© Vlad Catrinescu and Trevor Seward 2019
Vlad Catrinescu and Trevor SewardDeploying SharePoint 2019https://doi.org/10.1007/978-1-4842-4526-2_9

9. Configuring Office Online Server for SharePoint 2019

Vlad Catrinescu1  and Trevor Seward2
(1)
Greenfield Park, QC, Canada
(2)
Sultan, WA, USA
 

Office Online Server, previously named Office Web Apps, is a server that allows users to view and edit Office documents such as Word, Excel, PowerPoint, and OneNote directly from the browser. Office Online Server also allows users to view PDF documents in the browser and convert Office documents to PDF.

It’s important not to get confused in Microsoft’s choice of name for the product. Even if it’s called Office Online Server, the product is fully On-Premises and does not require a connection to Office 365 or any Office 365 licenses.

Furthermore, Office Online Server isn’t only for SharePoint! Office Online Server can add features to Exchange Server 2016 / 2019 as well as Skype for Business Server 2015 / 2019. We will not cover those features, or how to enable them in this book; however, it is important to know that the investments you make in Office Online Server aren’t only for SharePoint, but for Exchange and Skype for Business as well.

There are multiple reasons to deploy Office Online Server other than the ability to view and edit Office documents from the browser. With Excel Services gone since SharePoint Server 2016, you need Office Online Server in order to view Excel Dashboards. Furthermore, Office Online Server enables additional features such as Durable Links. Office Online Server is an evergreen product, so we do not have an Office Online Server 2016 and Office Online Server 2019; it’s simply Office Online Server with an update becoming available every three to four months. The minimum version of Office Online Server for SharePoint Server 2019 is November 2018; however, it’s always recommended to install the latest version available.

Office Online Server Architecture Overview

Before we get start configuring Office Online Server, it’s important to understand the Office Online Server architecture in order to understand what we will install and configure in this chapter.

Office Online Server is in a way similar to SharePoint Server as we need one or more Office Online Servers to create an Office Online Server Farm. This farm can serve one, or multiple SharePoint, Exchange and Skype for Business deployments. In Figure 9-1, we can see an Office Online Server farm consisting of three servers that serve two different SharePoint Farms as well as an Exchange deployment and a Skype for Business deployment.
../images/469662_1_En_9_Chapter/469662_1_En_9_Fig1_HTML.jpg
Figure 9-1

High-Level Overview of Office Online Server Architecture

An Office Online Server Farm can be made accessible through two different URLs. We call the first one the Internal URL, and the second one the External URL as seen in Figure 9-2. The URLs can be either HTTP or HTTPS, and at least one of the URLs is mandatory. Office Online Server allows you to configure either the Internal URL, the External URL, or both. When configuring the Internal and External URLs, you have the choice to configure them either on HTTP or HTTPS. Since our SharePoint Server will use HTTPS, we will configure Office Online Server to use HTTPS as well. Securing your Office Online Server with SSL is extremely important, since the OAuth token is passed in a packet on the request, and you could be subject to a man-in-the-middle attack if that token is not secured. You can set up Office Online Server on HTTPS even if your SharePoint sites are running on HTTP.
../images/469662_1_En_9_Chapter/469662_1_En_9_Fig2_HTML.jpg
Figure 9-2

Office Online Server Internal and External URL

Office Online Server uses only three ports to communicate between servers and with SharePoint, Exchange, and Skype for Business. Those ports are described in Table 9-1.
Table 9-1

Office Online Server Ports

Port

Function

80

HTTP traffic

443

HTTPS traffic

809

Traffic between Office Online Servers

To enhance security, you can block the ports that you do not use. For example, if your Office Online Server farm will be only made of one server and be accessible via SSL, you only need port 443.

The minimum hardware requirements for Office Online Server are the same as for SharePoint Server 2019 and outlined in Table 9-2.
Table 9-2

 Office Online Server Minimum Requirements

CPU

RAM

Disk

64-bit, 4 cores

12 GB

80 GB for system drive

Office Online Server supports the 64-bit versions of Windows Server 2012 R2 and Windows Server 2016. The Server with Desktop Experience feature needs to be enabled as Office Online Server cannot run on Windows Server core.

Note

At the time of writing this book, Office Online Server running on Windows Server 2019 was not supported. Always check the latest supported operating systems at https://docs.microsoft.com/en-us/officeonlineserver/plan-office-online-server .

From a networking perspective, all the servers in an Office Online Server Farm must be in the same forest, and in order to use Business Intelligence Features, they must be in the same forest as the users who will use them.

Office Online Server must be installed on its own dedicated server. It can run on both Physical as well as in a Virtual Machine running on Hyper-V or VMware. Office Online Server cannot be installed on the same machine as Exchange, SharePoint, and Skype for Business, SQL, Domain Controller, or any server that has Office installed.

Note

At the time of writing this book, the Office Online Server license prohibits enterprises installing Office Online Server on physical hardware they do not own, therefore making it impossible to use Office Online Server in Azure, AWS, or any other provider. Check with your Microsoft Licensing Expert before deploying Office Online Server on any machines you do not own.

If you plan to have more than one Office Online Server in your farm, you will need a load balancer that supports the following features:

  • SSL Offloading or SSL Bridging

  • Enabling client affinity or front-end affinity

  • Layer 7 routing

Furthermore, if you plan to open Office Online Server to the Internet for SharePoint or Exchange, you will also need a reverse proxy in order to securely make it available to external users.

If you plan to use SSL, the certificate must come from a trusted Certificate Authority and include the fully qualified domain name (FQDN) of your Office Online Server farm URL in the SAN (Subject Alternative Name). Furthermore, the FQDN of every server in your Office Online Server farm must be in the SAN of the certificate. The certificate we used in our book can be seen in Figure 9-3 and has office.cobaltatom.com as the Issued To, which is both our Internal and External URL and also has servers CALOS1 and CALOS2 in the SAN in their FQDN format.
../images/469662_1_En_9_Chapter/469662_1_En_9_Fig3_HTML.jpg
Figure 9-3

Office Online Server Certificate

Installing Office Online Server

Now that we know the Office Online Server architecture, let’s start installing it. We first need to install the following prerequisites:

  • NET Framework 4.5.2

  • Visual C++ Redistributable for Visual Studio 2015

Afterward, we need to activate the required Windows Server Features and Roles. This can be achieved with the following PowerShell script, which will require a reboot.

For Windows Server 2012 R2 run the following in an elevated PowerShell window:
Add-WindowsFeature Web-Server,Web-Mgmt-Tools,Web-Mgmt-Console,Web-WebServer,Web-Common-Http,Web-Default-Doc,Web-Static-Content,Web-Performance,Web-Stat-Compression,Web-Dyn-Compression,Web-Security,Web-Filtering,Web-Windows-Auth,Web-App-Dev,Web-Net-Ext45,Web-Asp-Net45,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Includes,InkandHandwritingServices,NET-Framework-Features,NET-Framework-Core,NET-HTTP-Activation,NET-Non-HTTP-Activ,NET-WCF-HTTP-Activation45,Windows-Identity-Foundation
For Windows Server 2016 run the following in an elevated PowerShell window:
Add-WindowsFeature Web-Server,Web-Mgmt-Tools,Web-Mgmt-Console,Web-WebServer,Web-Common-Http,Web-Default-Doc,Web-Static-Content,Web-Performance,Web-Stat-Compression,Web-Dyn-Compression,Web-Security,Web-Filtering,Web-Windows-Auth,Web-App-Dev,Web-Net-Ext45,Web-Asp-Net45,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Includes,NET-Framework-Features,NET-Framework-45-Features,NET-Framework-Core,NET-Framework-45-Core,NET-HTTP-Activation,NET-Non-HTTP-Activ,NET-WCF-HTTP-Activation45,Windows-Identity-Foundation,Server-Media-Foundation
After the reboot, the following prerequisites need to be installed:

  • Microsoft.IdentityModel.Extention.dll

After all prerequisites are successfully installed, you can open the Office Online Server Setup.exe from the binaries you got either from MSDN or the Volume Licensing Center.

After accepting the terms, select where you want to install the Office Online Server binaries as seen in Figure 9-4.
../images/469662_1_En_9_Chapter/469662_1_En_9_Fig4_HTML.jpg
Figure 9-4

Office Online Server Installation

Location of the log files as well as cache location can be specified later when creating the Office Online Server farm. Click Next, until you get a screen similar to Figure 9-5 indicating that the installation has finished.
../images/469662_1_En_9_Chapter/469662_1_En_9_Fig5_HTML.jpg
Figure 9-5

Office Online Server Installation Confirmation

With the installation of the Office Online Server binaries complete, it’s now time to install any Language Packs that you might want to offer to you users. For the Multilanguage UI to work, the language pack must be installed both on the Office Online Server, as well as on your host (SharePoint, Exchange, or Skype for Business).

Since our farm is not created at this point, installing Public Updates or Language Packs is as simple as starting the installer and clicking Next until it’s done. As Public Updates also include updates for the Language Packs, make sure to install the base Language Packs before installing Public Updates. By installing the base Language Packs before the Public Updates, all the language related updates in the Public Updates will be applied.

After your Office Online Server(s) are on the update level you want and have the required Language Packs for your business, it’s now time to create the Office Online Server farm.

Creating the Office Online Server Farm

Unlike most Microsoft products, Office Online Server does not have a user interface at all and the only way to manage it is by Windows PowerShell. Furthermore, unlike other Office Server products such as SharePoint, there is no “Office Online Management Shell” that you will find on your computer; the required module manage Office Online Server will be loaded by default every time you open PowerShell.

To create the farm, we need to run the New-OfficeWebAppsFarm PowerShell cmdlet. Office Web Apps is the old name of Office Online Server in the 2013 suite of Office Servers. You will see that most of the PowerShell cmdlets to manage Office Online Server still refer to Office Web Apps.

Note

Make sure to always run PowerShell as an administrator when changing Office Online Server configurations.

Before running the PowerShell to create our farm, there are a few things we need to plan. The first item to plan is what the URL will be that the consuming services (SharePoint, Exchange, or Skype for Business) will use to connect to the Office Online Server farm. From a SharePoint-only point of view, you could only have one URL if you want, since SharePoint can only use one of them, but not both. If you also plan to connect Skype for Business and Exchange to your Office Online Server Farm, they will sometimes need the External URL. A good example is when doing a Skype for Business meeting and sharing a PowerPoint presentation. Skype for Business will connect external users to the external URL of your office Online Server Farm. Something to consider is that to enable full functionality, the External URL must be accessible from the Internet. Some of the features are Document Previews from Outlook on the Web (formerly known as Outlook Web App), Skype for Business PowerPoint Presentations with external users, and document previews in Office 365 Search Results when using Cloud Hybrid Search.

Publishing both the Internal and External URL by using Secure Sockets Layers (SSL) is highly recommended for security reasons; both SharePoint and Exchange server can consume Office Online Server via HTTP. The only reasons that make it mandatory for you to publish it under SSL are as follows:
  1. 1.

    You have at least one SharePoint site that will be using HTTPS. If your SharePoint sites are using HTTPS, you will need it for your Office Online Server as well.

     
  2. 2.

    You plan to connect Office Online Server to Skype for Business. Skype for Business only connects to Office Online Server if the latter is using https.

     

While in this book we recommend SSL Bridging for security, Office Online Server also supports SSL Offloading. SSL Offloading is not recommended because the traffic between the Load Balancer and your Office Online Server will not be encrypted, and you can be subject to a man-in-the-middle attack. If you plan to use SSL up to the Office Online Server, either by using pass through or SSL bridging on your Network Load Balancer, make sure to import the certificate into IIS on every server of your Office Online Server Farm. Make sure the certificate has a Friendly Name in IIS, as that’s what we will need to use in our PowerShell cmdlet.

Note

It is mandatory that the certificate have a Friendly Name, and this Friendly Name cannot contain an asterisk.

This certificate must also be trusted by the SharePoint Server Farm. If the certificate is from a Certification Authority such as DigiCert that is included by default in the Root Certification Authorities in Windows, it will work without doing any special configurations. However, if using a Self-Signed Certificate or an authority that is not in the root authority cert store by default, make sure to add it as a trusted certificate in the SharePoint Central Admin ➤ Security ➤ Manage Trust. Make sure to add the root certificate and not the end Certificate. You can view an example in Figure 9-6.
../images/469662_1_En_9_Chapter/469662_1_En_9_Fig6_HTML.jpg
Figure 9-6

Establish Trust Relation in the SharePoint 2019 Central Administration

You could also do this by running the following PowerShell cmdlets from an elevated SharePoint Management Shell:
$trustCert = Get-PfxCertificate <C:CertsOOSRootCert.cer>
New-SPTrustedRootAuthority "OOSRootCert" -Certificate $trustCert
The following is the cmdlet we used in our environment to create the Office Online Server Farm:
New-OfficeWebAppsFarm -InternalUrl "https://office.cobaltatom.com" -ExternalUrl "https://office.cobaltatom.com" -CertificateName "OOSCert" –EditingEnabled
where

  • InternalURL is the Internal URL of the Office Online Server farm.

  • ExternalURL is the External URL of the Office Online Server farm, and as you see, you can select the same URL for both Internal and External URLs. This is what we did in our lab.

  • CertificateName is the Friendly Name of my Certificate in IIS.

  • EditingEnabled is a switch that tells Office Online Server that users are allowed not only to view documents with it, but also to create and modify documents in SharePoint directly in the browser. As soon as you choose this switch, you will be prompted to approve that you have the right licenses.

Note

 If you plan to use Office Online Server on HTTP you need to add the –AllowHttp switch. If you plan to use SSL Offloading, you need to pass the –SSLOffloaded switch.

The New-OfficeWebAppsFarm cmdlet has many parameters that are important to select the features you want to activate in your Office Online Server Farm. You can view those features on TechNet at the following link: https://docs.microsoft.com/en-us/powershell/module/officewebapps/new-officewebappsfarm?view=officewebapps-ps or by running the following PowerShell cmdlet:
Get-Help New-OfficeWebAppsFarm -Online
After running the command, PowerShell will configure everything needed to get the farm configured. To validate the configuration was successful, point your DNS A record or host file to the server you just configured the farm on and navigate to the Internal or External URL + /hosting/discovery. In this case that URL would be https://office.cobaltatom.com/hosting/discovery/ . If everything works as planned, you should see an XML file similar to Figure 9-7.
../images/469662_1_En_9_Chapter/469662_1_En_9_Fig7_HTML.jpg
Figure 9-7

Discovery XML File

After we successfully configured our first machine in the Office Online Server farm, you need to install the same binaries on all the other machines in the Office Online Server farm, and if using an SSL Certificate, make sure you also import that into IIS. After the binaries are installed, simply run the following cmdlet:
New-OfficeWebAppsMachine -MachineToJoin CALOS01.lab.cobaltatom.com

Where in the MachineToJoin Parameter, you give it the FQDN of the first Office Online Server in the farm. In our case, that FQDN is CALOS01.Lab.cobaltatom.com.

Repeat the New-OfficeWebAppsMachine cmdlet on all the servers you want to join to the Office Online Server Farm. After you finish adding all the servers in the farm, run the following cmdlet to validate their health status:
(Get-OfficeWebAppsFarm).Machines

The output should be all the servers in your Office Online Server farm, with a health status of healthy.

SSL Configuration

As we have enforced the use of TLS 1.2 for SharePoint, we must enable strong crypto as outlined in Microsoft Security Advisory 2960358. Per the advisory, it may be necessary to enable TLS 1.2 support via a registry entry. Save the following text as a UseStrongCrypto.reg and import it into each Office Online Server. Once imported, restart each Office Online Server in your farm.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWAREMicrosoft.NETFrameworkv4.0.30319]
"SchUseStrongCrypto"=dword:00000001

Connecting Office Online Server with SharePoint 2019

After our Office Online Server Farm is up and running, we need to connect it to SharePoint Server 2019. The Process is pretty straightforward. From any SharePoint Server in the farm, run the following cmdlet to create the binding from SharePoint 2019 to Office Online Server:
New-SPWOPIBinding -ServerName office.cobaltatom.com
If you are using Office Online Server on HTTP, you would need to add the –AllowHTTP switch, as in the following example:
New-SPWOPIBinding -ServerName office.cobaltatom.com –AllowHTTP
Furthermore, if you use Office Online Server over HTTP, you also need to configure the Security Token Service to allow connections over HTTP. You can do this by running the following PowerShell Script:
$config = (Get-SPSecurityTokenServiceConfig)
$config.AllowOAuthOverHttp = $true
$config.Update()
The Server name you need to give is the FQDN of the URL you want SharePoint Server to use to access Office Online Server, without any http or https in front. After that is successfully finished, we will need to tell SharePoint how to correctly call this URL. SharePoint Server knows four WOPI Zones:

  • Internal-http

  • Internal-https (default)

  • External-http

  • External-https

The difference between the zones is the way that SharePoint calls the Office Online Server URL we gave it. In the Internal Zone, SharePoint will do a call on the short name. Since the default is internal-https, it would call our Office Online Server on https://office; however, we might have errors because our certificate SAN is https://office.cobaltatom.com . That is why we need to set it to external-https by using the following cmdlet:
Set-SPWOPIZone -zone "external-https"
Lastly, you need to enable the Excel SOAP API for scheduled data refresh with Excel Online. To enable the Excel SOAP API, run the following Windows PowerShell cmdlet and replace the URL with your Office Online Server farm URL:
$Farm = Get-SPFarm
$Farm.Properties.Add("WopiLegacySoapSupport", "https://office.cobaltatom.com /x/_vti_bin/ExcelServiceInternal.asmx")
$Farm.Update()

To test that the connection was successfully configured, navigate to any SharePoint Site and open an Office document. That document should open in the browser and you should be able to go through the entire document. Test Office Online Server with all of the supported Office document types, including editing functionality, if enabled.

One of the features of Office Online Server is document previews directly in the search results, as seen in Figure 9-8.
../images/469662_1_En_9_Chapter/469662_1_En_9_Fig8_HTML.jpg
Figure 9-8

Office Documents Preview in Office Online Server

In order to enable this functionality, you will need to do a Full Crawl on your Content Sources and the previews will work afterward. With everything setup, let’s learn how to maintain Office Online server, and how to debug it in case something goes wrong.

Office Online Server Maintenance

As a SharePoint Administrator, you might also be tasked with debugging and patching Office Online Server. Luckily, Office Online Server allows us to use tools we are already used to, since Office Online Server also has a ULS Log, and it works almost exactly the same as the SharePoint one. To find out the location of your Office Online, simply run the following PowerShell cmdlet:
(Get-OfficeWebAppsFarm).LogLocation

Note

By default, the Office Online Server log location is at C:ProgramDataMicrosoftOfficeWebAppsDataLogsULS.

ULS log viewing tools such as UlsViewer will also work with Office Online Server as seen in Figure 9-9.
../images/469662_1_En_9_Chapter/469662_1_En_9_Fig9_HTML.jpg
Figure 9-9

Viewing ULS logs with UlsViewer

You can also get more details in the ULS log files by changing the Log Verbosity. The Lowest level is VerboseEX, which will output everything, and the highest level is Unexpected, which will only show critical errors. To change the Log Verbosity in your Office Online Server farm, run the following cmdlet:
Set-OfficeWebAppsFarm -LogVerbosity Verbose

Note

A reboot of every machine in the Office Online Server farm is required for the Log Verbosity to be changed.

Patching Office Online Server

Patching Office Online server is very different from patching SharePoint Server. In order to apply patches to an Office Online Server machine, it needs to be removed from the Office Online Server farm it is part of. If you are patching a Single Server Office Online Server Farm, you simply have to remove the server from the farm by using the following PowerShell cmdlet:
Remove-OfficeWebAppsMachine

After the machine is removed, you can apply the patch, and then recreate the Office Online Server farm by using the New-OfficeWebAppsFarm and the same parameters that you initially used to create this Office Online Server Farm.

Patching a Multi-Server Office Online Server Farm adds an extra layer of complexity. In order to keep Office Online Server availability, you must first remove one of the servers from the load balancer pool, and afterward remove it from the Office Online server farm by using the Remove-OfficeWebAppsMachine cmdlet.

Note

You cannot start by removing the Office Online Server Master Machine as this can only be removed when there are no other machines left in the farm. To find out what server is your Master Machine, simply run the Get-OfficeWebAppsMachine | Select MasterMachineName cmdlet on any server in your Office Online Server farm.

Once you remove a server from the farm, apply the patches on it, and then recreate the farm by using the New-OfficeWebAppsFarm cmdlet and the same parameters that you initially used to create this Office Online Server Farm. Point the Load Balancer only to this server, so users will use the server with the patched version of Office Online Server.

Remove the other Office Online Servers from the old farm, apply the patches, and then join them to this server by running the New-OfficeWebAppsMachine cmdlet.

Finally, add the remaining servers in the load balancer to load balance the charge.

Next Steps

With Office Online Server successfully configured, in the next chapter we will learn how to configure Workflow Manager in order to provide modern workflows in SharePoint 2019.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.142.173.227