Installing FIM 2010 R2 SP1 Portal on SharePoint Foundation 2013

I described in an earlier post the problems I was having installing and configuring FIM 2010 R2 SP1 on SharePoint Foundation 2013 and if you’ve had to do this, then chances are you’ve been just as disappointed by Microsoft’s documentation as I was. If that’s the case, then this is the guide for you.

Keep in mind, this is written from the perspective of a FIM consultant who had to nut it out using the Microsoft Installing FIM 2010 R2 on SharePoint Foundation 2013 guide and my own ingenuity. For a more in-depth guide from a SharePoint specialist, check out Spencer Harbar’s guide, which includes some detail around configuring SSL and takes a SharePoint “purist” approach, rather than the GUI-where-possible approach I used.

This guide is comprised of the following sections:

  1. Why you shouldn’t use SharePoint Foundation 2013 for FIM 2010 R2 SP1
  2. FIM Service and Portal Pre-requisites
  3. Installing the SharePoint Foundation 2013 Pre-requisites
  4. Installing SharePoint Foundation 2013
  5. Running the SharePoint Foundation 2013 Farm Configuration Wizard (GUI)
  6. Creating a SharePoint Foundation 2013 Web Application (Powershell)
  7. Creating a 2010 Experience Mode Site Collection (GUI)
  8. Configuring SharePoint Foundation 2013 for FIM 2010 R2 SP1 Portal
  9. Installing the FIM Service and Portal

Why you shouldn’t use SharePoint Foundation 2013 for FIM 2010 R2 SP1

If you’re like me, then you’re probably tempted to upgrade to SharePoint Foundation 2013 when doing your FIM 2010 R2 SP1 upgrade. I mean, it makes sense – it’s the latest release, why wouldn’t you upgrade to it when you’re doing a major FIM upgrade anyway? However, unless you’re running Windows 2012, don’t use SPF 2013. Here’s why:

  • If you run the “Standalone” installation, the default Web Application and Site Collection that are configured are incompatible with FIM 2010. You will need to uninstall both and re-install using the SharePoint Administration Shell (Powershell)
  • The reason you need to do this via the Management Shell, is that Classic Authentication has now been deprecated in SPF 2013 in favour of Claims-Based authentication. As such, you can’t select it as an option via the GUI and you even get a big red warning message (see below) when configuring a new site via the shell.
  • You have to run your sites in SharePoint 2010 Experience mode anyway, as the FIM Portal doesn’t support being installed on a SharePoint 2013 site collection.

My natural thought was to use the latest version of SharePoint Foundation when performing the upgrade, but as I was deploying I realised that while the FIM Portal will install on SPF 2013, it’s really designed to work with WSS 3.0 and SPF 2010. At this stage, it seems that the only reason support for SharePoint Foundation 2013 was added to FIM 2010 R2 SP1 was because Windows Server 2012 doesn’t yet support SharePoint Foundation 2010 – apparently this support is coming with SPF 2010 SP2. So until SPF 2010 SP2 is released, anyone wishing to install the FIM Portal for FIM 2010 R2 SP1 on Windows Server 2012 will need to use SharePoint Foundation 2013. In my opinion, everyone else should just stick to SharePoint Foundation 2010, or WSS 3.0.

That said, if you’re determined to do it, this guide should help you.

The screenshots detail an installation performed on Windows Server 2012, however I have also run through these steps on Windows 2008 R2.

FIM Service and Portal Pre-requisites

You should already be familiar with Microsoft’s Before You Begin guide if you’ve installed an earlier version of FIM. If you’re not, make sure you follow these steps before you install the FIM Service and Portal:

  • Install FIM Synchronisation Service either on this server, or another server. In my environment, it’s a different sever.
  • Prepare your FIMService, FIMMA, SPF and SPFAppPool service accounts.
  • Have a mail server and an e-mail address for the FIM Service to use

Installing the SharePoint Foundation 2013 Pre-requisites

This is fairly straight forward, as the SPF Pre-requisites installer will setup almost all of the Windows Features, such as IIS, as well as the other SPF 2013 pre-requisites. If there are any warnings, or errors, it’s pretty helpful in telling you what you need to do. Download and run the SharePoint Foundation 2013 installer to be presented with the following:

1-1 - Install SharePoint 2013 Pre-Requisites

Step 1: Select Install SharePoint 2013 Pre-Requisites

1-2 - SharePoint 2013 Products Preparation Tool

Step 2: Click Next to begin installing SharePoint Foundation 2013 Pre-requisites

1-3 - Installing SharePoint 2013 Pre-requisites

Step 3: Microsoft SharePoint 2013 Products Preparation Tool will install Pre-requisites

1-4 - Restart

Step 4: Pre-requisites are installed. Click finish to restart your system.

Installing SharePoint Foundation 2013

Once you’ve restarted your system, run the SharePoint Foundation 2013 installer again and this time select “Install SharePoint Foundation”.

2-1 - Server - Complete or Stand-alone

Step 1: Select “Complete” and click Install Now

Server-Type: Complete or Stand-alone?

If you choose stand-alone, FIM will install an express database and pre-configure a SharePoint site. Unfortunately, the SharePoint site it pre-configures uses Claims-Based Authentication, which FIM doesn’t support, and to create a site that uses classic-mode Windows Authentication, you’re going to have to delete the pre-configured site and create a new one via the SharePoint 2013 Management Shell (not supported via the GUI). I also see no point in using an express database if you have access to a proper SQL Server database.

2-2 - Run Configuration Wizard

Step 2: Leave the box checked to run the Configuration Wizard and click “Close”

Running the SharePoint Foundation 2013 Farm Configuration Wizard (GUI)

Now that SharePoint Foundation is installed, you need to create a new Server Farm and configure SharePoint Central Administration. If you’re familiar with SharePoint, you can do this via the SharePoint Management Shell using Powershell, however you can use the GUI at this stage. Since I like things simple, that’s exactly what I did.

2-3 - SharePoint Products Configuration Wizard

Step 1: Click next to start the wizard.

2-4 - Services Restart Warning

Step 2: Click yes to accept that it will restart some of your services.

2-5 - Create a New Server Farm

Step 3: Select Create a new server farm

2-6 - Specify Configuration Database Settings

Step 4: Specify configuration database settings. This is where your SharePoint Foundation database will reside. I put mine on the same SQL Server that I use for the FIMPortal, but only because I’m in a development environment.

Note: SharePoint Foundation 2013 will actually issue a health warning in Central Administration if your database is on the same server as your SharePoint server. Don’t do this in a production environment.

2-7 - Specify Farm Security Settings

Step 5: Specify Farm Security Settings. Here, you specify the password that other servers will need to know if they want to join your farm

2-8 - Configure SharePoint Central Administration Web Application

Step 6: Specify a custom port number if you want. Also, select NTLM as the authentication provider, or else you will have issues logging in to SharePoint Central administration. You can add Kerberos back in later.

2-9 - Completing the SharePoint Products Configuration Wizard

Step 7: Confirm the configuration details and click Next to create your SharePoint Web Application

2-10 - SharePoint Foundation 2013 Configuration Successful

Step 8: Your SharePoint instance has been created

2-11 - Initial Farm Configuration

Once configured, Central Administration should load. You can now close this window, as we will create your Web Application via Powershell, in the next step.

Creating a SharePoint Foundation 2013 Web Application (Powershell)

Okay, now that the Server Farm has been created, and Central Administration is configured, the next step is for you to create your SharePoint Web Application. You actually need to use the SharePoint Management Shell, which is a Powershell interface, in order to do this, as the GUI will set up your site in a way that means FIM can’t use it. Load the SharePoint Management Shell from your start menu and enter the following:

$adminCredentials = get-credential “FIMSPECIALIST\FIMSPAppPool”

$adminManagedAccount = New-SPManagedAccount -Credential $adminCredentials

New-SpWebApplication -Name “FIM Portal” -ApplicationPool “FIMAppPool” -ApplicationPoolAccount $adminManagedAccount -AuthenticationMethod “Kerberos” -Port 80 -URL http://FIMPortal.fimspecialist.com

Note that it can take quite a while to create your Web Application. At some stage, you should see a warning pop up, telling you that Windows Classic authentication is deprecated in SPF 2013, and then confirmation that your site has been created:

2-12 - Create Web Application

Creating a 2010 Experience Mode Site Collection (GUI)

Now that your Web Application has been created, you can actually go in and create a site collection for FIM through the SharePoint Central Administration GUI.

2-13 - Application Management

Step 1: In SharePoint Central Administration, go to Create Site collections under Application Management

2-14 - Create Site Collection (a)

Step 2: Give your site collection a meaningful name

2-15 - Create Site Collection - Template Selection

Step 3: Ensure you select 2010 experience version and Blank Site from the templates.

Note: When I was creating my site collection through the GUI, I seemed to have a bit of problem here, where SharePoint was still creating the site collection in 2013 experience mode. After you’ve created your site, run the following to double check that the site collection has been installed as the correct version:

$spSite = SpSite(“http://fimporta.fimspecialist.com”);
$spSite.CompatibilityLevel

If this returns ’14’, all is good. If this returns ’15’, you need to delete your site collection and try again. Interestingly, after fiddling around a bit, I’m now only able to create sites in 2010 Experience mode:

2010 experience mode

Anyway, scroll down and you will be presented with more options:

2-16 - Create Site Collection - Administrators

Step 4: Enter your Primary Site Collection Administrator account details

2-17 - Site Collection Created

Step 5: Site Collection is now created. Click OK.


Configuring SharePoint Foundation 2013 for FIM 2010 R2 SP1 Portal

Now that you’ve installed SharePoint, created a Web Application and create a site collection within that web application, there are just a last few configuration steps to ensure that the SPF2013 instance is ready to have FIM Portal installed on it:

Step 1: Disable server-side viewstate.

Open the SharePoint Management Shell again and as per the Microsoft guide to Installing FIM 2010 R2 on SharePoint Foundation 2013, execute the following:

$contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService;
$contentService.ViewStateOnServer = $false;
$contentService.Update();

Step 2: Disable Self-service upgrades

In the same SharePoint Management Shell, execute:

$spSite = SpSite(“http://fimportal.fimspecialist.com/”);
$spSite.AllowSelfServiceUpgrade = $false

Note: As mentioned above, I had an issue where the site collection was still being created in 2013 Experience Mode, despite selecting the 2010 option during creation. In this case, when I ran “$spSite.AllowSelfServiceUpgrade = $false”, I would receive the error:

System.InvalidOperationException: Invalid operation given the current state of the object.

After digging around, I discovered that the error is caused because a 2013 site is already considered to be upgraded, so you can’t set the AllowSelfServiceUpgrade value. If you get this error, delete your site collection and re-create it, double-checking that you select 2010 Experience Mode. Be sure to check the CompatibilityLevel to ensure ’14’ is returned.

Step 3: Create the SPNs for your SharePoint instance

I always forget this step. These are required for you to be able to actually login to the FIM Portal once it’s installed. Open a normal command prompt and execute the following:

setspn -S FIMService/fimportal.fimspecialist.com FIMSPECIALIST\FIMservice
setspn -S HTTP/fimportal.fimspecialist.com FIMSPECIALIST\FIMSPAppPool

Installing the FIM Service and Portal

This is the last step! Finally! After all that preparation, installing the FIM Service and Portal is actually quite straight forward.

3-1 - FIM Splash Screen

Step 1: Select Install Service and Portal from the FIM 2010 R2 SP1 splash screen

Step 2: Click next to begin the installer

Step 2: Click next to begin the installer

3-3 FIM 2010 R2 End-User License Agreement

Step 3: Check the Accept terms box and click next

3-4 FIM Customer Experience Improvement Program

Step 4: Check “I don’t want to join the program at this time” and click next.

3-5 - FIM 2010 R2 Service and Portal Select Components

Step 5: I only want to install the FIM Service and Portal, so I deselect the Reporting, Password Reset Portal and Password Registration Portals and click next

3-6 - Configure FIM Database Connection

Step 6: I am creating a new database on my database server with the default name.

Note: Best practice would dictate that you use a SQL alias here. This will more easily allow you to migrate your FIM database between database servers.

3-7 - Configure mail server connection

Step 7: Configure your mail server settings. In my development environment, I’m using a non-Exchange enabled mail server.

3-8 - Configure service certificate

Step 8: Generate a new self-issued certificate and click next. If you have your own certificates installed on the server, you can select them at this point

3-9 - Configure the FIM service account

Step 9: Configure your FIMService service account details here.

3-10 - Configure the FIM Service and Portal account

Step 10: Configure your FIM Synchronization Service server details here

3-11 - Configure connection to the FIM Service

Step 11: Enter the server address for your FIM Portal

3-12 - Configure Sharepoint Site Collection URL

Step 12: Enter the URL for the SharePoint site collection you created earlier.

3-13 - Configure optional portal homepage configuration

Step 13: I leave this blank, as I’m not installing the Registration Portal

3-14 - Configure security changes configured by setup

Step 14: Check both of these boxes. The first opens firewall Windows ports for your portal, so you can access it from other machines. The second ensures that users are able to access the SharePoint site collection

3-15 Enter optional password portal configuration

Step 15: Again, left blank as I am not using these features.

3-16 Click Install to begin the installation

Step 16: All done configuring, click install

3-17 Completed the FIM Service and Portal Setup Wizard

Step 17: If all goes well, you should get this screen at the end of the installation

Note: If you do not get this screen, but instead get a screen saying “FIM Service and Portal Setup Wizard ended Prematurely”, then read my post describing some of my troubleshooting for this issue.

3-18 FIM Portal Installed

Step 18: You should now be able to login to http://fimportal.fimspecialist.com/IdentityManagement/ with your administrator account to see the FIM Portal. Success!

Anyway, because of the lack of documentation at the time, I really had to work a lot of this out the first time I had to run through it, so I wanted to put it down as a guide for others who also want to install and configure FIM 2010 R2 SP1 on SharePoint Foundation 2013. I may come back and add to this over time so that it’s a more comprehensive guide, but this should get you started. As usual, please ask any questions below.

10 comments on “Installing FIM 2010 R2 SP1 Portal on SharePoint Foundation 2013
  1. Nils says:

    Hello!

    Great post!
    Though I have tried both this one and the “harbar post” ending up with a portal saying “service unavailable” and with the error:

    GetCurrentUserFromSecurityIdentifier: No Such User

    pointing to the Sharepoint apppool account eg ‘MYDOMAIN\FIMSPAppPool’

    Tried so much I can think of (configuration files, spns, entirely new installation ending up with same result) etc etc.

    My first installation worked fine (harbars post), when doing the exact same installation in another environment I ended up with this error. Tried several times with different settings ending up with the same result.

    What am i doing wrong here? Is FIM on Sharepoint Foundation 2013 really this bad?

    Any help would be appreciated.

    Best Regards

    • Ross Currie says:

      Hi Nils,

      That error is generally thrown by the FIM Portal when a user trying to login to the Portal isn’t configured correctly in the Portal.

      Normally, if a user couldn’t login, I would suggest that you log on to your FIM Portal with your administrator account and check that the user trying to access the portal has the correct details set (Account Name, Domain, objectSID, etc.), but in your case it sounds like you wouldn’t even be able to get that far.

      When you install SPF 2010, are you able to login to the SharePoint portal that results? Can you get into Central administration? That should be your first check to confirm you’re on the right track.

      Also, I trust you’re installing FIM with a domain user account? Similarly, when you login to the FIM Portal, you’re using the credentials you used to install the FIM Portal with?

  2. CJ says:

    Just completed all the steps and when I run the Install Service and Portal I get the following error:

    Installation Prerequisites Not Met

    The Features you have selected have the following prerequisites. Refer to the installation guide for more information. Please update your machine and retry the installation.

    -SharePoint.

    I can get into admin central just fine and I see the site collection as created by this article.

    Any ideas? googling “FIM 2010R2 Prerequisites Not Met” has only lead me back to initial install documents. Thanks for any help you can provide.

  3. Danny says:

    Used your article today as a resource for the scenario you describe and had no issues. Thanks for the writing and posting!
    Kind regards, Danny

  4. Ankit Yadav says:

    My environment for FIM consisted of the following components :-

    Windows Server 2012 Datacenter, SQL Server 2012 SP1, SharePoint Foundation 2013 & FIM 2010 R2 SP1

    I am following the below given article to configure the FIM with an AD connector & FIM connector, AD is single site, single domain.

    http://www.fimspecialist.com/fim-portal/installing-fim-2010-r2-sp1-portal-on-sharepoint-foundation-2013/

    I am stuck up at the point where, I am trying to create a web application which could be used for FIM from the SharePoint Powershell, it given the following error when I am trying to attempt the following commands :-

    PS C:\Users\fimadmin> $adminCredentials = get-credential “idmadBase\fimadmin”
    PS C:\Users\fimadmin> $adminManagedAccount = New-SPManagedAccount -Credential $
    dminCredentials
    New-SPManagedAccount : Account idmadBase\fimadmin has already been registered.
    At line:1 char:24
    + $adminManagedAccount = New-SPManagedAccount -Credential $adminCredentials
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidData: (Microsoft.Share…wManagedAccount:
    SPCmdletNewManagedAccount) [New-SPManagedAccount], InvalidOperationExcepti
    on
    + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletNewManag
    edAccount

    PS C:\Users\fimadmin> New-SpWebApplication -Name “FIM Portal” -ApplicationPool
    FIMAppPool” -ApplicationPoolAccount $adminManagedAccount -AuthenticationMethod
    Kerberos” -Port 80 -URL http://FIMPortal.IDMFIMBase.local
    WARNING: The Windows Classic authentication method is deprecated in this
    release and the default behavior of this cmdlet, which creates Windows Classic
    based web application, is obsolete. It is recommended to use Claims
    authentication methods. You can create a web application that uses Claims
    authentication method by specifying the AuthenticationProvider parameter set in
    this cmdlet. Refer to the http://go.microsoft.com/fwlink/?LinkId=234549 site
    for more information. Please note that the default behavior of this cmdlet is
    expected to change in the future release to create a Claims authentication
    based web application instead of a Windows Classic based web application.
    New-SpWebApplication : ApplicationPoolAccount is not found.
    At line:1 char:1
    + New-SpWebApplication -Name “FIM Portal” -ApplicationPool “FIMAppPool”
    -Applicati …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~
    + CategoryInfo : InvalidArgument: (Microsoft.Share…PWebApplicat
    ion:SPCmdletNewSPWebApplication) [New-SPWebApplication], SPCmdletException
    + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletNewSPWeb
    Application

    PS C:\Users\fimadmin> New-SpWebApplication -Name “FIM Portal” -ApplicationPool
    DefaultAppPool” -ApplicationPoolAccount $adminManagedAccount -AuthenticationMet
    od “Kerberos” -Port 80 -URL http://FIMPortal.IDMFIMBase.local
    WARNING: The Windows Classic authentication method is deprecated in this
    release and the default behavior of this cmdlet, which creates Windows Classic
    based web application, is obsolete. It is recommended to use Claims
    authentication methods. You can create a web application that uses Claims
    authentication method by specifying the AuthenticationProvider parameter set in
    this cmdlet. Refer to the http://go.microsoft.com/fwlink/?LinkId=234549 site
    for more information. Please note that the default behavior of this cmdlet is
    expected to change in the future release to create a Claims authentication
    based web application instead of a Windows Classic based web application.
    New-SpWebApplication : ApplicationPoolAccount is not found.
    At line:1 char:1
    + New-SpWebApplication -Name “FIM Portal” -ApplicationPool “DefaultAppPool”
    -Appli …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~
    + CategoryInfo : InvalidArgument: (Microsoft.Share…PWebApplicat
    ion:SPCmdletNewSPWebApplication) [New-SPWebApplication], SPCmdletException
    + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletNewSPWeb
    Application

    PS C:\Users\fimadmin>

  5. Peter Siffredi says:

    Hi,

    Is the “FIMSPECIALIST\FIMSPAppPool” the local admin account on the server you used for the install?

    I’m hitting errors at the SharePoint config.

    adminCredentials = get-credential “FIMSPECIALIST\FIMSPAppPool”

    $adminManagedAccount = New-SPManagedAccount -Credential $adminCredentials

    The below generates an error “You need to have machine administrator privileges”

    Then trying below fails to find ApplicationPoolAccount. Just wondering if I can delete the App pool and try again?

    Thanks

    New-SpWebApplication -Name “FIM Portal” -ApplicationPool “FIMAppPool” -ApplicationPoolAccount $adminManagedAccount -AuthenticationMethod “Kerberos” -Port 80 -URL http://FIMPortal.fimspecialist.com

  6. Mike Finazzo says:

    Ross,

    Cant tell you how many times I refer back to this page, its been very helpful.

    I’m now in the process of creating an automated install of FIM and found a lot of information for doing so. Have you ever automated the install and configuration of SharePoint Foundations for the FIM Service\Portal?

    Any thoughts would be helpful.

  7. Mag says:

    I am in the process of installing the service and portal part of this and keep getting the error “The Microsoft Identity Manager Server Database could not be successfully populated”. Do you have any idea why I am experiencing this issue? Thanks in advance.

Leave a Reply

Your email address will not be published. Required fields are marked *

*