed in a different OU, select that OU to create group in.
  2. Enter the Group Name (SharePoint SSO Administrators) and click the OK button.
  3. Left click the new group, and then right click the new group and select Properties.
  4. Click the Members tab.
  5. Click the Add button.
  6. Enter SharePointSSOSvc, click the Check Names button, and click the OK button.
  7. Click the OK button.
  8. In the left pane, right click Users and select New-Group. As before, if your organization requires a different location, use that location.
  9. Enter the Group Name (SharePoint SSO Managers) and click the OK button.
  10. Close Active Directory Users and Computers, we're done with it.
With the groups created we're ready to configure the service to automatically start.

Configure the SSO Service

By default the SSO service in SharePoint doesn't start. In this activity we're going to enable the SSO service. On each server in the farm and then once completed we're going to change the account used for SSO in SharePoint Central Administration.
Let's start by setting the service to start automatically and manually starting it.
  1. On the Start menu click Administrative Tools-Services
  2. In the Services application in the right hand pane scroll down to the Microsoft Single Sign-on Service, right click and click Properties.
  3. Change the Startup type from Manual to Automatic.
  4. Click the Start button.
  5. Click the OK button.
  6. Close the Services application. We're done with it.
  7. Repeat steps 1-5 on each server in the SharePoint farm.
  8. On the Start menu click Administrative Tools-SharePoint 3.0 Central Administration

More Here


Courtesy:http://www.thorprojects.com/blog/archive/2008/08/02/moss-single-sign-on-setup-step-by-step.aspx