Forum Discussion

Daniel Westerdale's avatar
Daniel Westerdale
Iron Contributor
Feb 21, 2018

Setting up WOPI Binding to Office Online Server Multi-server (not load balanced)

Hi   I have inherited and existing on-premises farm infrastructure that consists of a pair of load balanced SharePoint 2016 WFEs with each having a single Office Online Server (OOS) instance.  Th...
2016
SharePoint Online
sharepoint server
Trevor Seward's avatar
Trevor Seward
MVP
Feb 21, 2018
Each client must be able to access OOS directly via HTTP or HTTPS (I highly recommend using SSL end-to-end with OAuth tokens); each SharePoint server also must be able to access OOS as the binding is farm-wide, not for a particular SharePoint server in the farm. This also means you should put in a trusted certificate, either issued from a public CA or an internal CA that your client PCs trust.
  • Daniel Westerdale's avatar
    Daniel Westerdale
    Iron Contributor
    Feb 21, 2018

    Hi Trevor Seward

     

     

    Thanks,  I rechecked my config this morning and discovered a couple of things

     

    1. The external url  I had configured when I created the farm was incorrect as there wasn't a DNS entry for each OOS. Not an issue as not allowing external access.
    2. The main show showstopper is exactly as you have stated no clients  can access OOS on port 443. Looks like we missed the firewall rules for OOS when as part of a previous installation. 

    If I put in a RFC in tomorrow,  then a part from ports: 80 and 443 , are there other ports OOS needs to communicate with clients that you can think of?

     

    We do have the option for internal CA but I have testing with self-certs, which I export as ".cer" and import into the  Trusted Hosts on each of WFEs.  I assume this is ok.   

    Looking at DNS with entries per OOS verses Load balancer  -  going to test with the single instances ( each bound to a single WFE) when the rules are in place and give the business the option.

    • Trevor Seward's avatar
      Trevor Seward
      MVP
      Feb 21, 2018
      Only expose tcp/443. For the certs, your client also needs to trust the cert itself. This means you'd need to import the self-signed cert to each client. I'm not sure what you mean 'bound to each FE'. You can only have a single OOS farm (be it one or more servers) per SharePoint farm.
      • Daniel Westerdale's avatar
        Daniel Westerdale
        Iron Contributor
        Feb 21, 2018

        OK, lets clarify things from my perspective .  The client is any intranet user  who needs to render an office document that is hosted on premises - they don't need a cert import as far as know . I  have only exported the cert created on a OOS instance onto the WFE in the same data centre . Repeat this config per data centre.

         

        When I refer to the OOS farm , I mean going on to each OOS instance and running

        New-OfficeWebAppsFarm -InternalUrl "https://oosa.contoso.com" -ExternalUrl "https://oosa.constso.com" -CertificateName "OfficeWebApps Certificate" -EditingEnabled

        Then repeating for the other OOS instance (oosb.contoso.com) .  I don't think it is possible to configure a multi-server OOS farm as there is currently no LB IP address available.

Resources