Preparing SharePoint On-Premises

The following table shows what is required and needs to be set up before you to use Nintex K2 for SharePoint 2016/2019 in an on-prem environment:

Nintex K2 for SharePoint supports any SharePoint environment that has the following required features and capabilities:

• Claims-based Authentication
• OAuth
• App Catalog
• App Deployment: Cloud-Hosted apps
• App Deployment: SharePoint-Hosted apps
• Client Object Model (OM)
• JavaScript Object Model
• List and Library APIs
• Managed Metadata Service
• User Profile Service
• Remote Event Receiver
• REST API
• SharePoint Lists
• SharePoint Ribbon
• Windows PowerShell Support

The SharePoint App Domain needs to be set up prior to using the Nintex K2 for SharePoint App. For steps on how this can be achieved, see the following Microsoft TechNet article for information: Configure an environment for apps for SharePoint.

• As a minimum requirement, the SharePoint July 2016 Cumulative Update is required especially if:
  
  • You are using web apps or site collections with host headers (domain names / 'friendly' URLs).
  • You have other server software installed on the SharePoint server that is using the Default Web Site (i.e. port 80/443).
  • You are not using port 80/443 for your web apps.
  For more information, see: July 2016 Cumulative Update for SharePoint Server 2013
  See this link for information on how to reduce the 5 hours usually needed to install cumulative updates to 30 minutes.
  We recommend that your SharePoint farm is updated to the latest public and / or cumulative update.

• SharePoint 2016/2019 Apps must be enabled for the Nintex K2 for SharePoint App to work (Configure an environment for apps for SharePoint (SharePoint 2016/2019) https://technet.microsoft.com/en-us/library/fp161236.aspx).
  For more information see the Microsoft Technet page: http://technet.microsoft.com/en-us/library/fp161232.aspx
  • For an index of useful resources for installing and managing apps in SharePoint 2016/2019, see: http://technet.microsoft.com/en-us/library/fp161232.aspx
    Specifically:
    
    • Configure an environment for apps for SharePoint 2016/2019: http://technet.microsoft.com/en-us/library/fp161236.aspx
    • Enable apps in AAM or host-header environments for SharePoint 2016/2019: http://technet.microsoft.com/en-us/library/dn144963.aspx
    • How to: Set up an app catalog on SharePoint: http://msdn.microsoft.com/en-us/library/office/fp123530.aspx
    • Manage the App Catalog in SharePoint 2016/2019: http://technet.microsoft.com/en-us/library/fp161234.aspx
    • Host webs, add-in webs, and SharePoint components in SharePoint: https://dev.office.com/sharepoint/docs/sp-add-ins/host-webs-add-in-webs-and-sharepoint-components-in-sharepoint
    • Tenancies and deployment scopes for SharePoint Add-ins: https://dev.office.com/sharepoint/docs/sp-add-ins/tenancies-and-deployment-scopes-for-sharepoint-add-ins
• Host Web – the host web is the SharePoint site where the Nintex K2 for SharePoint application has been enabled, the system manages integration details via the host web.
• App Web – an app web is an isolated SharePoint subsite that is provisioned automatically by SharePoint when Nintex K2 for SharePoint is installed on the App Catalog site. The Nintex K2 for SharePoint application contains both SharePoint-hosted and provider-hosted components. The SharePoint-hosted components are the application pages, such as Application.aspx, Settings.aspx and WorklistAppPart.aspx, which are rendered via the provisioned app web site. The Nintex K2 for SharePoint application is tenant-scoped which will limit the number of potentially provisioned app webs to, at most, one per application catalog.

• User Profile Service: For on-premises SharePoint apps, correct set up and population of the User Profile Service is required in order for OAuth tokens to be validated by SharePoint.

  While detailed steps on configuring User Profile Services is outside of the scope of this document, the following excerpt taken from http://technet.microsoft.com/en-us/library/jj729797(v=office.15).aspx describes the requirement for UPA when using SharePoint on-premises apps.

  Server-to-server authentication allows for servers that are capable of server-to-server authentication to access and request resources from one another on behalf of users. Therefore, the server that runs SharePoint Server 2019 and that services the incoming resource request must be able to complete two tasks:

  • Resolve the request to a specific SharePoint user.
  • Determine the set of role claims that are associated with the user, a process known as re-hydrating the user’s identity.

  To rehydrate a user’s identity, a server that can perform server-to-server authentication requests access to SharePoint resources. SharePoint Server 2093 takes the claims from the incoming security token and resolves it to a specific SharePoint user. By default, SharePoint Server 2019 uses the built-in User Profile service application to resolve the identity.

  The key user attributes for locating the corresponding user profile are as follows:

  • The Windows Security Identifier (SID).
  • The Active Directory Domain Services (AD DS) user principal name (UPN).
  • The Simple Mail Transfer Protocol (SMTP) address.
  • The Session Initiation Protocol (SIP) address.

  Therefore, at least one of these user attributes must be current in user profiles. We recommend a periodic synchronization from identity stores to the User Profile service application.

• When AppDeployment.exe runs through the Config Analysis, a warning is issued concerning the User Profile Tasks > User Profile Sync Connection Task. This may occur because the installation account does not have Full Control permissions, but can be ignored if the SP Farm user (used post-installation) does have full control.
  If you want to avoid the warning, add the installation account (for example the K2Service account) to the User Profile Service (UPS), Service Applications, Administrators with Full Control set. Connection permissions for UPS must be granted with Full Control. This is done by following these steps:
  
  1. In Central Admin, select Manage service applications from the Application Management menu.
  2. Select the User Profile Service Application row (click on the empty line, not on the text).
  3. In the Service Application ribbon, select Administrators from the Operations block.
  4. Add the installation account and assign Full Control permissions, then click OK.
  5. Again in the Service Application ribbon, select Permissions in the Sharing block.
  6. Add the installation account and assign Full Control permissions, then click OK.

For the prerequisite hardware and software necessary for the SharePoint 2016/2019 server, see the Hardware and software requirements for SharePoint 2019 on the Microsoft TechNet website.