SharePoint / ISA AAM and SSL Termination issue


UPDATE: Please click HERE for an update on this post.

UPDATE #2: Click HERE for another update.

I’m having a bit of a problem with Search on Microsoft Office SharePoint Server 2007.  I’m writing this blog for a few reasons.  First, it allows me to put to virtual paper, everything that is in my head before it gets replaced by useless baseball stats or what I have for dinner tonight.  Second, hopefully someone out there will have a solution.  Third, once (and if) I am able to solve it, other people experiencing this problem might stumble across this and use this information to fix it and eventually name their first born after me.  If you are here for number 3, you may want to use my nickname instead: Bada$$ SharePoint MoFo.

Now the main problem here is with the search drop-down box on a site collection.  Normally when you visit a list, the search drop-down will switch to “This List” for the search scope. 

Search Working Handy if all you want to do is search the list.  Unfortunately for me on both my production and test environments, it doesn’t work that way.  All I see is the “This Site” search scope.  It does correctly search the site but sometimes I want to narrow it down a bit more.

Search Not Working

I believe the problem is related to the fact that we publish SharePoint behind ISA and we are using SSL termination.  That means that you access ISA via SSL and it talks to the SharePoint farm via standard http without SSL.  This was an architecture decision that we needed to make for a number of reasons. That means changing it isn’t an option.  Please take a look at the image below for an idea of our setup:

sp_diagram

As you can see, we aren’t doing anything too drastic and you would expect this to work.  Unfortunately it doesn’t.  Our AAM settings are as follows:

Internal URL Zone Public URL
http://sharepoint.domain.com Default https://sharepoint.domain.com
https://sharepoint.domain.com Default https://sharepoint.domain.com

From what I have read, this should all be correct.  One interesting thing is if I enable SSL on the SharePoint front end and browse to it locally, bypassing ISA, the drop-downs work.  If I use the exact same URL from outside and go through ISA, the drop-down no longer works!  I have been commenting on Matthew McDermott’s blog  about this and I’ve found one other person that appears to be having this problem as well.  My machines are patched with SP2 and the April 2009 cumulative update. 

Anyone have any thoughts before I escalate this to Microsoft?  If I come up with a solution, I will post it as an update here.

,

  1. #1 by James Murray on October 14, 2009 - 2:31 pm

    Hi

    I stumbled across this post and I’ve read the updated one. I had exactly the same problem and run it just as you do in your diagram.

    What I found was when I turned Link Translation off on the ISA firewall that sharepoint was more than capable of handling the link translation and the errors I was getting dissappeared while still running on port 80.

    Link translation is turned on by default on the ISA server rule even if you tell it that link translation has already been configured so you actually have to go into the Listner itself and turn it off

    Hope this helps
    James

  2. #2 by Brian on October 14, 2009 - 2:42 pm

    Interesting. I tried disabling it but it didn’t seem to make a difference. I even tried using the link translation to translate it back to itself as well as several other crazy things. I may hop on the test farm and see if I was overlooking something with link translation.

    Thanks for the feedback.

  3. #3 by Brian on October 27, 2009 - 9:38 am

    I finally got around to looking into the link translation. It still has the same problem when it is turned off. In fact, I had it turned off before I went ahead and disabled SSL termination. Maybe there is something else causing it. Regardless, having SSL all the way through is fine. It may add to the load a bit but I doubt it is significant. We are also having other services setup close so SSL is a good idea at this point.

  4. #4 by Nathi on November 23, 2009 - 11:45 pm

    Hi

    Any solution found for this issue. We are getting the same problem with the similar setup in our end. Any help would be appreciated.

    Thanks
    Vanathi

(will not be published)