Configure the Secure Store Service in SharePoint 2013

Microsoft SharePoint Server 2013 provides a default feature of Secure Store Service (SSS) which has replaced the Single Sign-On (SSO) service, a feature of Microsoft office SharePoint Server 2007 for the storage and mapping of credentials for use in connecting with third-party or back-end systems. Many companies have already developed an in-house credential storage system or use a solution other than Microsoft Secure Store Service (SSS).

Sequence of events occurs as follows:

•          A SharePoint Server 2013 user accesses a data-connected object such as an Excel Services worksheet, Visio Services diagram, or PerformancePoint Services dashboard.
•          The Business Intelligence Service Application accesses the target application specified by the object.
•          If the user is a Member of that target application, the credentials stored in the target application are returned and the Business Intelligence Service Application impersonates the credentials while accessing the data.
•         The data is displayed to the user within the context of the worksheet, Visio diagram, or dashboard

A Secure Store Service (SSS) is a storage area to keep all the user ids and passwords that are used mainly in SharePoint 2013/2010 service applications. To create a SSS, we need to use the following procedure:

1. Register a managed account to SharePoint Server 2013
2. Start Secure Store Service
3. Create Secure Store Application
4. Encryption of Keys
5. Create a target application and set the credentials for the target application
6. Enable Audit logging for Secure Store

A. Register a managed account

1. Navigate to "CA"-> "Security"
2. Navigate to "General Security" -> "Configure managed accounts".
3. Navigate to "Managed Accounts" -> "Register Managed Account".
4. In the User name box, type the name of the account.
5. In the Password box, type the password for the account.
6. If you want SharePoint Server 2013 to handle changing the password for the account, select the "Enable automatic password change" box and specify the password change parameters that you want to use.
7. Click "OK".

Power shell commands

$account = "domain\username"

$credential = Get-Credential -Credential $account

New-SPManagedAccount -Credential $credential

B. Start Secure Store Service

1. Navigate to "CA" -> "System Settings" -> "Manage services on server".
2. Choose the server on which the service should run by clicking the Server drop-down list, and then click "Change Server".
3. Click "Start next to Secure Store Service".

$ServiceName = "Secure Store Service"
Get-SPServiceInstance -server $env:COMPUTERNAME | where-object {$_.TypeName -eq $ServiceName} | Start-SPServiceInstance -confirm:$false > $null

1. Navigate to "CA" -> "Application Management" -> "Manage service applications".
2. In the Manage Service Applications page on the ribbon click "New", then click "Secure Store Service".
3. In the Service Application Name box, type a name for the service application.
4. In the Database Server box, type the instance of SQL Server where you want to create the Secure Store database.
5. Select "Create new application pool" and type a name for the application pool in the text box.
6. Select the Configurable option, and, from the drop-down list, select the account for which you created the managed account earlier.
7. Click "OK".

Power Shell commands

$appPool = New-SPServiceApplicationPool -Name $secureStoreServiceAppPool -Account $account
$sssApp = New-SPSecureStoreServiceApplication -Name "Secure Store Service Application" -DatabaseServer "DatabaseServer" -DatabaseName "DatabaseName" -ApplicationPool $appPool -AuditingEnabled:$false
Start-Sleep -s 15
$sssAppProxy = New-SPSecureStoreServiceApplicationProxy -Name "Secure Store Service Application Proxy" -ServiceApplication $sssApp –DefaultProxyGroup
Start-Sleep -s 15


Note: Back up the database of the Secure Store Service application before generating a new key.

1. Navigate to "CA" -> "Application Management" -> "Manage service applications".
2. Click on the "Secure Store Service application".
3. In the Key Management group, click "Generate New Key".
4. On the Generate New Key page, type a pass phrase string in the Pass Phrase box, and type the same string in the Confirm Pass Phrase box. This pass phrase is used to encrypt the Secure Store database.
5. Click "OK".

Note: The pass phrase that is entered is not stored anywhere in SharePoint. Make sure you write this down and store it in a safe place. You must have it to refresh the key, such as when you add a new application server to the server farm.

Power Shell

Update-SPSecureStoreMasterKey -ServiceApplicationProxy $sssAppProxy -Passphrase

E. Create target application and Set credential for target application

1. Navigate to "CA" -> "Application Management" -> "Manage service applications".
2. Click the "Secure Store Service application".
3. In the Manage Target Applications group, click "New".
4. In the Target Application ID box, type a unique text string.
5. In the Display Name box, type a text string that will be used to display the identifier of the target application in the user interface.
6. In the Contact Email box, type the e-mail address of the primary contact for this target application.
7. Target Application Page URL:

• Use the default page: Any web sites that use the target application to access external data will have an individual sign-up page that was added automatically. The URL of this page will be: http:/<samplesite>/_layouts/SecureStoreSetCredentials.aspx?TargetAppId=<TargetApplicationID>
• where "<TargetApplicationID>" is the string provided in the Target Application ID box.
• Use custom page: You provide a custom web page that lets users provide individual credentials. Provide the URL of the custom page in this field.
• None: There is no sign-up page. Individual credentials are added only by a Secure Store Service administrator who is using the Secure Store Service application.

1. Target Application Type: choose the target application type: Group, for group credentials, or Individual, if each user is to be mapped to a unique set of credentials on the external data source.
2. Click "Next".
3. Use the Specify the credential fields for your Secure Store Target Application page to configure the various fields that may be required to provide credentials to the external data source. By default, two fields are listed: Windows User Name and Windows Password.

To add an additional field for supplying credentials to the external data source, on the Specify the credential fields for your Secure Store Target Application page, click "Add Field".

1. By default, the type of the new field is "Generic". The following field types are available:

Field	Description
Generic	Generic Values that do not fit in any of the other categories.
User Name	A user account that identifies the user.
Password	A secret word or phrase.
PIN	A personal identification number.
Key	A parameter that determines the functional output of a cryptographic algorithm or cipher.
Windows User Name	A Windows user account that identifies the user.
Windows Password	A secret word or phrase for a Windows account.
Certificate	A certificate.
Certificate Password	The password for the certificate.

11. Specify the membership settings: Target Application Administrators Field, list all users who have access to manage the target application settings.
12. If the target application type is group, in the Members field, list the user groups to map to a set of credentials for this target application.
13. Click "OK".

Power Shell
$UserNameField = new-spsecurestoreapplicationfield -name "UserName" -type WindowsUserName -masked:$false

$PasswordField = new-spsecurestoreapplicationfield -name "Password" -type WindowsPassword -masked:$true

$fields = $UserNameField, $PasswordField

$targetApp = new-spsecurestoretargetapplication -Name "IntranetFarmTargetApplication" -FriendlyName "Intranet Farm Target Application" -ContactEmail "admin@domain.com" -ApplicationType Individual

$targetAppAdminAccount = New-SPClaimsPrincipal -Identity "Domain\Account" –IdentityType WindowsSamAccountName

$defaultServiceContext = Get-SPServiceContext "http://demo.com"

$ssApp = new-spsecurestoreapplication -ServiceContext $defaultServiceContext -TargetApplication $targetApp -Administrator $targetAppAdminAccount -Fields $fields

F. Enable Audit logging for Secure Store

1. Navigate to "CA" -> "Application Management" -> "Manage service applications".
2. Select the "Secure Store Service application".
3. On the ribbon, click "Properties".
4. From the Enable Audit section, click to select the "Audit log enabled" box.
5. To change the number of days that entries will be purged from the audit log file, specify a number in days in the "Days Until Purge" field. The default value is 30 days.
6. Click "OK".

For more Information:
How to configure SSS in SP2013: http://technet.microsoft.com/en-us/library/ee806866(v=office.15).aspx