Manage external systems (SharePoint Foundation 2010)
적용 대상: SharePoint Foundation 2010
마지막으로 수정된 항목: 2016-11-30
An external system is a source of data, such as a Web service, SQL Server database, other relational database, or a custom connector, that can be used in a solution. An instance of an external system includes connection and authentication information for a specific instance of an external system. There can be one or more instances of an external system for any external system. Configuring multiple external system instances allows the solution designer to set different security parameters on external data connections to support multiple ways to connect to the same external system. However, in many applications, a single external system instance is all that is needed.
In this article:
Set permissions on an external system
View all external systems for a Business Data Connectivity service application instance
Delete an external system
View the external content types of an external system
Configure an external system
Configure an instance of an external system
Set permissions on an external system
You set permissions on an external system to specify who can edit it, who can execute operations (such as read or update) on external content types stored at the external system, who can create external lists using the data that is stored in the external system, and who can set permission on it.
We recommend that you give specific permissions to each user or group that needs them, in such a way that the credentials provide the least privilege necessary to perform the needed tasks. For more information about setting permissions, see Business Connectivity Services 사용 권한 개요 in "Business Connectivity Services security overview (SharePoint Foundation 2010)".
To set permissions on an external system
Verify that you have one of the following administrative credentials:
You must be a farm administrator.
You must be an administrator of the Business Data Connectivity 서비스 application and have Set Permissions permission on the external system.
On the Central Administration Web site, in the Application Management section, click Manage service applications.
Click in the Name column of the row that corresponds to the Business Data Connectivity 서비스 application.
In the View group of the ribbon, click External Systems.
Click the check box of the external system for which you want to set permissions.
In the Permissions group of the ribbon, click Set Object Permissions.
In the box, type the user accounts, groups, or claims for which permissions will be granted, and then click Add.
참고
The user account, group, or claim cannot have a vertical bar (|) in its name.
Set the permissions for the account, group, or claim:
참고
At least one user, group or claim in the metadata object's access control list must have the Set Permissions permission.
Click Edit to allow the user, group, or claim to edit the external system.
.gif "보안 참고 사항")
Security NoteThe Edit permission should be considered highly privileged. With the Edit permission a malicious user can steal credentials or corrupt a server farm. To help ensure a secure solution, we recommend using a test environment where the Edit permission can be assigned freely to developers and solution designers. When you deploy the tested solution to a production environment, remove the Edit permissions. Click Execute to allow the user, group, or claim to execute operations (create, read, update, delete, or query) on external content types that are stored at the external system.
팁
The Execute permission is not applicable to the external system itself. This setting is used when you want to propagate the Execute permission to child objects (such as external content types) in the external system.
Click Selectable In Clients to allow the user, group, or claim to create external lists of any external content types whose data is stored at the external system and to view the external content types in the external item picker.
팁
The Selectable In Clients permission is not applicable to the external system itself. This setting is used when you want to propagate the Selectable In Clients permission to child objects (such as external content types) in the external system.
Click Set Permissions to allow the user, group, or claim to set permissions on the external system.
Security NoteThe Set Permissions permission should be considered highly privileged. With the Set Permissions permission, a user can grant Edit permission to the external system.
To propagate permissions to all items nested in the external system, click Propagate permissions to all External Content Types that belong to this External System. Doing so will overwrite existing permissions.
View all external systems for a Business Data Connectivity service application instance
View the external systems in the Business Data Connectivity 서비스 application to choose an external system before configuring it or to perform some other operation.
To view all external systems for a Business Data Connectivity service application instance
Verify that you have the following administrative credentials:
- You must be a farm administrator or an administrator of the service application.
On the Central Administration Web site, in the Application Management section, click Manage service applications.
Click in the Name column of the row that corresponds to the Business Data Connectivity 서비스 application.
In the View group of the ribbon, click External Systems.
Delete an external system
Delete an external system to remove it from the metadata store.
참고
You cannot delete an external system that contains external content types in the metadata store. To delete the external system, you must first delete all external content types that it contains.
To delete an external system
Verify that you have one of the following administrative credentials:
You must be a farm administrator.
You must be an administrator of the Business Data Connectivity 서비스 application and have Edit permission on the external system.
On the Central Administration Web site, in the Application Management section, click Manage service applications.
Click in the Name column of the row that corresponds to the Business Data Connectivity 서비스 application.
In the View group of the ribbon, click External Systems.
Point to the external system, click the arrow that appears, and then click Delete.
View the external content types of an external system
External systems make external data available using external content types. You can view all the external content types associated with an external system.
To view the external content types of an external system
Verify that you have the following administrative credentials:
- You must be a farm administrator or an administrator of the service application.
On the Central Administration Web site, in the Application Management section, click Manage service applications.
Click in the Name column of the row that corresponds to the Business Data Connectivity 서비스 application.
In the View group of the ribbon, click External Systems.
Point to the external system, click the arrow that appears, and then click View External Content Types.
Configure an external system
You can configure some settings of an external system by using the Business Data Connectivity 서비스.
To configure an external system
Verify that you have one of the following administrative credentials:
You must be a farm administrator.
You must be an administrator of the Business Data Connectivity 서비스 application and have Edit permission on the external system.
On the Central Administration Web site, in the Application Management section, click Manage service applications.
Click in the Name column of the row that corresponds to the Business Data Connectivity 서비스 application.
In the View group of the ribbon, click External Systems.
팁
The only external systems that are configurable in the Business Data Connectivity 서비스 are Windows Communication Foundation (WCF) Web services.
Point to the external system, click the arrow that appears, and then click Settings.
Edit or view the settings.
If the external system is a WCF Web service, the following settings are available:
Field Notes Metadata Exchange URL
The full Web address of the Web service description language (.wsdl) file of the Web service.
Metadata Exchange Discovery Mode
The protocol to use for discovering web service metadata:
Disco: the Business Data Connectivity 서비스 uses the DiscoveryClientProtocol (equivalent to wsdl.exe ) to download the metadata.
MetadataExchange: the Business Data Connectivity 서비스 uses WS-Transfer (equivalent to svcutil /mex) to download the metadata.
CustomProxy: the Business Data Connectivity 서비스 does not attempt to discover the service. When this option is used, the user must provide Address, Binding and Contract for the service.
WSDL Authentication Mode
The default way that incoming credentials are passed to the Web service.
Five choices are available:
Mode Description User’s Identity
Uses the credentials of the logged on user to authenticate to the Web service.
This mode is called PassThrough in the BDC model file.
BDC Identity
Uses the application pool account under which the Business Data Connectivity 서비스 is running to authenticate the logged on user to the Web service.
This mode is called RevertToSelf in the BDC model file.
Impersonate Custom Identity
For Web services that use basic authentication instead of Windows authentication.
Uses the Secure Store Service to map the user’s credentials to the individual or group credentials that are used by the Web service.
This mode is called Credentials in the BDC model file.
Impersonate Windows Identity
For Web services that use Windows authentication.
Uses the Secure Store Service to map the user’s credentials to the individual or group credentials that are used by the Web service.
This mode is called WindowsCredentials in the BDC model file.
Impersonate Custom Identity - Digest
For Web services that use digest authentication instead of Windows authentication. Uses the Secure Store Service to map the user’s credentials to the individual or group credentials that are used by the Web service.
This mode is called DigestCredentials in the BDC model file.
Secure Store WSDL Target Application ID
For Impersonate Custom Identity, Impersonate Windows Identity, and Impersonate Custom Identity-Digest authentication, the target application identifier for this Web service, as configured in the Secure Store Service.
Secure Store Implementation
If you are providing a custom secure store provider, specify the fully qualified assembly name of the provider. Otherwise, leave this field empty.
Click OK.
Configure an instance of an external system
There can be one or more instances of an external system for any external system. Configuring multiple external system instances allows the solution designer to set different security parameters on external data connections to support multiple ways to connect to the same external system.
To configure an instance of an external system
Verify that you have one of the following administrative credentials:
You must be a farm administrator.
You must be an administrator of the Business Data Connectivity 서비스 application and have Edit permission on the external system.
On the Central Administration Web site, in the Application Management section, click Manage service applications.
Click in the Name column of the row that corresponds to the Business Data Connectivity 서비스 application.
In the View group of the ribbon, click External Systems.
Click the external system to view its instances.
팁
The only instances of external system types that are configurable by default are databases and WCF Web services.
Point to the external system instance, click the arrow that appears, and then click Settings.
Edit or view the settings.
If the external system is a WCF Web service, the following settings are available:
Field Description Authentication Mode
The way that incoming credentials are passed to the Web service.
Five choices are available:
Mode Description User’s Identity
Uses the credentials of the logged on user to authenticate to the Web service.
This mode is called PassThrough in the BDC model file.
BDC Identity
Uses the application pool account under which the Business Data Connectivity 서비스 is running to authenticate the logged on user to the Web service.
This mode is called RevertToSelf in the BDC model file.
Impersonate Custom Identity
For Web services that use basic authentication instead of Windows authentication.
Uses the Secure Store Service to map the user’s credentials to the individual or group credentials that are used by the Web service.
This mode is called Credentials in the BDC model file.
Impersonate Windows Identity
For Web services that use Windows authentication.
Uses the Secure Store Service to map the user’s credentials to the individual or group credentials that are used by the Web service.
This mode is called WindowsCredentials in the BDC model file.
Impersonate Custom Identity - Digest
For Web services that use digest authentication instead of Windows authentication. Uses the Secure Store Service to map the user’s credentials to the individual or group credentials that are used by the Web service.
This mode is called DigestCredentials in the BDC model file.
Service Endpoint Address
The full Web address of the Web service’s .wsdl file.
Impersonation Level
The degree to which the Business Data Connectivity 서비스 will can act on behalf of the user when connecting to an external web service. Values include:
None: An impersonation level is not assigned.
Anonymous: The server process cannot obtain identification information about the client, and it cannot impersonate the client.
Identification: The server process can obtain information about the client, such as security identifiers and privileges, but it cannot impersonate the client. This is useful for servers that export their own objects, for example, database products that export tables and views. Using the retrieved client-security information, the server can make access-validation decisions without being able to use other services that are using the client's security context.
Impersonation: The server process can impersonate the client's security context on its local system. The server cannot impersonate the client on remote systems.
Delegation: The server process can impersonate the client's security context on its local system. The server cannot impersonate the client on remote systems.
Secure Store Target Application ID
For Impersonate Custom Identity and Impersonate Windows Identity authentication, the target application identifier for this Web service, as configured in the Secure Store Service.
Secondary Secure Store Target Application ID
This field is used to provide the target application identifier of the optional filter that will be used to capture user-supplied input values for Secure Store related filters. For information on the types of filters supported, and on implementing filters, see the Microsoft SharePoint 2010 Software Development Kit (https://go.microsoft.com/fwlink/p/?LinkId=166117).
Secure Store Implementation
If you are providing a custom secure store provider, specify the fully qualified assembly name of the provider. Otherwise, leave this field empty.
If the external system is a database, the following settings are available:
Field Description Access Provider
The type of database.
Authentication Mode
The way that incoming credentials are passed to the database.
Four choices are available:
Mode Description User’s Identity
Uses the credentials of the logged on user to authenticate to the database.
This mode is called PassThrough in the BDC model file.
BDC Identity
Uses the application pool account under which the Business Data Connectivity 서비스 is running to authenticate the logged on user to the database.
This mode is called RevertToSelf in the BDC model file.
Impersonate Custom Identity
For databases that do not use Windows authentication.
Uses the Secure Store Service to map the user’s credentials to the individual or group credentials that are used by the database.
This mode is called RdbCredentials in the BDC model file.
Impersonate Windows Identity
For databases that use Windows authentication.
Uses the Secure Store Service to map the user’s credentials to the individual or group credentials that are used by the database.
This mode is called WindowsCredentials in the BDC model file.
Database Server
The name of the database server.
Initial Database Name
The name of the database.
Integrated Security
If you are using integrated security, type the string, SSPI, and the Business Data Connectivity 서비스 will use the user’s Windows credentials to connect to the external system. If you are not using integrated security, leave this field blank, and the Business Data Connectivity 서비스 will connect by using unique credentials for the database server.
Connection Pooling
If this is selected, the Business Data Connectivity 서비스 maintains ownership of the connections to the external system in a pool as an optimization.
Secure Store Target Application Target ID
For Impersonate Custom Identity and Impersonate Windows Identity authentication, the target application identifier for this database, as configured in the Secure Store Service.
Secondary Secure Store Target Application Target ID
This field is used to provide the target application identifier of the optional filter that will be used to capture user-supplied input values for Secure Store related filters. For information on the types of filters supported, and on implementing filters, see the Microsoft SharePoint 2010 Software Development Kit (https://go.microsoft.com/fwlink/p/?LinkId=166117).
Secure Store Implementation
If you are providing a custom secure store provider, specify the fully qualified assembly name of the provider. Otherwise, leave this field empty.
Click OK.