Switching to SSL

[Brian Tkatch]

Project Server 2003 SP 2a.

Anything i should know about changing Project Server to use SSL?

Our servers have been running for some time, but now i have been
tasked with adding an SSL certificate and forcing access to be https.
The certificate will be supplied to me, and it's ok if the intranet
Project users connect to port 80. But externally, that is from the
Internet, the connection to PWA must be port 443.

I am curious what is involved, and if there are any pitfalls.Or if
complicated, if there is a guide.

B.

 

[John Sitka]

I'm going through this right now.
I believe the switch to https:// is faily easy, it's in this groups archives for sure. (I'll look)

The Microsoft recommendation is to install an additional Project Server in the DMZ
and point it to the SQL Data on the existing http server. This install is described in the Administrator
or install guides in detail.

I'm currently trying to utilize Microsoft ISA server to accomplish the same end result, because then we
will have an ISA server in place to handle other enterprise concerns beyond PWA. So far it has gone
resonably well. I can get authentication via https:// to the ISA server which then allows access to the
http:// bound internal project server. This is accomplished through what is called https:// to http:// bridging.
However all does not run smooth yet. I believe the active X chart controls which provide much of the
content in PWA are not liking the name (URL) or protocol transformations.

Remember there are two core components that need to be resolved for external access to work, naming and security.

How would an external client resolve a internal server name or link contained in the dynamically built content
of PWA? ISA handles this link translation on the fly fairly well. (except for the link to the Project workspace.)

Do you want to open the port to all traffic and then have that traffic authenticate against Project server,
or do you want the firewall to be the traffic autority of who gets the opportunity to talk to the Project web server.

 

[Brian Tkatch]

I'm going through this right now.
I believe the switch to https:// is faily easy, it's in this groups archives for sure. (I'll look)

The Microsoft recommendation is to install an additional Project Server in the DMZ
and point it to the SQL Data on the existing http server. This install is described in the Administrator
or install guides in detail.

I'm currently trying to utilize Microsoft ISA server to accomplish the same end result, because then we
will have an ISA server in place to handle other enterprise concerns beyond PWA. So far it has gone
resonably well. I can get authentication via https:// to the ISA server which then allows access to the
http:// bound internal project server. This is accomplished through what is called https:// to http:// bridging.
However all does not run smooth yet. I believe the active X chart controls which provide much of the
content in PWA are not liking the name (URL) or protocol transformations.

Remember there are two core components that need to be resolved for external access to work, naming and security.

How would an external client resolve a internal server name or link contained in the dynamically built content
of PWA? ISA handles this link translation on the fly fairly well. (except for the link to the Project workspace.)

Do you want to open the port to all traffic and then have that traffic authenticate against Project server,
or do you want the firewall to be the traffic autority of who gets the opportunity to talk to the Project web server.

We have the server itself behind a firewall, and SiteMinder will be
policing security. Our internal server is to get an external name as
well, so we'll the outside world can resolve it's ip.

Thanx for the information. I did not realize this was in the Admin
guide.

B.

 

[John Sitka]

here's a link..
http://groups.google.ca/group/micro...7?lnk=gst&q=ssl&rnum=3&hl=en#fe1a54e018ac88a7

you are lucky to be in an environment where secure publishing is understood, all I get is blank stares,
and asked what port do you want open.

 

[Brian Tkatch]

here's a link..
http://groups.google.ca/group/micro...7?lnk=gst&q=ssl&rnum=3&hl=en#fe1a54e018ac88a7
Thanx!

you are lucky to be in an environment where secure publishing is understood, all I get is blank stares,
and asked what port do you want open.

It is understood by the group that needs to understand it.
Unfortunately, that's where it ends too.

B.