Question

Photo of Hock_Hin Lee

0

Setup "Login User Ids" for (a) every person or (b) only Staff/Workers?

5

Initially I thought that the ultimate deployment scenario was that every member/person on Rock will have a userid/password to access Rock.

Now, I am not so sure.  Apart from the (a) Rock Administrators, (b) People who will add/update information, (c) People who will user/reference information like Pastors and workers and (d) people doing check-in (and the list of people/roles as can be found in the Rock system) ,,, does it make sense to setup userid/password for every "active" person in Rock?

(Allowing just about anyone access to Rock also means that I will need to get the External Connector licence from Microsoft on top of the Microsoft Server licence.)

  • Photo of Jon Edmiston

    1

    Found this link helpful:

    http://forums.iis.net/t/1149662.aspx?Licensing+required+for+running+an+IIS+based+web+server

    Quoted:
    "Basically, if you don't intend to authenticate users as Windows users then you don't need any additional CALs.  The external connector license only applies if you need to have users connect to your server as Windows users, say through terminal services or file/print shares."

    ...

    "It depends on the authentication - if you use Windows accounts, then yes you need CALs for those users.  If they are ASP.NET Forms authentication then no."

    Rock users are authenicated via forms authenciation unless you use the Active Directory login provider. Not sure why you'd want to do that though unless you already have users with CALs.

  • Photo of Jay Greentree

    0

    If I read correctly the "External Connector licence " is only required for users logging into the windows server directly/over remote desktop not for website logins.

  • Photo of Michael Garrison

    0

    I agree with Jay's reading- that's what I've seen in the past as well regarding Windows Server licensing.

    I think that you will want to have a separate login for every person who needs Rock access, if for no reason other than being able to revoke a single person's access without messing everyone else up.

  • Photo of Jim Michael

    0

    A couple of days ago I would have said you 100% need External Connector for a public facing web server that had any form of authentication to the web site, as that's the way it's been for quite a while. But yesterday I found this document http://www.picacommunications.com/briefs/SLA_WinServer_ExternalAccess.pdf that seems to indicate the rules for External Connector changed with Windows Server 2012 and became significantly less restrictive. Read it an see what your interpretation is. Mine is that you no longer need EC for "Web workloads" INCLUDING "web applications" (like Rock.) In prior versions of Windows, you didn't need EC for simple web sites but as soon as you allowed people to login, you needed EC. Now it looks like you don't.

  • Photo of Hock_Hin Lee

    0

    I will check with the Microsoft licensing resources again  (Answer at bottom of this post), but at the end of the pdf document (http://www.picacommunications.com/briefs/SLA_WinServer_ExternalAccess.pdf )is a disclaimer that goes as follows:-

    Our interpretations do not always conform with the advice that Microsoft account teams,
    white papers, and other communications give to customers. This document is designed to
    present, to the best of our knowledge, the rules that customers are bound by contract to
    follow. Customers can then decide, when communications from Microsoft appear to diverge
    from our interpretations, how they should proceed.
    Among other things, they can elect to use this information to
    •
    negotiate contract language acknowledging that a specific interpretation of the
    language will apply to their contract, or
    •
    design their operations and architectures around these interpretations of the rules, in
    the belief that Microsoft will not have sufficient grounds to pursue legal action in an
    audit or similar action against the customer, or
    •
    follow Microsoft's advice, if they believe Software Licensing Advisors has not correctly
    interpreted the language that describes these rules, has not made an argument strong
    enough to survive legal scrutiny, or if they want to avoid arguments with Microsoft
    over these rules.
    This document is NOT advice to pursue any particular path, but is intended only to inform
    customers, so that they can take any course of action they deem advisable with greater
    knowledge of what the applicable contract language says. Software Licensing Advisors does
    not provide legal advice and is not responsible for any consequences that might result from
    your pursuing any actions as a result of what you read here.

    ================================

    The MS licensing person says that if MS Server services are used by the Web Application (which will happen when the Web Application (Rock) talks with SQL Express) then Server CAL licences are required!  <<<< Not sure how true/accurate this statement is.

    So far, the best licensing option is to get the MS Server Essentials which comes with 25 CALS (if External Connector licence is needed)