SharePoint adventures

Content deployment fails with guid conflict

AndrasGaal — Thu, 16 Feb 2012 13:57:46 GMT

When setting up content deployment, you might need to start from scratch on the destination side. You delete the sitecollection, create a new one and try running the deployment. The deployment process will fail and log an error that states that the database already contains an item with the same guid.

The reason for this behaviour lies in the way SP2010 works post SP1. The feature is called sitecollection recycle bin. Sitecollections when deleted from the GUI or powershell are marked as deleted but are kept in the DB.

You can see which sitecollections have been deleted by running the Get-SPDeletedSite powershell cmdlet.

To delete these sites from the DB, you need to remove them using the Remove-SPDeletedSite cmdlet. After you have run this, you will need to manually start the Gradual site delete job that will actually delete the content from the DB.

Content deployment job stuck on preparing

AndrasGaal — Tue, 14 Feb 2012 20:35:19 GMT

After you have successfully verified your content deployment job on a newly created farm, and your deployment jobs are stuck on the status Preparing and you see the message Content deployment status not available in the ULS log, just go back to Content deployment settings on Central Admin, make sure something is selected in the export server dropdown and click Ok. Even if you haven’t changed anything. Voliá, content deployment jobs start running.

SharePoint 2010 Master

AndrasGaal — Mon, 17 Oct 2011 18:54:31 GMT

Recently I had the opportunity to take part in the the 9th rotation of the SharePoint 2010 Master course in Redmond. I had big expectations on the course itself, having heard a lot of good things about it. Among the good things every single master I have talked to pointed out the very demanding and challenging nature of the course.

Well, I can definitely say that it has been the most intense three weeks of my technical life. Not only was the content very well built and wide-spread, but the pace of the training was also very fast. Listening to the introductions on the first day I immediately noticed that my fellow master candidates are all very experienced and quite knowledgeable on SharePoint. People attending the course had a very good general knowledge but also contributed with unique areas of expertise that came in very handy later during team exercises.

Time management played a critical role throughout the duration of the master rotation. Starting from the first day, the candidates had to have a perfect knowledge on how much they can handle, what are their strengths and weaknesses, and how to process an awful lot of information while keeping a healthy balance between learning and relaxation. When you are surrounded with a technical topic for more than 10 days for 12+ hours a day, it is critical to find a way to maintain your concentration and keep some reserves for the qualification lab and knowledge exam.

Speaking of exams, both the qual lab and the knowledge exams were very demanding. And again, time management, time management, time management…

Summing it all up, I think it was a well invested effort, I met my calculation and not only learned a lot on SharePoint 2010 and myself, but also met a lot of very bright, fun people!

Oh yes, I almost forgot. I am now certified as a SharePoint 2010 Master!

Deciphering the encoded claims string

AndrasGaal — Tue, 23 Aug 2011 10:17:13 GMT

During a recent claims discussion, it came up how SharePoint 2010 encodes claims into encoded claim strings.

Here’s the answer:

The claim i:0#.w|europe\andrasg translates into:

i: This is an identity claim. Other claims would have the character c here.

:: Colon separator

0: Reserved for later use

#: Claim type = SPClaimTypes.UserLogonName

.: Claim value type = Microsoft.IdentityModel.Claims.ClaimValueTypes.String

You can find the full list of values at:

http://msdn.microsoft.com/en-us/library/gg481769.aspx

These unified encoding values ensure that different farms can understand each others claims. Be aware though that if you use a custom claim type, the encoded string can differ from farm to farm.

Description goes missing on editforms

AndrasGaal — Wed, 27 Jul 2011 21:01:20 GMT

I had some trouble today finding the reason why descriptions set on fields did not show up on the editform. Turned out that Office Toolbox was installed and even though it was not active, made all descriptions disappear.

Retracting the OfficeToolbox wsp solved the problem.

Beware of conflicting field static names

AndrasGaal — Wed, 27 Jul 2011 20:59:08 GMT

Recently I came across a problem where pushdown of changes on a contenttype did not work when doing a feature upgrade. The appropriate AddContentTypeField command was specified in the feature.xml template:

Digging deeper I found no errors when upgrading the feature so I was about to give up when I tried to manually add the field to the contenttype from the UI. I was greeted with a nice exception when clicking “Add from existing site columns”. This error showed up in the ULS log with a trace and callstack. The error message was rather misleading, telling that there is a column that has multiple choice values with the same ID.

Examining my solution I found a few fields that had a StaticName that already existed. This resulted in site columns with the same staticname but a different ID. Cleaning these up made the error disappear.

It’s been a happy SharePoint day.

The good solution for versioning SharePoint 2010 webparts

AndrasGaal — Tue, 19 Jul 2011 01:26:42 GMT

Everyone who has had the pleasure of working in a team with other developers and using TFS with auto-incrementing version numbers most probably have faced the issue with webparts breaking after an increment in version numbers. This effect is not at all strange, as SharePoint keep the full signature of the class behind the webpart and as this changed it will not know how to render the webpart.

To solve this problem, a very easy workaround is to create a class in a separate assembly that inherits from the version-controlled webpart .cs file and implements the actual webpart. This way the non-version controlled part of the code is very thin and SharePoint is still happy with it. Problem of this solution is that it requires and additional assembly file and also generates quite some overhead (SPWebConfigModification class) when packaging your solution.

Come SharePoint 2010, a lot nicer solution is available:

You could even omit the NewVersion tag and have a wide OldVersion range.

One thing to be careful of is keeping old SafeControl entries. If you remove them, assembly redirection will not work as the original assembly will not be loaded. This results in SharePoint also not updating its references to the old assembly version. Also keep in mind that SharePoint updates assembly references page-by-page when they webparts on the page are loaded, so all pages need to be “touched” in order to get rid of old references.

To get around the bug with leading zeros in the public key token’s bytes make sure you are at least on the June 2011 CU.

More info on the issue:
http://www.bluedoglimited.com/SharePointThoughts/Lists/Posts/Post.aspx?ID=313

And the resolution:
http://blogs.msdn.com/b/mcsnoiwb/archive/2011/07/18/assembly-binding-redirection-bug-fixed-in-june-cu.aspx

DataFormWebPart XSL variables are emtpy

AndrasGaal — Wed, 06 Jul 2011 22:18:28 GMT

If you discover that a DataFormWebPart added programmatically is missing values in its built in XSL variables, like HttpVDir or PageUrl, verify that the ViewFlag attribute is set to something other than zero on your webpart. Took me some time to find out… Also, would be nice to know what this property stands for.

What to do when SPContext is null but you need it?

AndrasGaal — Mon, 27 Jun 2011 15:01:55 GMT

Sometimes you stumble upon really strange errors when doing trivial things. When you dig deeper, sometimes it turns out the error comes from the lack of a HttpContext, for example when running some action through STSADM or a timer job.

Recently I faced a strange ArgumentNullException when creating a Content by Query Webpart in C# code. A feature activated event handler was supposed to add a new webpart to a page. Wiring everything up, testing the feature activation through the UI, everything was smooth. As a last step I made the feature hidden and tried to activate the feature through stsadm. And this is where I was left out of luck. STSADM only gave me a very helpful “Value cannot be null”. Digging deeper in the ULS log I caught a callstack which showed that there is some problem getting the SPContext.

To go around this problem, the easiest way is to create a fake SPContext. Waldek and Keith have some great suggestions. The idea is pretty simple:

   1: if (HttpContext.Current == null)

   2: {

   3:   HttpRequest request = new HttpRequest("", web.Url, "");

   4:   HttpContext.Current = new HttpContext(request,

   5:     new HttpResponse(new StringWriter()));

   6:   HttpContext.Current.Items["HttpHandlerSPWeb"] = web;

   7: }

   8: // your code goes here

Be aware that this trick only works when you are working with an SPWeb level object. When dealing with SPList or lower hierarchy items you need to go an other way.

Publishing start and end dates are set brute force

AndrasGaal — Tue, 26 Apr 2011 21:18:10 GMT

When setting publishing start and end dates on a publishing page, these dates will be saved in the PublishStartDate and PublishEndDate fields of the publishing page. Changing the scheduling settings will result in an immediate change of the page (with the modified by and modified date properties set as well), regardless of the state of the page (draft, pending, etc.).

An interesting anomaly I have faced recently (and the source of this discovery) was that when using custom field controls to values of some custom fields and trying to access the values of PublishStartDate or PublishEndDate, these fields contain the values that were present on the ListItem when the pagelayout used to edit the publishing page has loaded.

So imagine the following flow of user actions:

Open page for editing
Use the Schedule button in the ribbon
Set some scheduling dates and click ok
The modal dialog disappears (and your page loads some info through JavaScript from the server)
Save the page
Field controls are asked to provide values of their controls so these can be saved to the appropriate field

At this point I would expect that the following code would return the dates set in step 3:

   1: public override object Value

   2: {

   3:     get

   4:     {

   5:         SPFieldDateTime pubStart = base.Fields.GetFieldByInternalName("PublishStartDate") as SPFieldDateTime;

   6:         return ListItem[pubStart.Id];

   7:     }

   8:     set

   9:     {

  10:         base.Value = value;

  11:     }

  12: }

Interestingly this is not the case, the values set in step 3 are not retained. My logic would tell me that the ListItem object would be built from scratch at step 5 resulting in the query of properties (changed in step 3). Any ideas what’s happening here?

Anatomy of page lifecycles in SharePoint 2010 publishing pages

AndrasGaal — Tue, 26 Apr 2011 21:02:27 GMT

As most of you already know, SharePoint 2010 brings a whole load of nice publishing features out of the box. One of these are the handling of publishing pages. Publishing pages are basically .aspx pages that get their content from the listitem associated to them. You can imagine a publishing page much like any other document you would put in a document library. Specialty of these pages is that it stores most of its contents in its properties. If you go ahead and check any publishing page in the Pages document library you will find columns like Page Content, Title, Page Image. These are inserted into the “slots” of the page layout associated with the content type of the publishing page. These slots (content placeholders) are defined in page layouts by using field controls.

Going back to our original topic, these publishing pages behave pretty similar to documents in terms of lifecycle management. Every document has the following aspects of lifecycle properties:

version (major and minor)
check-out state: checked-out (long-term or short-term), checked-in
approval state: draft, pending, rejected, approved, scheduled

Let’s take versions for first. When enabling major and minor versioning (default on the Pages document library on publishing sites) every document starts with version 0.1. Minor versions (0.1, 0.2, 1.1, 1.2, etc.) can only be seen by users with editor rights on the page. Major versions can be seen by read-only users as well. This provides with a nice way of preparing content for general consumption while not showing anything to unauthorized users.

A typical workflow would be:

0.1 --- save ---> 0.2 --- save ---> 0.3 … any number of minor versions …. --- publish ---> 1.0

When reaching a major version the page content will be visible to users with just read permissions. This version of the page will remain visible until an other major version is published. The tricky thing is that if you go ahead and edit version 1.0 and save (check-in) SharePoint will create a version 1.1 while still showing version 1.0 to read-only users. This way you can continue preparing your version 2.0 and only show it to users when you feel like it’s ready.

Check-in and check-out provides a simple way of letting other editors know that you are working on a specific page. While a page is checked out to you, no other editor will be able to edit the page. Users with editor rights can Undo checkout which means that changes to a page (content and also changes in webparts) will be undone and checked-in state will be restored.

Approval state complicates the picture by introducing a new attribute to versions. Content approval can be enabled without using versions as well, in this case it functions as a yes-no switch on the visibility of the page to read-only users. Things get more complicated when using major and minor versions. A usual version flow would be as follows:

0.1 draft --- save ---> 0.2 draft --- save ---> 0.3 draft … any number of draft minor versions … --- publish ---> 1.0 pending --- approve ---> 1.0 approved

Content approval is started as soon as you publish a major version. After the page is approved, read-only users will start to see the modifications made since the last approved major version.

Content approval scheduling (or simply scheduling) adds a way to postpone the approval process to a specific time. During this time the status of the page will be 1.0 scheduled to show that it will be visible to read-only users at a later time. Scheduling works by employing a scheduled job that runs every minute and checks if the Publishing start date (or Publishing end date) has been reached. If yes, the job sets approval on the page accordingly.

Setting Modified by, Editor and other fields when versioning and content approval is enabled

AndrasGaal — Tue, 26 Apr 2011 20:08:18 GMT

Most of you are probably aware that setting fields like Modified, Editor, Created and Author require some special attention:

   1: using (SPSite site = new SPSite("http://sp2010"))

   2: using (SPWeb web = site.OpenWeb())

   3: {

   4:     SPFile f = web.GetFile("/Pages/default.aspx");

5:

   6:     f.Item["Modified"] = DateTime.Now.AddDays(-2);

   7:     f.Item["Editor"] = "-1;#SHAREPOINT\\SYSTEM";

   8:     f.Item.UpdateOverwriteVersion();

   9: }

So far so good. What happens when content versioning is enabled? calling UpdateOverwriteVersion() results in a new minor version and the approval state going to Pending. The best I could figure out is the following:

   1: using (SPSite site = new SPSite("http://sp2010"))

   2: using (SPWeb web = site.OpenWeb())

   3: {

   4:     SPFile f = web.GetFile("/Pages/default.aspx");

5:

   6:     f.Item["Modified"] = DateTime.Now.AddDays(-2);

   7:     f.Item["Editor"] = "-1;#SHAREPOINT\\SYSTEM";

   8:     f.Item.UpdateOverwriteVersion();

9:

  10:     f = web.GetFile("/Pages/default.aspx");

11:

  12:     f.Item.ModerationInformation.Status = SPModerationStatusType.Approved;

  13:     f.Item.Update();

  14: }

Using this method you can set all fields but the Modified date, which will be set to the time of the approval.

The mystery around Excel Services and the Secure store

AndrasGaal — Wed, 19 Jan 2011 01:10:08 GMT

Sooner or later in the life of a SharePoint admin there will be a time when the dreaded Secure Store Service will have to be configured. Usually this time comes when Excel Services has to be configured to map certain users to a predefined account to enable data refresh.

When using Excel Services data refresh can happen in the following ways:

Using user account delegation
Using a predefined account
Using anonymous connection

Let’s look at each of these methods in detail:

User account delegation

When using delegation, Excel Services will attempt to use the logged on user’s identity to authenticate to the external data source.

In SharePoint 2007 delegation worked by using Kerberos Constrained Delegation (CD). A big drawback of this solution was that it had to be configured end-to-end, so the Web Application had to support it, Excel Services had to be configured, the external data source had to be configured and also quite some work was needed with (fake) SPNs and delegation rules.

Fortunately this has changed quite a lot in SharePoint 2010. With the use of claims based authentication, delegation got a lot simpler. As long as you are using Claims – Windows Authentication on the Web Application and have the Claims to Windows Token Service (C2WTS) configured no double-hop scenario is produced and authentication delegation can succeed.

Predefined account

When using a predefined account, Excel Services will use the account you have configured to access the external data source. This account can be any account you specify. You will need to take care of updating the password of this account when it changes.

Anonymous

It’s pretty self-explanatory, Excel Services will not attempt to authenticate against the external data source.

Influencing which of these methods Excel Services will be using can be a little tricky. Excel Services will use what it is instructed to use in the connection definition. To complicate things even further this connection definition could be in a separate file (eg: .odc file in a data connection repository) or embedded in the Excel file. If the Excel file contains a reference to a connection definition file it will be used.

The most important setting in the selection process is set on the following panel:

The settings are:

Windows Authentication
SSS
None

So what do these mean?

Windows Authentication

Excel Services will try to delegate the logged on users’ identity to the external data source. This will only succeed if the following are true:

The Web Application you are using is set to Claims – Windows Authentication (NTLM or Negotiate)
C2WTS is configured and running
Kerberos authentication and constrained delegation are configured from the C2WTS identity to the external data source.

In SharePoint 2007 using this setting was only possible after Kerberos Constrained Delegation was fully configured for the whole path (user – Web Application – Excel Services – external data source).

SSS (SSO)

When choosing this authentication method Excel Services will use the Secure Store Service to find a Target Application ID matching what you enter here. Credentials you have set for this application will be used to access the external data source. As this practically breaks the hops into one-hop journeys, there’s no need for Kerberos configuration.

None

Usually this choice causes the most headaches when not configured properly. In this case the authentication scheme specified in the connection string will be passed to the database provider. In case Windows Authentication is specified in the connection string, the Unattended Account will be used. If a specific username and password is set, those will be used.

In case the Unattended Account is selected, Excel Services will try to go to the Secure Store Service and fetch a credential identified by the Unattended Account Application ID in the Excel Services Settings page:

So now we understand where Excel Services is looking for the credential to use. What happens when Excel Services tries to fetch a credential from the Secure Store Service? To understand what’s happening, let’s separate the case when SSS is set in the connection and when None is set and the Unattended Account is used.

SSS – in this case Excel Services looks up (in the context of the logged on user) the target application in the Secure Store Service and verifies if the current logged on user is amongst the credential owners of the target application. If not, you will get an Access Denied exception similar to the following in the ULS log:

The Microsoft Secure Store Service application Secure Store Service Application failed to retrieve credentials. The error returned was “Access is denied”.
None – in this case Excel Services will be using the Unattended Account specified in Excel Services settings. The target application will be looked up, but in this case the context of Excel Services will be used. So when specifying the Credential Owner of the target application, add the service account of Excel Services as well.

As you can see it is pretty important to set the Credential Owner for the target application. Unfortunately I haven’t found any good way to change the Credential Owner after creating the target application. I have also not found a way to find out what account you have set to be used to access the external data source. This makes configuring the target application a bit tricky…

SharePoint and the favicon

AndrasGaal — Tue, 14 Dec 2010 15:17:00 GMT

Setting a page’s favicon is pretty easy in 2010:

<SharePoint:SPShortcutIcon runat="server" IconUrl="/_layouts/images/favicon.ico"/>

Now try this with an icon coming from the Style Library:

<SharePoint:SPShortcutIcon runat="server" IconUrl="/Style Library/favicon.ico"/>

You think you have nailed it, right? Fire up IE8 running on XP and you’ll see it won’t appear.

Here’s the fix:

<SharePoint:SPShortcutIcon runat="server" IconUrl="/Style%20Library/favicon.ico"/>

Took me some time to figure out…

Error creating a sitecollection when using custom claims providers

AndrasGaal — Thu, 18 Nov 2010 19:06:02 GMT

Just came across a problem where the creation of a site collection would fail with no real informative error message. If you are using custom claims providers you might be running into the situation described in Steve Peschka’s blog:

http://blogs.technet.com/b/speschka/archive/2010/11/15/problems-resolving-claims-names-in-sharepoint-2010.aspx

Most probably the problem is that the claims provider doesn’t handle the user “NT AUTHORITY\authenticated users” well.

Using long usernames in profile import

AndrasGaal — Thu, 28 Oct 2010 21:52:33 GMT

Today I discovered a really weird thing on profile import. If you try to set the connection account to an account with a name longer than 20 characters, profile import will claim that the username or password is invalid. In this case, try entering the “pre-Windows 2000” logon name of the account (which is by default the user logon name trimmed to 20 chars).

Voilá.

Took me a few hours to figure out…

Setting the super user account on SharePoint 2010 and getting Access Denied errors afterwards

AndrasGaal — Thu, 30 Sep 2010 21:13:50 GMT

By default after installing SharePoint 2010 you will probably soon encounter the following two error messages in the Application log:

Object Cache: The super user account utilized by the cache is not configured. This can increase the number of cache misses, which causes the page requests to consume unneccesary system resources.
To configure the account use the following command ‘stsadm -o setproperty -propertyname portalsuperuseraccount -propertyvalue account -url webappurl’. The account should be any account that has Full Control access to the SharePoint databases but is not an application pool account.
Additional Data:
Current default super user account: SHAREPOINT\system

Object Cache: The super reader account utilized by the cache does not have sufficient permissions to SharePoint databases.
To configure the account use the following command 'stsadm -o setproperty -propertyname portalsuperreaderaccount -propertyvalue account -url webappurl'. It should be configured to be an account that has Read access to the SharePoint databases.
Additional Data:
Current default super reader account: NT AUTHORITY\LOCAL SERVICE

Source of the error is as the Technet documentation says:

By default, the Portal Super User account is the site’s System Account, and the Portal Super Reader account is NT Authority\Local Service. There are two main issues with using the out-of-box accounts.

The first issue is that some items get checked out to System Account, so when a query that includes these items is made, the checked out version of the item is returned instead of the latest published version. This is a problem because it is not what a user would expect to have returned, so the cache has to make a second query to fetch the correct version of the file. This negatively affects server performance for every request that includes these items. The same problem would occur for any user who has items checked out, if that user’s account was set to be the Portal Super User account. This is why the accounts configured to be the Portal Super User and the Portal Super Reader should not be user accounts that are used to log into the site. This ensures that the user does not inadvertently check items out and cause problems with performance.

The default Portal Super Reader account is NT Authority\Local Service, which is not correctly resolved in a claims authentication application. As a result, if the Portal Super Reader account is not explicitly configured for a claims authentication application, browsing to site collections under this application will result in an “Access Denied” error, even for the site administrator. This error will occur on any site that uses any feature that explicitly uses the object cache, such as the SharePoint Server Publishing Infrastructure, metadata navigation, the Content Query Web Part, or navigation.

So keeping these values on their default value on an intranet/extranet portal is not such a good idea. Let’s go ahead and set these two, according to the suggestions in the error message!

stsadm -o setproperty -pn portalsuperuseraccount -pv DOMAIN\user -url http://webappurl
stsadm -o setproperty -pn portalsuperreaderaccount -pv DOMAIN\user -url http://webappurl
iisreset

After doing so, you’re either done, or – in case you are in claims mode – will see Access Denied on all pages on the webapplication you set the accounts.

Moral of the story: if you are in claims mode, you will need to use the claims user name (i:0#.w|domain\user).

Relevant sections of the Technet article:

14. Make note of how the names for the Object Cache Super Reader and Object Cache Super User accounts are displayed in the User Name column. The displayed strings will be different depending on whether you are using claims authentication for the Web application.

Copy the following code and paste it into a text editor, such as Notepad:

$wa = Get-SPWebApplication -Identity "<WebApplication>" 
$wa.Properties["portalsuperuseraccount"] = "<SuperUser>" 
$wa.Properties["portalsuperreaderaccount"] = "<SuperReader>" 
$wa.Update()

Replace the following placeholders with values:
- <WebApplication> is the name of the Web application to which the accounts will be added.
- <SuperUser> is the account to use for the Portal Super User account as you saw it displayed in the User Column field mentioned in Step 14 of the previous procedure.
- <SuperReader> is account to use for the Portal Super Reader account as you saw it displayed in the User Column field mentioned in Step 14 of the previous procedure.

SharePoint 2010 Kerberos Guide

AndrasGaal — Tue, 31 Aug 2010 23:50:17 GMT

A really comprehensive guide on SharePoint 2010 identity scenarios. It is a must read for everyone planning a SharePoint 2010 deployment.

Grab it from here: http://download.microsoft.com/download/B/B/F/BBF0C6F3-6E36-4979-8C43-DE165AD7AE34/SP2010 Kerberos Guide.docx

Getting the User Profile Sync Service running on SharePoint 2010

AndrasGaal — Wed, 16 Jun 2010 22:59:21 GMT

If the User Profile Sync service is causing you constant headaches, here’s a mini howto for getting it work:

Keep things together – Stop all instances of the User Profile Service (UPS) and User Profile Sync Service (UPSS). If the UPSS is stuck in starting state, look for a One-Time job named User Profile Service provisioning (unprovisioning) job. My general recommendation is to have only one instance of the UPS running. You should also have only one instance of UPSS running in your farm!
Usually it’s a wise decision to start from scratch – This means to remove the User Profile Service Application (UPA) and get a new one. This of course means that all what you have synced so far will have to be synced again. Be warned!
Make sure your farm account is amongst the Local Administrators on the computer you wish the UPSS to be running on. Don’t forget to restart the SharePoint 14 Timer Service (or restart the whole box) after changing the group membership!
Make sure you don’t have remains of previous Sync, Profile or Social DBs.
Again make sure, all UPS and UPSS are stopped on all servers in your farm
Create a new UPA
Grab ULSViewer (get it from here) and set a filter to Category contains “profile” and start monitoring your ULS log on the box you want to start ULSS on.
Start ULSS – type your farm account password.
Watch ULSViewer for any problems

If your ULSS has started successfully and all your services are on the same box, don’t forget to do an IISRESET. If you miss this step, clicking the UPA in Manage Service Applications results in an unknown error with the ULS log containing:

UserProfileServiceUserStatisticsWebPart:LoadControl failed, Exception: System.IO.FileLoadException: The located assembly's manifest definition does not match the assembly reference.

Federation extensions for MOSS2007

AndrasGaal — Tue, 01 Jun 2010 19:15:00 GMT

The Geneva team has just released a package to support MOSS 2007 deployments with ADFS 2.0.

Announcing the RTW of Federation Extensions for SharePoint 3.0 !!

It even includes RMS config!

ADFS 2.0 RTW

AndrasGaal — Thu, 06 May 2010 08:29:58 GMT

ADFS 2.0 has RTMed. You can grab it here: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=118c3588-9070-426a-b655-6cec0a92c10b

You can also find the Geneva team’s announcement here: AD FS 2.0 is here!

Setting up SharePoint 2010 Excel Services to get external data

AndrasGaal — Tue, 04 May 2010 19:25:23 GMT

Some of you out there might just want to run as far as possible when having to configure SharePoint 2007 Excel Services to refresh data from an external SQL or OLAP source using the logged on users’ credentials.

The process involved configuring SPNs for quite some services, taking care of delegation, configuring ECS to use Kerberos and then usually a lot of hair pulling and tracing using netmon.

The reason for using Kerberos is quite simple: you need Kerberos to work around double or multi-hop authentication scenarios. For example in 2007, the user authenticated to the web frontend (1 hop), the web frontend contacted ECS running under the SSP (2 hops) which in turn went back to fetch data from the SQL Server or Analysis Services (3 hops).

Good news is that in SharePoint 2010 things got quite simple thanks to claims based authentication. As you might know SharePoint 2010 does claims based auth among its components, so the whole 2-3-many hops problem is now eliminated.

SharePoint 2010 solves this by having the user authenticate to the web frontend (either using Kerberos or NTLM – note: SAML won’t work here!) and then continuing to the Excel Services web service app using claims based auth. Thanks to claims, doing multiple hops is not a problem. The interesting part in continuing with the request is when ECS wants to fetch the necessary data from the external data source. As SQL and Analysis Services cannot be accessed using claims based auth (this changes in 2008R2 – Reporting Services will support it in SharePoint integrated mode) some magic is done and the claims token is converted back to a Windows (Kerberos) token. This magic is done by the service called Claims to Windows token service (c2wts) which is installed by default in SharePoint 2010.

In order for c2wts to work, you need to make sure, that the user running this service is trusted to transform claims to windows tokens by verifying the following in c2wtshost.exe.config (usually in C:\Program Files\Windows Identity Foundation\v3.5):

<?xml version="1.0"?>
<configuration>
  <windowsTokenService>
    <allowedCallers>
      <clear/>
      <add value="WSS_WPG" />
    </allowedCallers>
  </windowsTokenService>
</configuration>

Usually when setting the C2WTS to a custom domain account, it is added to the WSS_WPG group, so probably you won’t need to modify the config.

To successfully authenticate to the external datasource, first it needs to be configured to support Kerberos auth (for SQL: Using Kerberos Authentication with SQL Server, for Analysis Services: How to configure SQL Server 2008 Analysis Services and SQL Server 2005 Analysis Services to use Kerberos authentication).

Next step is to allow the service account running the c2wts service delegation to the external data sources. This can be done on the delegation tab of the user account properties in Active Directory Users and Computers (ADUC).

Lastly configure delegation from the account running Excel Services to the external data sources.

Now you only need to make sure that the Excel Services calculation method is set to “Impersonate” and the document library in which your xlsx file resides is included in the trusted locations of ECS.

If everything is right, data refresh should succeed. If not, refer to the ULS log for errors.

UPDATE (05/14): Fiddling with the c2wts service I discovered that it only works if the Windows service is set to LocalSystem identity. If you give it a custom identity it fails with:

SPSecurityContext.WindowsIdentity: Could not retrieve a valid windows identity for NTName='test\user', UPN='user@test.local'. UPN is required when Kerberos constrained delegation is used. Exception: System.ArgumentException: Token cannot be zero.    
at System.Security.Principal.WindowsIdentity.CreateFromToken(IntPtr userToken)    
at System.Security.Principal.WindowsIdentity..ctor(IntPtr userToken, String authType, Int32 isAuthenticated)    
at System.Security.Principal.WindowsIdentity..ctor(IntPtr userToken)    
at Microsoft.IdentityModel.WindowsTokenService.S4UClient.CallService(Func`2 contractOperation)    
at Microsoft.SharePoint.SPSecurityContext.GetWindowsIdentity().

Stay tuned for an update on this. Running C2WTS under LocalSystem will trip a health validator rule in SharePoint and you’ll get a warning.

There’s a quite good article over at technet on this topic: Configure Kerberos authentication for the claims to Windows token service (SharePoint Server 2010). Worth a read.

UPDATE (06/17): Lee Graber has a nice writeup on the topic Claims to Windows token topic: Testing the Claims To Windows Token Service for different identities.

On the same note, the required user rights for the account running the C2WTS are “Act as a part of the operating system” and “Logon as a service”.

UPDATE (09/01): The SharePoint 2010 Kerberos Guide has a good summary of all necessary settings. To get c2wts working under a domain account instead of LocalSystem, give the account the following permissions on the box running the service. Don’t forget to restart the service after granting the rights!

Act as part of the operating system
Impersonate a client after authentication
Log on as a service

To revert back to LocalSystem use the following PowerShell commands:

$claims = Get-SPServiceInstance | where {$_.TypeName -eq "Claims to Windows Token Service"} 
$claims.Service.ProcessIdentity.CurrentIdentityType = 0 
$claims.Service.ProcessIdentity.Update()

UPDATE (09/26/11): Reviewed some parts of the article and corrected a few things. Thanks Mads for the hints!

delegation will only work if you have Claims – Windows auth (either NTLM or Kerberos) but not ADFS (SAML)
usually there’s no need to fiddle with the c2wts config.