Configuring the Secure Store Service
The Secure Store Service (SSS) maintains an encrypted database that maps the identities of SharePoint users, groups, or process accounts to the external credentials required to access external systems. When the Business Data Catalog (BDC) needs to impersonate external credentials to access a data source, it passes the identity of the caller to the SSS. The SSS then returns the external credentials that are mapped to the identity of the caller.
Within the SSS, credentials mappings are organized by target applications. A target application represents an external system or data source, and includes a unique target application ID. When the BDC requests a set of credentials from the SSS, it specifies the target application ID so that the SSS knows which credential mapping to retrieve.
In the external list reference implementation, we created a target application to represent the Vendor Management system. Within this target application, we mapped the identity of the user code proxy service to the external credentials required to access the Vendor Management system. To enable users to access the external lists from outside a sandboxed application, we also mapped individual user identities to the external credentials required to access the Vendor Management system. This is illustrated by the following diagram.
Configuring a target application in the Secure Store Service
.png "Ff798456.5fee9541-0c5c-44c0-9f8b-29a5145b228a(en-us,PandP.10).png")
In the external list reference implementation, the install script configures the SSS and creates a target application that you can use. If you want to create your own target application, you can use the following procedure.
To create a target application in the Secure Store Service
In the Central Administration Web site, click Application Management, and then click Manage Service Applications.
On the Manage Service Applications page, click Secure Store Service.
On the ribbon, in the Manage Target Applications section, click New.
On the Create New Secure Store Target Application page:
- Set the Target Application ID to SPGVM.
- Set the Display Name to SPG Vendor Management Application.
- Provide a contact e-mail address.
- Under Target Application Type, select Group as shown in the following illustration. Click Next.
.png "Ff798456.1ff9e6ac-4906-4d21-a1c3-6c1f49f07ff6(en-us,PandP.10).png")
Note
Note: A target application type of Group indicates that you want to map multiple identities to a single set of credentials.
On the next page, leave the credential fields set to Windows User Name and Windows Password, and then click Next.
On the next page, in the Target Application Administrators text box, add your administrative account.
In the Members text box, add the user code proxy service account and any user accounts or groups that require access to the external system, and then click OK. See the following illustration.
.png "Ff798456.b1a5e9e7-c92e-449b-9a4d-1414bdca67ed(en-us,PandP.10).png")
On the Secure Store Service page, on the SPGVM drop-down list, click Set Credentials, as shown in the following illustration.
.png "Ff798456.98d29662-b91c-4734-830b-7a2a38db3f32(en-us,PandP.10).png")
On the Set Credentials for Secure Store Target Application page, provide the credentials that are required to access the external system, and then click OK.
.png "Ff798456.cb27eeb3-1104-4d76-be3f-7d012b490f7f(en-us,PandP.10).png")