Deploy the Microsoft SharePoint On-Prem Connector

Microsoft Outlook message handling

When the connector encounters Microsoft Outlook .msg files as it indexes content, it overrides the media type for the files and indexes them as application/vnd.ms-outlook.

Multi-tenant configurations

If your SharePoint is a multi-tenant deployment, where multiple customer sites are hosted on the same Web application, you need to configure site collection mode in the configuration file. In multi-tenant deployments, you get permissions only for your site collection and can't get Full Read permissions, as required by the SharePoint On-Prem connector.

To enable site collection mode:

• Give the connector user account site collection administrator permissions.
• Set sharepoint.server in your connector configuration file to the site collection URL, such as http://sharepoint.example.com/sites/sitecollection. The URL doesn't need to use the exact same case as on SharePoint.
• Set sharepoint.siteCollectionOnly in your connector configuration file to true.

If you have multiple site collections to index in a multi-tenant environment, you need to configure one connector instance for each of the site collections.

Known connector limitations

• The time it takes the connector to detect changes to items in the databases increases with the number of databases the connector monitors.
• Memory consumption increases with the number of unique users and groups that you use in ACLs for each site collection.
• You can configure the connector with identities from only one Active Directory Domain.
• Some common Active Directory and Windows principals, such as Everyone, BUILTIN\Users, and All Authenticated Users, aren't supported.
• Delete notifications are not instantaneous and it can take more than 4 hours for a connector to recognize that a user deleted content from the source repository.

System requirements

Deploy the connector

Prerequisites

Step 2. Create the SharePoint On-Prem connector configuration file

Step 3. For HTTPS, add SharePoint as a trusted host

If SharePoint is configured to use HTTPS, get a SharePoint certificate to add it as a trusted host for the connector.

1. On the computer that will run the connector, open a browser and go to SharePoint.

2. In the warning page that opens, click I Understand the Risks and Add Exception. The page shows a message such as "This Connection is Untrusted" because the certificate is self-signed and not signed by a trusted Certificate Authority.

3. Once the View button is available, click it.

4. Go to the Details tab and click Export.

5. Save the certificate in the connector directory with the name sharepoint.crt.

6. Click Close then Cancel to close the windows.

7. Open a command prompt and enter the following command:

   $ keytool -importcert -keystore cacerts.jks -storepass changeit -file sharepoint.crt -alias sharepoint

   When prompted "Trust this certificate?", answer yes.

Step 4. Set up logging

1. In the directory that contains the connector binary, create a folder named logs.

2. In the same directory (not logs), create a Latin1-encoded file named logging.properties.

3. Add the following text to logging.properties:

   handlers = java.util.logging.ConsoleHandler,java.util.logging.FileHandler
   # Default log level
   .level = INFO
   # uncomment line below to increase logging level for SharePoint APIsa
   #com.google.enterprise.cloudsearch.sharepoint.level=FINE
   
   # uncomment line below to increase logging level to enable API trace
   #com.google.api.client.http.level = FINE
   java.util.logging.ConsoleHandler.level = INFO
   java.util.logging.FileHandler.pattern=logs/connector-sharepoint.%g.log
   java.util.logging.FileHandler.limit=10485760
   java.util.logging.FileHandler.count=10
   java.util.logging.FileHandler.formatter=java.util.logging.SimpleFormatter
   

Step 5. Configure the SharePoint On-Prem identity connector

This step is required to apply SharePoint On-Prem identity-based ACLs to search results. If you set up the connector with public ACLs, you can skip this step.

1. In the same directory as the SharePoint Online connector installation, create a file and name it sharepoint-onprem-identity-connector.config.

2. Add parameters as key/value pairs to the file contents, as in the following example:

   ### SharePoint On-prem identity connector configuration ###
   
   # Required parameters for data source access
   api.customerId=C05d3djk8
   api.serviceAccountPrivateKeyFile=service_account.json
   api.identitySourceId=08ef8becd116faa475de26d9b291fed9
   
   # Required parameters for SharePoint access
   sharepoint.server=http://sp-2016:32967/sites/doc-center-site-collection
   sharepoint.siteCollectionOnly=true
   sharepoint.username=contoso\\admin
   sharepoint.password=pa$sw0rd
   sharepoint.stripDomainInUserPrincipals=true
   
   # Required parameters for AD lookup
   adLookup.host=dc.contoso.com
   adLookup.username=contoso\\admin
   adLookup.password=pa$sw0rd
   api.referenceIdentitySources=CONTOSO,contoso
   api.referenceIdentitySource.contoso.id=08ef8becd116faa5d3783f8c5a80e5aa
   api.referenceIdentitySource.CONTOSO.id=08ef8becd116faa5d3783f8c5a80e5aa
   

   The values are almost the same as for the SharePoint On-Prem connector, except that instead of api.sourceId, the parameter is api.customerId. The value of api.customerId is the customer ID that you got from your Google Workspace admin.

Step 6. Launch the SharePoint On-Prem connector

In the following steps, you map the principals in both the on-premises Active Directory and the SharePoint site collection to identities in the Cloud Identity service. This synchronization is done with Google Cloud Directory Sync (GCDS) and the SharePoint On-Prem identity connector.

After GCDS synchronizes users and groups, to synchronize the SharePoint site collection groups, run the SharePoint On-Prem identity connector. Lastly, run the SharePoing On-Prem connector to index and serve results to your Cloud Search users.

Data source access

SharePoint on-premises access

Site collection indexing

SharePoint Identity Mapping

Active Directory Lookup

HTML content generation