Set permission to a published service application (SharePoint Foundation 2010)

 

Applies to: SharePoint Foundation 2010

In Microsoft SharePoint Foundation 2010, you must establish a relationship between the publishing farm and the consuming farm by giving the consuming farm permission to the Application Discovery and Load Balancer Service Application on the publishing farm. After doing this, the consuming farm can be given permission to other service applications. This article describes how to configure permissions to the Application Discovery and Load Balancer Service Application and published service applications for the consuming farm.

Important

Before you start to configure publishing and consuming farms, we highly recommend that you read the articles Share service applications across farms (SharePoint Foundation 2010) and Services architecture planning (SharePoint Foundation 2010).

In this article:

• Set permission to the Application Discovery and Load Balancer Service Application and any other service application for a consuming farm by using Windows PowerShell

• Set permission to the Application Discovery and Load Balancer Service Application and any other service application for a consuming farm by using Central Administration

Important

You must perform steps 1 through 5 in the Windows PowerShell procedure to obtain the consuming farm ID, which you must have in order to complete either the Windows PowerShell or Central Administration procedures.

Set permission to the Application Discovery and Load Balancer Service Application and any other service application for a consuming farm by using Windows PowerShell

The first procedure explains how to set permission to the Application and Load Balancer Service Application. The second explains how to set permissions to any other service applications.

To set permission to the Application Discovery and Load Balancer Service Application for a consuming farm by using Windows PowerShell

1. Verify that you meet the following minimum requirements: See Add-SPShellAdmin.

2. On a server in the consuming farm, on the Start menu, click All Programs.

3. Click Microsoft SharePoint 2010 Products.

4. Click SharePoint 2010 Management Shell.

5. At the Windows PowerShell command prompt, type the following command:

   Get-SPFarm | Select Id
   

   For more information, see Get-SPFarm.

6. On a server in the publishing farm, access the SharePoint 2010 Management Shell and at the Windows PowerShell command prompt, type the following commands:

   $security=Get-SPTopologyServiceApplication | Get-SPServiceApplicationSecurity
   
   $claimprovider=(Get-SPClaimProvider System).ClaimProvider
   
   $principal=New-SPClaimsPrincipal -ClaimType "https://schemas.microsoft.com/sharepoint/2009/08/claims/farmid" -ClaimProvider $claimprovider -ClaimValue <consumingfarmid>
   
   Grant-SPObjectSecurity -Identity $security -Principal $principal -Rights "Full Control"
   
   Get-SPTopologyServiceApplication | Set-SPServiceApplicationSecurity -ObjectSecurity $security
   

   Where:

   Consumingfarmid is the GUID value of the consuming farm

   For more information, see the following:

   • Get-SPTopologyServiceApplication

   • Set-SPServiceApplicationSecurity

   • Get-SPServiceApplicationSecurity

   • New-SPClaimsPrincipal

   • Get-SPClaimProvider

   • Grant-SPObjectSecurity

To set permission to a published service application for a consuming farm by using Windows PowerShell

1. At the Windows PowerShell command prompt, type the following commands:

   $security=Get-SPServiceApplication <GUID>| Get-SPServiceApplicationSecurity
   
   $claimprovider=(Get-SPClaimProvider System).ClaimProvider
   
   $principal=New-SPClaimsPrincipal -ClaimType "https://schemas.microsoft.com/sharepoint/2009/08/claims/farmid" -ClaimProvider $claimprovider -ClaimValue <consumingfarmid>
   
   Grant-SPObjectSecurity -Identity $security -Principal $principal -Rights <NamedAccessRights>
   
   Set-SPServiceApplicationSecurity <GUID> -ObjectSecurity $security
   

   Where:

   Consumingfarmid is the GUID value of the consuming farm

   <GUID> is the ID of the published service application.

   <NamedAccessRights> is the name of the access right from the Get-SPServiceApplicationSecurity <GUID>.NamedRights.

For more information, see the following:

• Get-SPServiceApplication

• New-SPClaimsPrincipal

• Get-SPServiceApplication

• Get-SPServiceApplicationSecurity

• Grant-SPObjectSecurity

• Set-SPServiceApplicationSecurity

Set permission to the Application Discovery and Load Balancer Service Application and any other published service application for a consuming farm by using Central Administration

This procedure explains how to set permission to any service application, but most specifically, the Application and Load Balancer Service Application.

Important

You must perform steps 1 through 5 in the Windows PowerShell procedure to obtain the consuming farm ID, which you must have in order to complete this procedure.

To set permission to the Application Discovery and Load Balancer Service Application and any other published service application for a consuming farm by using Central Administration

1. On the server that hosts the Central Administration Web site for the publishing farm, verify that the user account that is performing this procedure is a member of the Farm Administrators SharePoint group.

2. On the SharePoint Central Administration Web site, click Application Management, and then click Manage service applications.

3. Click the row that contains Application Discovery and Load Balancer Service Application.

4. On the ribbon, click Permissions.

5. In the Connection Permissions dialog box, do the following:

   1. Manually paste the ID of the consuming farm from Step 5 of the Windows PowerShell section.

   2. Click Add.

   3. Select the consuming farm ID, and then select the Full Control check box.

   4. Click OK.

6. Repeat steps 2 through 5 for any published service applications for which you want to enable access from the consuming farm and assign the necessary permission.