Four SCSM Self-Service Portal Solutions (certificate, redirect, alias)
Author: Brody Kilpatrick | Created: July 20, 2011
When accessing the Self-Service Portal, typing https://servername/enduser into the browser address isn’t acceptable for most organizations. This blog posts addresses 4 concerns of the self-service portal and how to resolve them. The information may be common to many IT Professionals; however, it was not common to me, as I have rarely been required to set up IIS sites in the past. I must also mention and thank the source for most of this information, Thomas Bianco, who has challenged me with (I think uncommon) Service Manager questions and answers.
Creating a DNS entry for your Self-Service portal
Properly creating a certificate to access the Self-Service Portal
Automatically redirecting to the end-user portal when typing in that alias
Preventing the need to type in https in front of the site name
For each of these steps, we are going to assume the following:
Self-Service Portal Server Name: SCSM01
Website Name we want to use: ServiceManager.domain.local
1. Creating a DNS entry for your Self-Service portal
Log into DNS for your Active Directory Domain
Go to Forward Lookup Zones
Select you domain
Right click on your domain
Select New Alias (CNAME)
In the Alias Name box type “ServiceManager” (Without the quotes)
In the Fully Qualified Domain Box Type “ServiceManager.domain.local” (Without the quotes)
Click Ok
To test, Browse to https://servicemanager/enduser
You will still receive a certificate error, but should be able to click on to the site
2. Properly creating a certificate to access the Self-Service Portal
Log onto you SCSM Self-Service Portal Server
Start > Run > MMC > File > Add/Remove Snap-in
In the list of snap-ins, select Certificates
Click Add
A window should pop up stating “This snap-in will always maange certificates for:”
Select Computer Account > Next
Select “Local Computer” > Next
Finish
Ok
Expand Certificate (Local Computer) > Personal > Certificates
Right Click > Request New Certificate
Select the Certificate Enrollment Policy
Next
On the enrollment policy click the link labeled “More information is required to enroll for this certificate. Click here to configure settings.”
On the Subject tab, on the dropdown box under Type: Populate each field and add them as necessary
Under Alternative name, under Type: Select DNS
Type in all the names that could be used to access the SSP. For example servicemanager, servicemanager.domain.local, SCSM01, SCSM01.domain.local
Click Add
Select the General Tab and populate the fields
Select the Private Key Tab > Key Options Check the box “Make private key exportable
Select the Certificate Authority Tab
Select the correct certificate authority for your organization
OK
Back on the Certificate Enrollment Window check the “Web Server” box
Click Enroll
Update the SSP with the new certificate
Go to IIS Manager
Select SCSMPortal
Select Bindings
On the HTTPS binding, click edit
In the SSL certificate box, select you new certificate
Click OK
Click Close
The Certificate Error on the Self-Service Portal should no longer exist.
3. Automatically redirecting to the end-user portal when typing in that alias
Open IIS Manager
Select SCSMPortal
Double Click HTTP Redirect (If HTTP Redirect in not installed, go to Roles, Add Features, Select HTTP Redirect)
Check the box “Redirect requests to this destination”
Type in “enduser" (Without the quotes)
Under redirect behavior make sure “Redirect all requests to exact destination” is UNCHECKED
Under redirect behavior make sure “Only redirect requests to content in the directory” is CHECKED
In the Status Code Select “Found (302)”
Click Apply
Go to the Analyst and enduser vitual directories under SCSMPortal
Select HTTP Redirect
Make sure “redirect requests to this destination” is UNCHECKED
To Test type in https://servicemanager
You should automatically be redirected to https://servicemanager/enduser
4. Preventing the need to type in httpsin front of the site name
From Thomas:
[A Client] had a requirement to silently redirect users from their HTTP support site to the new HTTPS. It took me a few hours, but I found out an easy way to do this without redirecting to an absolute path that would break outside access through the firewall. First, I’m using the same redirect we worked out at [Client], then adding in the URL rewrite add-in from http://www.iis.net/download/URLRewrite. The HTTP redirect moves users who hit the website root down to the enduser virtual directory, and the rewrite directives moves connections from HTTP to HTTPS. The only downside is that people going to the root with HTTP get redirected twice, which takes about 1-4 seconds…Feel free to steal this for your blog.
Here’s how:
Open IIS Manager
Select SCSMPortal
Select bindings
Click Add
Type: http
IP address: All unassigned
Port: 80
Host Name: Leave Blank
Click OK
If you get a warning about Port 80 being using on the default website, you may want to stop the default website or remove the binding from the default website