Establishing STS Trust between SharePoint farms

You might come to a scenario where you have multiple farms and you want to manage some of the service applications centrally on one farm, publish them and consume them from one or more farms.
One of the prerequisites to succeed is to establish STS trust between the farms. This is what this post is all about. In one of my next post I'll write about the service publishing and consuming itself in more details.

So... imagine how it looks like (assume we have only 2 farms, could be n farms):

The steps needed to implement this topology are:

1. Export the root certificate on the Services Farm

We will first need to export our Root certificate from the Services Farm. We will use the Get-SPCertificateAuthority cmdlet to export the certificate for our farm.

On the Services Farm, run the following in the SharePoint 2013 Management Shell:

$rootCert = (Get-SPCertificateAuthority).RootCertificate

$rootCert.Export("Cert") | Set-Content "C:\Cert\ServicesFarmRootCert.cer" -Encoding byte

2.  Create a Certificate on the Consuming Farm

On the Consumer Farm, we not only need to export the Root certificate, but also a Secure Token Service (STS) certificate as well. The later can be exported by using the Get-SPSecurityTokenServiceConfig cmdlet. To ease this process, we will also get the Farm ID for our Consuming Farms and create text files with it. The Farm ID will need to be added to the Publishing permissions on the Services Farm so that we can access our services later on.

Here's the PowerShell script you need to run to achieve that, on the first 2 variables you need to replace the values with your server hostnames:

$publisher = "ServicesFarmCAServer"

$consumer = "ConsumingFarmCAServer"

$path = "C:\Cert"

If ((test-path $path) -eq $false)

{

 [IO.Directory]::CreateDirectory("$path")

}

$rootCert = (Get-SPCertificateAuthority).RootCertificate

$rootCert.Export("Cert") | Set-Content "C:\Cert\ConsumingFarmRootCert.cer" -Encoding byte

$stsCert = (Get-SPSecurityTokenServiceConfig).LocalLoginProvider.SigningCertificate

$stsCert.Export("Cert") | Set-Content "C:\Cert\ConsumingFarmSTSCert.cer" -Encoding byte

$farmID = (Get-SPFarm).Id

New-Item C:\Cert\ConsumingFarmID.txt -type file -force -value "$farmID"

Copy-Item \\$consumer\c$\Cert\ConsumingFarmID.txt \\$publisher\c$\Cert

3,  Exchange the certificates between the Consuming and Services farms

Now we have all certificates that we need from the 2 farms. Remember, if you have more than one consuming farms, you need to repeat Step 2 for each of the farm. That's an easy copy-paste operation, however if you have more farms, it makes sense to script it.

$publisher = "ServicesFarmCAServer"

$consumer = "ConsumingFarmCAServer"

Copy-Item \\$publisher\c$\Cert\ServicesFarmRootCert.cer \\$cconsumer\c$\Cert

Copy-Item \\$cconsumer\c$\Cert\ConsumingFarmRootCert.cer \\$publisher\c$\Cert

Copy-Item \\$cconsumer\c$\Cert\ConsumingFarmSTSSTSCert.cer \\$publisher\c$\Cert

4.  Certificate Import on the Services farm

We now want to import all the Consuming farms certificates on the Services Farm and establish a trust. We are required to use the Farm ID to set up our permissions later on. We will rely on the text files we created a few steps back.

Replace ConsumingFarmName with the name you want to refer to the trusted provider/consumer and that's what will be visible later in the Trust section under Central Administration -> Security.

$trustCert = Get-PfxCertificate "C:\cert\ConsumingFarmRootCert.cer"

New-SPTrustedRootAuthority ConsumingFarmName -Certificate $trustCert

$stsCert = Get-PfxCertificate "c:\cert\ConsumingFarmSTSCert.cer"

New-SPTrustedServiceTokenIssuer ConsumingFarmName -Certificate $stsCert

$farmID = Get-Content C:\Cert\ConsumingFarmID.txt

$security = Get-SPTopologyServiceApplication | Get-SPServiceApplicationSecurity

$claimProvider = (Get-SPClaimProvider System).ClaimProvider

$principal = New-SPClaimsPrincipal -ClaimType "http://schemas.microsoft.com/sharepoint/2009/08/claims/farmid" -ClaimProvider $claimProvider -ClaimValue $farmID

Grant-SPObjectSecurity -Identity $security -Principal $principal -Rights "Full Control"

Get-SPTopologyServiceApplication | Set-SPServiceApplicationSecurity -ObjectSecurity $security

5. Certificate Import on the Consuming Farm

We have one final step to wrap up concerning our certificates. On the Consuming Farm(s), we will need to execute the following script to import the Services Farm Root Certificate only.

Replace ServicesFarmName with the name you want to refer to the trusted provider/consumer and that's what will be visible later in the Trust section under Central Administration -> Security.

$trustCert = Get-PfxCertificate "C:\Cert\ServicesFarmRootCert.cer"

New-SPTrustedRootAuthority ServicesFarmName -Certificate $trustCert

That should be it. Considering you've got your user profiles in sync, and you've done everything in this article properly, you are now ready to publish some of your service applications and consume them remotely. This works over WAN as well. As mentioned earlier, one of my next blog posts will focus on the publishing/consuming setup.