Application Migration

Application Migration is a separately licensed product from 1E that replaces the Application Mapping feature in Shopping with a much more feature rich solution. Application Migration runs on the Tachyon platform, and depends on Configuration Manager for inventory data, and information about application deployments. The legacy Application Mapping feature requires legacy AppClarity 5.6 which is out of support, but can still be used with Shopping.

When Shopping is integrated with Application Migration, you can optionally use the self-service Shopping OSD Wizard and the WSA Wizard to show the user which applications will be migrated. If self-service Wizards are not required, then task sequences are still able to use Application Migration features without Shopping.

If Application Migration is replacing Application Mapping:

• there is currently no automated method to migrate rules from Application Mapping to Application Migration. Please contact 1E if you require help with this (email Support@1e.com)
• you can continue using AppClarity 5.x for license management but instead you may wish to consider using the web-based AppClarity 7.1, which can be installed on Tachyon Platform alongside Application Migration.

Licenses

Shopping and Windows Servicing Assistant are licensed separately. Both license keys must be provided when installing Shopping Central server.

Microsoft System Center Configuration Manager requirements

If you use Shopping's ConfigMgr integration, you will need the following installation accounts, ConfigMgr security role, and database access.

Shopping installation accounts

The user installing Shopping Central or Shopping Receivers requires membership of the Full Administrator security role in Configuration Manager, as described in Accounts needed to install Shopping.

1E Shopping Receivers security role

Configuration Manager site databases

Shopping Central - the Shopping Central Service account (SVCUSER) must be a member of the Shopping Configuration Manager Database Access (SHOPPINGCONSOLESMSUSERS) group. This group requires a login with db_datareader rights and execute permission on the fn_GetAppState and fnGetSiteNumber functions.  If the Shopping Central installer has sufficient rights on the Configuration Manager database, then these database rights will be configured automatically during installation.

Shopping Receivers - in all Configuration Manager Site databases, ensure the Shopping Receiver service account has a login with db_datareader rights and execute permission on the fnGetSiteNumber function. If the Shopping Receiver installer has sufficient rights on the Configuration Manager database, then these rights will be configured automatically during installation.

Support for the Windows Servicing Assistant

Microsoft Intune requirements

To prepare for integration with Intune please refer to Enabling Intune integration.

Shopping Intune integration supports the Intune application types that are most useful for Windows clients. Additional application types might be supported in future versions. See Managing Intune applications page for more details.

Shopping Intune integration assumes that user accounts can be uniquely identified by their e-mail addresses. In other words, Shopping end-users accounts do not share e-mail addresses.

You will also need the following Azure Active Directory accounts for these purposes:

Accounts needed to install Shopping

Shopping Central installation account

The user installing Shopping Central requires the following

• Must be a domain user
• Must be a member of the Shopping Administrators (ADMINACCOUNT) group
• Must have local admin rights on the server on which Shopping Central will be installed. If the Shopping Central Service and Web components are to be installed on separate servers, the user installing them must have local admin rights on each server.
• Must have local admin rights on the Configuration Manager site server. 
• Must be a member of the Full Administrator role in Configuration Manager as the installer adds ConfigMgr Security rights for the Shopping Central Service Account.
• Requires one of the following sets of rights on the SQL instance hosting the Shopping database
  • sysadmin (can be temporary for the duration of installation), or
  • ALTER ANY LOGIN (on the SQL server / instance) and db_owner (on the database) if the Shopping database is pre-created, or dbcreator if the installation will create the database
• Requires one of the following sets of rights on the SQL instance hosting Configuration Manager database:
  • sysadmin (can be temporary for the duration of installation), or
  • ALTER ANY LOGIN and db_owner

Shopping Receiver installation account

The user installing the Shopping Receiver requires the following

• Must be a domain account
• Must have sysadmin rights on each SQL instance hosting the Configuration Manager database
• Must be a member of the Full Administrator role in Configuration Manager
• Useful to be a Shopping Administrator with access to the Sites node in order to select the Primary Site, otherwise another Administrator can complete that step after installation

Service accounts

Shopping Central service account

• Must be a domain account with local admin rights on the Shopping server
• Must have NTFS security
  • read and execute permissions on the Shopping program files installation folder
  • full permissions to the Shopping log folders
  • the above will be automatic if Shopping is installed using default locations on a default installation of Windows
  • the above security permissions are particularly relevant if you use non-default installer properties INSTALLDIR or LOGPATH
• We recommend restricting the account with Deny logon locally
• Must be a member of the Shopping Configuration Manager Database Access (SHOPPINGCONSOLESMSUSERS) group. If the Shopping Central installer account has permissions to add accounts to this group, then it will automatically add the account to the group during installation.
• For AppClarity integration, must have integration services permission enabled from the AppClarity console 

Shopping Receiver service account

If you use Shopping's ConfigMgr integration, you will need at least one Shopping Receiver.

• Each Receiver needs a service account, which can be either a dedicated or shared domain user account or Network Service

• We recommend restricting the account with Deny logon locally

• The Receiver is installed on each ConfigMgr Site server, and the service account must have local admin rights on the Site server

  • at the very least it must have read access to the binaries, and full permissions to the Receiver log folders

  • if you upgrade the Shopping Receiver with a different service account, it must have Read/Write permissions to %sysdrive%Programdata/1E or ~All Users/1E

• Must have permissions in the Configuration Manager Console and its SQL database, depending on the version of Configuration Manager, as described above in Microsoft System Center Configuration Manager requirements.

• Installation of Shopping Central requires details of the Receiver service account or an AD Security group containing Receiver service accounts, so that Receivers can access the Central web service:

  • a shared service account can be used if all Receivers use the same account, and an AD group is not required
  • a domain security group must be used if each Receiver has its own service account, or uses Network Service, which must be members of this group
  • we recommend using a domain security group if other services need access to the Central web service, for example if Shopping API scripts are used by OSD Task Sequences, then the group should include the Configuration Manager Network Access account. This security group should be Universal, but can be global if only one domain is involved.

Active Directory security groups

Shopping Console Access groups

Three separate AD groups are required to enable access to the Shopping Admin Console and optionally support the Shopping Console node security feature. 

• Shopping Full Database Admin Access (SHOPPINGCONSOLEADMINUSERS)
• Shopping Limited Database Admin Access (SHOPPINGCONSOLESMSUSERS)
• Shopping Configuration Manager Database Access (SHOPPINGCONSOLEUSERS)

The Shopping Console node security feature is enabled by default, but can be disabled in the Shopping Console settings panel. If the Shopping Admin Console Node Security feature is to be used, then the Shopping Full Database Admin Access (SHOPPINGCONSOLEADMINUSERS) group must have Modify permissions in Active Directory to manage membership of itself and the other two Shopping Access groups in the table below. You can permission each group, or permission an OU which contains the groups.

If the Shopping Console node security feature is not used, then the groups should have the following membership. The names in brackets are the Shopping Central installer properties, which are referenced elsewhere in this documentation.

Shopping Administrator groups

These are accounts or groups that have administrator rights in the Shopping Admin Console and web portal.

In addition to the Shopping Access groups, you need three further role-based security groups. Shopping allows these groups to be to be specified as individual domain user accounts, but then you are restricted to only these users being administrators, and using the Shopping Admin Console Node Security to manage additional user accounts. If your organization prefers to manage access rights through AD or other identity managements system, then you should use groups and disable the Shopping Admin Console Node Security feature.

Shopping Receiver Account group

During a Shopping Central installation, you must provide details for a Receiver Account. Instead of specifying an account, we recommend you specify an AD Security group, which contains individual Receiver service accounts. See Shopping Receiver service account.

Active Directory Server

During a Shopping Central installation, you must provide details for an Active Directory Server.  This can be an AD domain controller or an actual domain name. By default, Shopping performs AD queries using the global catalog, in which case you can specify the Active Directory Server as the domain name or nominate a domain controller server that is a global catalog server. 

If the global catalog is not available or not required (for example, in a single domain environment) then select a domain controller with the primary domain controller (PDC) emulator FSMO role if it is well connected. The PDC emulator is the preferred domain controller because it manages account and group changes for the domain. If the PDC emulator role is transferred, then update the Active Directory Server setting in the Admin Console settings.

Groups and Organisation Units

Shopping does not support mixed domain AD Groups, i.e. AD Groups in one domain that contain AD users, computers or groups from another domain. To use AD Groups with Shopping, ensure that the Groups and the objects it contains belong to the same domain. Nested OUs, up to 5 levels deep, are supported but it does not support Groups within OUs.

Multi-domain configurations

Shopping supports implementations that span multiple domains. During installation, Shopping must be pointed at a Configuration Manager server which is used as its main contact. A Shopping Receiver must be installed on that server and on all other Configuration Manager site servers that Shopping interacts with. The Shopping Central and Shopping Receiver components may be installed on different domains but you must configure the DNS settings as follows:

• If the Shopping Central service and main Configuration Manager contact are hosted on different domains, you must ensure that the SMS Provider (returned by the Configuration Manager server used during installation) is resolved to the correct domain name before you install Shopping central. This can only be done if a DNS search suffix for the Configuration Manager domain is added to the TCP/IP stack for the Shopping Central server's network card.
• If the Shopping Central service and Shopping Receiver are hosted on different domains, add the DNS search suffix for the Receiver's domain to the TCP/IP stack for the Shopping Central server's network card. This must be done before users on the domain is serviced by that Shopping Receiver.
• DNS search suffixes are added on the DNS tab in the Advanced TCP/IP Settings for the IPv4 Properties of the Shopping Central server's network card.

Multi-forest configurations

Shopping is designed to cater for two types of multi-forest Active Directory configurations: root-level forest trusts and external trusts. Each trust type has different requirements for where Shopping components must be installed, and rules that must be followed when creating Shopping accounts and groups.

The AD forests may be single or multi-domain. Multi-domain considerations are decribed in Multi-domain configurations.

For both trust types, Shopping components are installed as follows:

• On the AD forest where the Configuration Manager central site is located, install the following on the domain where the trust originates:
  
  • Shopping Web and API, Central service, Shopping database, and Shopping Admin Console 
  • Shopping installation accounts

• On either AD forest, where appropriate, install the following on the accessible domains (shown in orange in the below diagrams):
  • Shopping Receivers, clients, and end-user accounts (for example Shopping approvers)

Restrictions on multi-forest environments

Though Shopping supports the dual-forest domain scenarios illustrated above, there are specific restrictions on the configuration of groups to be used with Shopping and certain implications associated with the way that the domain and trust relationships work with it.

• Groups must be uniform – they must only contain AD objects from the same domain and forest. All the contained users, machines or groups must be in the same domain and forest as the group itself. If you need to add objects from another domain or forest, add them to a group that belongs to that domain or forest.
• Shopping only supports security type groups – you can only use security type groups with Shopping but they may have any scope type.
• Installation domain and accounts – the domain specified during installation is set as the starting point for all AD searches. Any accounts used during installation must belong to that domain and associated forest. Node security users and groups added later using the Shopping Admin console must come from the same domain/forest specified during installation. All other AD groups used in Shopping may come from either forest.
• Trust relationship and type – Shopping supports two-way trusts where there is an up-level trust between the domains. Both domain controllers in the supported dual forest scenarios must be Windows 2000 server or above.
• Trusted domains must be configured correctly and the trusted domain exist – AD searches in Shopping is severely impacted if there is a trust relationship for a domain that no longer exists.

When installing Shopping Central, the installer setting IISHOSTHEADER is used to configure the HTTP binding on the Shopping Website, and the Console settings for the Web URL and API URL. The Web URL setting is used in Shopping emails.

It is possible to manually add additional HTTP bindings to the Shopping Website. For example you can install using the server's DNS Alias FQDN, and then manually add a second HTTP binding for the DNS Alias without the suffix. This would allow users to access the Shopping Portal using either name.

Service Principal Names

Service Principal Names (SPN) are attributes of AD accounts.  Servers and service accounts are able to automatically create and update their own SPNs if they have AD permissions. Normally server accounts have these permissions by default, therefore if a service is using Network Service built-in account, there is no need to create any SPN. However, user accounts typically do not have permission and you need to create or update the SPN manually using an account that does have the rights, such as a domain administrator account. You can create an SPN by editing the attribute directly in the AD service account object, or use the SetSPN utility. More information about SPNs can be found in Microsoft's knowledge base. 

SPNs must exist for the HTTP host header for the following accounts:

• the account used for the Shopping application pool, which is normally the Network Service. (optionally: the Shopping Central service account)

The following is a example of how to create SPNs for the Shopping Central service account (assuming that the IIS application pools for Shopping have been configured to run as the  Shopping Central service account, this is considered a non-typical configuration ).

setspn -s http/shopping ACME\svc_ShoppingCtrl
setspn -s http/shopping.acme.local ACME\svc_ShoppingCtrl

The following is a example of how to create SPNs for the Shopping Central application pools. If the IIS application pools for Shopping use Network Service, then specify the server's machine account. (this would be the most common configuration) 

setspn -s http/shopping ACME-SRV6
setspn -s http/shopping.acme.local ACME-SRV6

To determine if SPNs exist for the Shopping Central service account and Network Service on the server itself:

setspn -l svc_ShoppingCtrl
setspn -l ACME-SRV6

More complex scenarios can be configured which requires in-depth knowledge of IIS, SPN and DNS configuration and are beyond the scope of this documentation.

Shopping Central IIS configuration

The following PowerShell commands can be used to install relevant IIS roles and features on Windows Server 2012 R2 and later, and record the server configuration in a file.

Do this even if IIS is already installed because it will ensure all the required features and roles are installed.

Import-Module ServerManager

Get-WindowsFeature | Out-file ServerManager-1.txt

Install-WindowsFeature Web-Server,
Web-Default-Doc,
Web-Dir-Browsing,
Web-Http-Errors,
Web-Static-Content,
Web-Http-Redirect,
Web-Http-Logging,
Web-Stat-Compression,
Web-Windows-Auth,
Web-Net-Ext45,
Web-Asp-Net45,
Web-ISAPI-Ext,
Web-ISAPI-Filter,
Web-Mgmt-Console,
Web-WMI,
Net-Framework-45-Core,
Net-Framework-45-ASPNET
 
Uninstall-WindowsFeature Web-DAV-Publishing
  
Get-WindowsFeature | Out-file ServerManager-2.txt

Network requirements

Sizing and deployment considerations