SharePoint 2010: Business Connectivity Services - The Secure Store Service (part 1) - Configuring the Secure Store Service

The Secure Store Service is used to store accounts inside SharePoint to use when authorizing against databases that require authorization, etc. It typically stores credentials in the form of username and password, but it can also store tokens, pin numbers, etc.

The Secure Store Service application works by a scheme being defined providing authentication information. Then the user- or group-level permissions to pass to the database are mapped in the Secure Store application. The Secure Store Service allows connections using the federation, delegation, or impersonation level. In cases of Business Connectivity Services, the mapped credentials are passed from the Secure Store to the data source.

1. Configuring the Secure Store Service

In this section and the ones that follow, we will go through the procedure of configuring the Secure Store Service, while explaining the individual steps and configuration options. The first step is to ensure that the Secure Store Service is started:

1. Navigate to Central Administration => Manage Service on Server (Figure 1).

2. Locate the service called Secure Store Service.

3. If the Secure Store Service is not started, then start it.

Figure 1. Services overview

With the Secure Store Service started, it is now possible to provision a Secure Store Service application as follows:

1. Navigate to Central Administration => Manage Service Application (Figure 2).

2. Click the New button on the ribbon.

3. Click Secure Store Service to open the dialog for creating the new service application.

Figure 2. Provisioning the Secure Store Service application

The Create New Secure Store Service Application dialog (Figure 3) allows administrators to specify a database where the credentials are stored. The credentials are encrypted and accessible by the Secure Store Service application. To create the Secure Store Service, do the following:

1. Enter a unique service name.

2. Specify the database instance name where the Secure Store database will be created. Also specify a name for the Secure Store database.

3. Choose or create an application pool identity, which the Secure Store Service application will run under. It is suggested to use a unique account for this particular service application for security reasons.

4. Click OK. The Secure Store Service application and proxy should now be created.

Figure 3. Provisioning the Secure Store Service application

With the new Secure Store Service application created, it must be configured with a pass phrase (Figure 4) that allows it to securely encrypt and decrypt the stored credentials from the database.

1. Click the Secure Store Service application to begin configuring it.

2. If it is the first time the Secure Store Service application is being configured, a prompt will appear, asking for a new key to be generated. Click Generate New Key on the ribbon.

3. Enter a pass phrase, and click OK.

Figure 4. Secure Store Service key generation