Things that Should be Easy

Stormy Skies for Cloud Computing

2009-10-27T16:06:00.001-04:00

I don’t know about you, but I’m somewhat confused about all the hype over “cloud computing”. Don’t get me wrong, accessing services on the Internet makes sense, sometimes. What I don’t understand is how many people tout cloud computing as the silver bullet for all of our IT ills; you know, the way virtualization was supposed to solve all of our problems? That will be a different post. Back to the point. The Web 2.0 Journal has a nice enumeration of the benefits to cloud computing. First I’d like to comment on these benefits.

What the vendors tell you

“Reduced Cost - Cloud technology is paid incrementally, saving organizations money.“

My comment: It depends on what cost your talking about. Making use of hosted services provides a cost-effective way to start initially deploying a capability to your organization. However, it’s like renting an apartment vs. buying a house: you never stop paying rent. The service fee is a constant monthly expense that never goes away. Need a second service? There’s another monthly fee. The problem of course is that you never actually get ROI with this model. It’s more like a reverse ROI. You start out ahead of the game because you had few start up costs. But after a few months, you get further and further behind, because at some point you’ve paid as much in service fees as it would have cost to do the implementation in house. And you keep on paying. Indefinitely.

Check out my post on getting started with SharePoint on the cheap where I show how you can get started with SharePoint in house for $1100, with no recurring costs. That setup will support between 500 to 1000 users and provide over 100 GB of storage. Comparable hosting plans would cost between $55-$80 per month (more if you exceed the small amount of storage that comes with most plans by using document versions). That means that the in-house implementation of SharePoint would actually come out cheaper than the hosted option somewhere between 14 to 20 months. ROI within 18 months is considered good in the industry.

“Increased Storage - Organizations can store more data than on private computer systems.”

My comment: Storage is cheap. In fact, storage is one of the cheapest IT commodities you can buy today. You can get 4 TB of business-class storage for under $6,000. Compare that to a hosted SharePoint service offering with only 1 TB of storage for $4,000 per month. What IT commodity is significantly more expensive than storage? WAN bandwidth. Cloud computing model uses WAN bandwidth like it’s going out of style. See the “What the vendors don’t tell you” section of this post for more on the topic.

“Highly Automated - No longer do IT personnel need to worry about keeping software up to date.”

My comment: There is an obsessive compulsive disorder in IT circles called “software updates”. Many administrators think that they need to apply the latest hot fix or service pack the moment it comes out. It’s ok to talk about it. I had this problem too. Do you know what I discovered happens if you don’t apply most of these updates? Absolutely nothing. Servers keep running. In fact, by not applying the latest update you mitigate the risk of that update breaking your application. So, while letting the hosting provider keep the software up to date is nice, it is of questionable business benefit and can lead to misbehaving applications or unexpected downtime.

“Flexibility - Cloud computing offers much more flexibility than past computing methods.”

My comment: I have a few thoughts on this one. First, while cloud computing can provide more flexibility, more flexibility is not necessarily better. If an in-house system has enough flexibility, adding more flexibility may not offer any business benefit. Second, the most inflexible part of an organization may be the people. Every time you something in IT changes, users need to get retained. That training is time consuming and costly (time = money) . Third, Has anyone asked why there is a need for so much flexibility? Could it be a symptom of poor planning? Why not deal with the problem’s root cause rather than the symptom?

“More Mobility - Employees can access information wherever they are, rather than having to remain at their desks.”.

My comment: This is great, but you don’t need to have your service hosted in the cloud. Get an Internet domain name and a DNS service like No-IP Plus ($25 per year). You can make your in-house web application Internet-accessible in less than an hour.

“Allows IT to Shift Focus - No longer having to worry about constant server updates and other computing issues, government organizations will be free to concentrate on innovation.”

My comment: See my comment in the "Highly Automated“ section for my thoughts on chasing server updates. We have AD, Exchange, SharePoint, SQL Server, and TFS in house, and have no full-time IT support personnel. How do we do this? By keeping our filthy hands off of the servers. Best of all, we don’t need to pay hosting service fees for the privilege of not touching the servers. Not monkeying with existing servers allows us to focus on delivering new capability.

Next I’d like to add a one more item people often attribute to hosted systems and comment on that item: “Increased reliability”. There a general feeling that service providers in the cloud can do a better job of ensuring system uptime than other organizations can. In some cases I think this is true, especially when taking about specialized hosting companies. However, many cloud service providers do not fall into that category. Remember the now infamous T-Mobile Sidekick data loss incident? I guess “carrier-grade” doesn’t mean what it used it. There is no guarantee that a service providers will do a better job of ensuring service reliability than you will.

Along the same lines as service reliability is “service availability”. While service reliability refers to the service running, service availability refers to users actually being able to get to the service, two completely different things. When the service is running on the same LAN as the users, service availability pretty much equals service reliability. I.e., if the service is running users can most likely get to the service. It’s a different story when the service is running in the cloud and users need to access the service over the WAN. Lets face it, Internet connections go down. Speeds fluctuate. Granted, downtime for this reason doesn’t happen often, but when it does things can be very frustrating.

What the vendors don’t tell you

Now I’d like to point out some of cloud computing’s dirty little secrets. Few people in the industry talk about these, and customers don’t find out until after they’ve signed a 1-year contract.

Single sign-on

Single sign-on (SSO) is the concept that a user has to enter his or her credentials into one system, and that the credentials would get propagated into all other systems that the user needs to access. For example, a user would login to his or her desktop computer and would be able to access the organization’s email and portal systems without additional logins. For most organizations running Microsoft software in-house, this is a daily reality because all of the organizations systems are running off of the same user directory service, the organization’s Active Directory. But what happens when the organization makes use of the hosted service in the cloud? That service has its own usernames and passwords. Users now have an additional login for the hosted service. Web browsers can help by caching user credentials on their desktops, but there are other desktop applications that don’t do as good a job with that. The issue multiplies as the organization adds additional services, each service requiring its own username and password.

WAN vs. LAN bandwidth

How much bandwidth do most organizations have on their LANs? Most have 1000 Mbps. How much bandwidth do these organizations have on their WANs? Usually less than 10 Mbps. That means that most organizations have roughly 100 times the bandwidth on the LANs as no their WANs. That’s important since the organizations’ users access cloud services through the WAN. Users will perceive even well-implemented cloud services as being much slower and unresponsive as compared to mediocrely implemented in0house services. The cloud service is slower, the problem lies with the users’ limited bandwidth in accessing the cloud service.

WAN vs. LAN reliability

How often does your LAN go down? How often does your WAN go down? Imagine losing access to all of your organization’s services in the event of an Internet connection loss? More is available in the previous section of this post titled “service availability”.

System integration

One of the best outcomes to increasing numbers of software vendors’ adoption of open interfaces and API standards in their software is customers’ ability to make the systems their organizations rely on to operate as a single system, rather than a collection of desperate applications. New business capabilities like business intelligence were now possible. What if an organization wanted this capability but relied on hosted services for some of its systems? Let’s say that an organization had an internal Active Directory and mail system, but made use of one vendors hosted ecommerce service and another vendor’s hosted CRM service. Seems reasonable so far? The organization wants to to answer a simple question: how many customers who have purchased from the organization within the past 6 months have emailed their sales representative directly after a purchase? This question requires data from the AD, email, ecommerce, and CRM systems. Getting to that data is hard, because the CRM and ecommerce systems must be accessed over a WAN connection. This makes the processes of getting to the vast data the systems hold very painful. We also hope that there is some way to correlate the various data entities between the systems: orders, customers, email addresses, sales people, etc.

Conclusion

There’s a lot of buzz about delivering software as a service (SaaS). I think that SaaS / cloud computing / utility computing will definitely be a good delivery model for some types of computing capabilities. But, there are just too many benefits to running services co-located with users to make locally running services go away anytime soon. My colleague, Brad Smith came up with a much better alternative to either model: localized software as a service (LSaaS). Briefly put, the LSaaS software delivery model makes use of hosted services as a pure SaaS model does. However, rather than users accessing a hosted service directly, the LSaaS model places an extension to the hosted service into an organization’s office. Users access the service local extension over the LAN. That service extension may communicate with the hosted service in the cloud on an as-needed basis. See my previous post on how an LSaaS software delivery model can simplify software licensing and copy protection while avoiding the pitfalls with a pure SaaS delivery model. I believe that more and more vendors will start using the LSaaS software deliver model in the next few years.We certainly will.

Technorati Tags: SaaS,Cloud computing,Utility computing,LSaaS

The Next Web: Twitter-Facebook AND Twitter-Microsoft deal confirmed

2009-10-21T13:08:00.001-04:00

The Next Web reports that a deal between Twitter and Microsoft will be announced at the Web 2.0 Summit.

“What’s particularly unique is the deal is with both Microsoft AND Facebook and the company plans to integrate deeply with both company’s products and services, namely Bing and Facebook.com.”

Microsoft has already announced Twitter and Facebook integration with XBox Live. What’s next? Twitter and Facebook integration with SharePoint 2010? Here’s hoping. That would make for some real SharePoint 2010 cloud integration.

Technorati Tags: Microsoft,Twitter,Facebook,Cloud computing

SharePoint 2010 public beta and general release announced

2009-10-20T15:14:00.001-04:00

Microsoft issued a press release announcing the both the public beta of SharePoint 2010 and its general release. The public beta will be available November 2009, along with the public betas of Office 2010, Project 2010 and Visio 2010. The general release for SharePoint 2010 is slated for the first half of 2010.

From the Microsoft press release:

The public betas of Microsoft SharePoint Server 2010, Office 2010, Project 2010 and Visio 2010 will become available in November 2009; more information is available at http://go.microsoft.com/?linkid=9689707.

Microsoft SharePoint Server 2010 will be available in the first half of 2010. More information about Microsoft SharePoint Server 2010 can be found at http://www.microsoft.com/sharepoint.

Remember that SharePoint 2010 will be an x64-only release. That means you will need to install it onto an x64 version of Windows Server.

Technorati Tags: SharePoint,WSS,MOSS 2007,SharePoint 2010

Watch SharePoint Conference 2009 video highlights on demand

2009-10-20T13:09:00.001-04:00

Do you wish you were at the Microsoft SharePoint Conference 2009? Me too. Watch selected conference video highlights here:

http://www.mssharepointconference.com/Pages/videohighlights.aspx

Tom Rizzo, Senior Director for SharePoint, recaps the news and announcements that Steve Ballmer and Jeff Teper shared with the SharePoint Conference 2009 attendees. He also shared some fun facts that you might not have know about the conference.

Tom Rizzo's News of the Day

Before diving in to the SharePoint 2010 take a moment to look back at the amazing solutions customers have built on Microsoft Office SharePoint 2007.

SharePoint Conference 2009 Opening Video

Hear what our customers are already saying about SharePoint 2010. See what they’re most excited about after trying it out and their plans for future deployment.

SharePoint 2010 Customer Excitement

Watch this short video to see SharePoint Conference 2009 come together on location in Las Vegas and learn what it takes to bring it together, such as the number of labor days and the miles of CAT 5e cable.

Time Lapse Footage

Technorati Tags: SharePoint,WSS,SharePoint Conference 2009,SharePoint 2010,SharePoint Foundation

Watch the SharePoint Conference 2009 keynote on demand

2009-10-20T13:04:00.001-04:00

Do you wish you were at the Microsoft SharePoint Conference 2009? Me too. But, you can watch the keynote here:

http://www.mssharepointconference.com/Pages/default.aspx

The keynote had lots of great content including loads of SharePoint demos such as the new SharePoint UI, Excel Services, Performance Point, FAST Search, and more. See Steve Ballmer, Jeff Teper, and others deliver the first true glimpses of what promises to be the best release of SharePoint ever.

Technorati Tags: SharePoint,SharePoint 2010,WSS,MOSS 2007,SharePoint Foundation,SharePoint Conference 2009

Getting paid for your SharePoint software, part 4

2009-10-20T07:00:00.001-04:00

Part 1
Part 2
Part 3
Part 4 <--- You are here

This is the fourth part of my series on getting paid for your SharePoint software. If you have not already done so, please read part 1, part 2, and part 3.

In part 1, I discussed how you need to be able to do four things to transform a piece of software into a product that you can get paid for:

Distribute the software
Deploy the software
License the software
Copy protect the software

Of these, licensing and copy-protecting the software prove to be the most difficult on the SharePoint platform.

In part 2, I laid out two options that address licensing and copy-protecting SharePoint software:

Licensing and copy-protecting the installer
Licensing and copy-protecting the application assemblies

While the first option is the easiest way to get started, it also provides the least amount of protection and capabilities. The second option is what you would ultimately want to get to, but it can require a significant level of effort to implement, somewhere between several weeks to several months.

In part 3 I showed how we could use a services or cloud computing application architecture to give us additional licensing and copy-protection options beyond what I covered in part 2. Unfortunately, we uncovered new challenges that arise from this architecture, namely:

Customer’s WAN bandwidth limitations
Security and multi-tenancy concerns about the hosted service
User context maintenance and single sign on (SSO)

So does that mean that a services architecture just exchanges one set of problems for another? Not necessarily. In fact, we can see that all of the issues arise from the fact that the service was hosted outside of the customer’s environment and shared among many customers. Let us examine a an alternate approach where the service the web parts access is hosted not on the Internet but in the customer’s network. My colleague Bradley Smith termed this approach as Localized Software as a Service (LSaaS).

Option 4: Localized Software as a Service (LSaaS)

The LSaaS application architecture leverages the benefits on services oriented architecture (SOA) and cloud computing application delivery models. However, LSaaS extends “the cloud” into the customer’s data center. Whereas a SaaS software delivery model requires that all service requests traverse the customer’s WAN to the service vendor’s Internet-based service instance, LSaaS instantiates one or more instances of the service in the customer’s datacenter.

The main advantage of LSaaS over traditional SaaS is that LSaaS gains the benefits that SaaS offers in terms of ease of licensing and copy protection, but LSaaS mitigates the issues that arise with a pure SaaS approach, namely:

Limited WAN bandwidth
Risks of multi-tenancy
Loss of user context when invoking the service

For a more detailed description of these potential issues, please see the “All services all the time?” section of part 3 of this series. Let’s see what our licensing and copy protection options look like:

Licensing – LSaaS licensing options are very similar to the SaaS options discussed in part 3. Additionally, LSaaS software delivery schemes also allow for service-instance-based licensing models. The idea is that each instantiation of your service running at the customer’s site can deliver a well-defined, quantifiable amount of service capacity. If the customer needs additional capacity, they will require additional instances of the service. Each additional service instance requires the customer pay an additional fee.

The key to making this licensing model work is that the service instance must deliver a predictable, quantifiable level of service capacity. How you define the capacity depends on what your service does. Popular capacity quantifiers include data storage, processing speed, processing throughput, Here are some examples of companies using service-instance-based license models to deliver their software as LSaaS:
- Black Blade Associate’s docBlock Ascend (disclaimer: I work for Black Blade)
  
  The docBlock Ascend provides virtual document processing to the SharePoint platform. Black Blade charges a flat fee for each docBlock server appliance. Each appliance has two load-balanced processing modules. For the purposes of licensing, you can think of each processing module as a virtual document service instance. Each processing module (service instance) can process 4 virtual documents per minute. “4 virtual documents per minute” is the quantifiable service capacity per service instance.
  
  If the customer needs to process more than 8 virtual documents per minute, they must order additional docBlock devices. There are no per-user, per site collection, per SharePoint server, or any other types of additional fees or license complexity. Simple huh?
- Google Search Appliance
  
  The Google Search Appliance (GSA) provides enterprise search capability for a variety of content sources. Each GSA is a single service instance and can index 1,000,000 documents, the service capacity. If a customer needs to index more documents, they buy more GSAs.
  
  The SharePoint connectors for the GSA are free and even code with source code. Why doesn’t Google charge for the connectors too? The more document repositories are connected to a GSA, the faster the customer will exceed the GSAs service capacity and buy another GSA.
Copy-protection – As with the SaaS software distribution option discussed in part 3, copy-protection is no longer needed for the web parts or other components deployed to the customer’s SharePoint farm, as these components are just the service client and should be freely distributable.

However, unlike the SaaS option, the LSaaS service instance you are deploying to the customer’s site does need to be copy protected. The best way to achieve this is to create a service deployment model that ensures that only your service is running on a given operating system instance. That way you can write management code that ensures that everything on the operating system instance, including the operating system components, conforms to a valid instance of you service. Black Blade, Google, and other vendors accomplish this copy protection by distributing their service instances as server hardware appliances.
Level of effort - As with the SaaS software distribution option discussed in part 3, the level of effort for actually doing the licensing and copy protection is fairly low. However, architecting or re-architecting an application to use a service model can be high, especially if a high percentage of the application’s codebase makes direct calls into the SharePoint object model. There is also additional effort involved beyond that which was required for a hosted service in creating an administration and management interface for your service instances. While you can get away with running direct SQL queries and editing raw XML files to configure your hosted service, I would strongly advise creating a more end-user friendly administration experience for the LSaaS service instances you deploy to customer sites. If you are going the appliance route for your LSaaS service instances, you will need to become familiar with shell scripting, writing unmanaged (C/C++) code, and WMI.

Which option is best?

It depends. You weren’t expecting a more definitive answer, were you :-) Let me elaborate a bit. If you are just getting started with a product idea, have a product that is mostly user interface, or have limited resources to implement licensing and copy-protection components, I would suggest starting with option 1 (adding licensing and copy protection to the installer only), discussed in part 2 of this series. Once you have a product that is generating some income and you have some more resources to devote to implementing licensing and copy-protection, look at option 2 (adding licensing and copy protection to the installer and the application assemblies), discussed in part 2.

If you have some serious resources you can devote to implementing or revamping your product (say 3-6+ moths worth) and your product provides value through more than just a nice user interface, i.e. the product has a service layer, you will be able to look at option 3 (delivering the product using a SaaS model), discussed in part 3 or option 4 (delivering the product using a LSaaS model), discussed above. Although option 4 has a higher level of effort than option 3, both options require roughly the same magnitude of effort to implement. The key question to ask to determine to which service model (SaaS or LSaaS) you should use to deliver your product is: Where does the bulk of the data the service needs to process reside, at the customer’s site or on the Internet? By that I mean which location has the most data, measured in bytes, that the service needs to act upon, the client’s site or the Internet?

If the bulk of the data, again measured in bytes, resides on the Internet, then you can easily use a SaaS model (option 3) for delivering your software. If the bulk of the data the service needs resides in the customer’s site, then you should use an LSaaS model (option 4) to deploy your service. This is not just an academic exercise. I went through this decision process for each of the products we sell at Black Blade Associates.

Conclusion

This concludes my “Getting paid for your SharePoint software” series. My goal in writing this series was to encourage more developers to start thinking about getting real returns on their SharePoint expertise by monetizing their SharePoint software. A platform like SharePoint can only achieve true success if customers can procure additional platform capability as supported products, not just consulting services. With the impending release of SharePoint 2010, this is a great time to start developing sellable software products for the SharePoint platform.

Technorati Tags: SharePoint,WSS,MOSS 2007,SharePoint 2010

Visual Studio 2010 Beta 2 has new SharePoint 2010 development tools

2009-10-20T07:00:00.000-04:00

Download the Visual Studio 2010 beta and check out the SharePoint 2010 walkthroughs and how to’s here:

http://msdn.microsoft.com/en-us/vstudio/dd441784.aspx

Walkthroughs

How To...

The Catch

What’s the catch? The SharePoint development tools included in Visual Studio 2010 are exclusively for SharePoint 2010. What can you use to accelerate your SharePoint 2007 development today? Check out WSPBuilder. WSPBuilder is an open-source tool and add-in for Visual Studio 2008 that not only automates a lot of the manual tasks of creating a SharePoint solution package (WSP file), but also comes with lots of Visual Studio templates for SharePoint artifacts, like web parts, features, content types, etc…. There’s a great WSPBuilder walkthrough by Tobias Zimmergren here.

Then. look at SharePoint Solution Installer. SharePoint Solution Installer will take any WSP package and wrap it in a very friendly wizard interface. Next, next, next, and the WSP you created using WSPBuilder is deployed to the entire SharePoint farm.

Technorati Tags: C#,SharePoint 2010,SharePoint,WSS,MOSS,Visual Studio,SharePoint Designer

Impersonation options in SharePoint code

2009-10-13T07:05:00.000-04:00

When creating web parts, event receivers, timer jobs and other SharePoint code, I often find that I need to temporarily grant the code more permissions than the current user has. I’ve found that many developers either don’t know what options they have for user impersonation through code or are confused as to the subtle differences between the various options.

Impersonate the application pool identity

WSS V3 introduced the RunWithElevatedPrivileges method of the SPSecurity class. The RunWithElevatedPrivileges method impersonates the identity of the IIS application pool serving the current SharePoint request. The RunWithElevatedPrivileges method accepts a delegate method with no parameters. The RunWithElevatedPrivileges method impersonates the identity of the IIS application pool serving the current SharePoint request just prior to executing the user-specified delegate method. Once the delegate method has completed execution, the RunWithElevatedPrivileges method reverts the identity back to current user identity. Best of all: you don’t even need to know the username or password of the application pool identity. Here is some sample code that deletes a tasks list while impersonating the application pool identity:

Guid siteid = SPContext.Current.Site.ID;
Guid webid = SPContext.Current.Web.ID;
 
SPSecurity.RunWithElevatedPrivileges(delegate()
{
    using (SPSite site = new SPSite(siteid))
    {
        using (SPWeb web = site.OpenWeb(webid))
        {
            SPList taskList = web.Lists["Tasks"];
            taskList.Delete();
        }
    }
});

There are a few gotchas of which you should be aware when using the RunWithElevatedPrivileges method:

You code will need a the proper level of code access security (CAS) permissions in order to run the RunWithElevatedPrivileges method.

While impersonating the IIS application pool identity will give your code the highest level of permission within the current SharePoint web application, your code will have minimal permissions within other SharePoint web applications. This usually makes the RunWithElevatedPrivileges method a poor choice if you need to access a different SharePoint web application from the one in which the code is currently executing.

According to SharePoint deployment best practices, IIS application pool identities should have minimal permissions on the SharePoint web servers. This means that your code may have minimal access to the underlying web server while executing within the RunWithElevatedPrivileges delegate method. You may not be able to do things like write to the Windows Event logs, work with temporary files, access the registry, or any other web server resource that requires a high privilege level.

This method was implemented in WSS V3, so it will be unavailable in WSS V2 or SharePoint Portal Server 2003.

Impersonate the application pool identity, take 2

Update: Thanks to Jonas for correcting me and apologies to Todd for misquoting him.

Todd Bleaker, SharePoint MVP, clued me in to this technique. Normally the .Net Framework System.Security.Principal.WindowsIdentity.Impersonate method accepts an integer value corresponding to a Win32 logon token. However, there is a neat trick you can use with the method: if you pass in a zero pointer (System.IntPtr.Zero), the method will allow your code to run as the identity of the IIS application pool serving the current SharePoint request. As with the RunWithElevatedPrivileges method, you do not need a username or password to do the impersonation. However, unlike the RunWithElevatedPrivileges method, you can use this technique with WSS V2 and SharePoint Portal Server 2003. Here is the same code as in the previous example, but altered to use this impersonation method:

private WindowsImpersonationContext ctx = null;
ctx = WindowsIdentity.Impersonate(System.IntPtr.Zero);
 
using (SPSite site = new SPSite(siteid))
{
    using (SPWeb web = site.OpenWeb(webid))
    {
        SPList taskList = web.Lists["Tasks"];
        taskList.Delete();
    }
}
 
if (ctx != null)
    ctx.Undo();

This impersonation method has the same caveats as the RunWithElevatedPrivileges method technique, except that this will work with WSS V2 and SharePoint Portal Server 2003:

You code will need a the proper level of code access security (CAS) permissions in order to run the impersonation, WSS_Medium, according to Todd Bleaker’s article.

While impersonating the IIS application pool identity will give your code the highest level of permission within the current SharePoint web application, your code will have minimal permissions within other SharePoint web applications. This usually makes impersonating the application pool identity a poor choice if you need to access a different SharePoint web application from the one in which the code is currently executing.

According to SharePoint deployment best practices, IIS application pool identities should have minimal permissions on the SharePoint web servers. This means that your code may have minimal access to the underlying web server while executing within the RunWithElevatedPrivileges delegate method. You may not be able to do things like write to the Windows Event logs, work with temporary files, access the registry, or any other web server resource that requires a high privilege level.

Impersonate a named user account

While you can use the System.Security.Principal.WindowsIdentity.Impersonate method to impersonate the Local System account, the real purpose of the method is to allow you to impersonate named user accounts, such as mydomain\jsmith. The .Net Framework has a nice model for handling the impersonation context once you have a logon token but is somewhat vague on the mechanics of actually getting logon tokens. My RunAs in C# article with source code details how to get these elusive logon tokens and execute your code in the generated impersonation context. The article wraps the LogonUser Win32 API. The main benefit to this approach is that you can execute code as any user you want, as long as you know the user’s username and password. This includes doing highly privileged operations within SharePoint, SharePoint farm servers, or any other server on the network. Here is a code sample that executes a file move using user-supplied credentials:

BlackBlade.Utilities.SecurityUtilities.RunAs(delegate()
    {
        File.Move(“local_file”, “network_file_location”);
    },
    “a_username”,
    “some_password”);

What are the catches:

You need to know the username and password of the account you want to impersonate.

Accessing the Win32 API can generate non-intuitive error messages and be tough to debug.

Finding a secure place to store the username and password of the account your impersonating can be tough. I recommend looking at the MOSS 2007 SSO infrastructure.

Impersonate the Local System Account

Normally the LogonUser Win32 function used to get logon tokens for .Net impersonation requires a domain, username, and password to get a logon token. However, there is a neat trick you can use with the method: if you pass in “NT AUTHORITY” for the domain and “Local System” as the username, the method will allow your code to run as the Local System account. You do not need a password. The Development Hole blog has a great article with code detailing how to impersonate Built-In service accounts. The Local System account can do pretty much anything on any SharePoint server in the farm. As with the other impersonation methods, you will need to manually revert the impersonation context. Here is some code that uses the Impersonate method to write an entry to the local SharePoint server’s Application event log:


using (Impersonation imp = new Impersonation(BuiltinUser.NetworkService))
{
    this.EventLog.WriteEntry("This line would throw an exception for most SharePoint users or even most application pool identities");
}

If this method allows you to impersonate the Local System account and act as a local SharePoint server administrator at will, why would you not always want to use this impersonation method? Here are a couple of reasons:

This method always impersonates the web server’s Local System account, regardless of in which SharePoint web application the code is running. This can make it very difficult to track which web application is accessing the web server’s resources.

In most cases, the Local System account will not have rights to any network resources, including SharePoint content or administrative tasks. While you’ll be able to do anything you want on the local web server, you will not be able to engage in any SharePoint-related activities.

Technorati Tags: WSS,SharePoint,MOSS 2007,C#

VMware Workstation networking not working in Windows 7

2009-10-08T12:12:00.001-04:00

I just upgraded my Vista x64 computer to Windows 7. When I started VMware Workstation 6.5.3 for the first time after the upgrade and launched a virtual machine, VMware displayed the following error:

The virtual network drivers on the host are incompatible with the installed VMware application. Expected version 5. Please reinstall the product.

The error sounds a lot worse than it actually is. Turns out that all I had to do to get things working was run a repair on VMware Workstation. You will need the VMware Workstation installation program. Do not run the repair option from the Programs and Features section of the Windows 7 Control Panel. If you do, you will receive a message box telling you to run the original VMware Workstation installation software, and the network repair will not complete properly.

The repair process will take a while to complete, about 15 minutes on my computer. The installation software will remove and reinstall all of the virtual drivers, including the networking, on the host computer. You will need to restart your computer after the repair is complete.

Once you restart your host computer, you may get an this error message:

Device driver software was not successfully installed.

This is actually referring to the two network drivers VMware installs. I’ve only seen this on one computer so far, but as near as I can tell, there are no adverse affects yet.

Technorati Tags: VMware,Virtualization,Windows 7

How to: Add a folder to a SharePoint list using C#

2009-09-10T07:19:00.000-04:00

Unlike adding folders to document libraries, adding folders to lists requires a bit more work in order for the folder to appear in the list view. For example, the following code will add a folder to the list, but the folder will be hidden and not show up in the list view:

   1: //get a reference to the SharePoint objects

   2: using(SPSite reportingSiteCollection = new SPSite(“http://localhost”))

   3: {

   4:     using(SPWeb reportingSite = reportingSiteCollection.OpenWeb())

   5:     {

   6:         //get a reference to the list

   7:         SPList reportingList = reportingSite.Lists[“Reporting List”];

8:

   9:         //the following line will in fact create the folder, but the folder within the list, but there will be no list item associated with the folder, so the folder will not appear in any list views

  10:         reportingList.RootFolder.SubFolders.Add(“New_Folder_Name”);

  11:     }

  12: }

Instead, you need to add a list item using the SPFileSystemObjectType.Folder enumeration and call the update method on the newly created list item so that the folder the item represents will not only be added to the list but also be visible as a list item:

   1: //get a reference to the SharePoint objects

   2: using(SPSite reportingSiteCollection = new SPSite(“http://localhost”))

   3: {

   4:     using(SPWeb reportingSite = reportingSiteCollection.OpenWeb())

   5:     {

   6:         SPList reportingList = reportingSite.Lists[“Reporting List”];

7:

   8:         //the following line will in fact create the folder, but the folder within the list, but there will be no list item associated with the folder, so the folder will not appear in any list views

   9:         SPListItem newFolder = reportingList.Items.Add(reportingList.RootFolder.ServerRelativeUrl, SPFileSystemObjectType.Folder, “New_Folder_Name”);

10:

  11:         //the following line will associate a list item with the newly created folder and make the folder visible in the list views

  12:         newFolder.Update();

  13:     }

  14: }

Technorati Tags: C#,WSS,SharePoint,MOSS

GetItems List Query Returns no Items

2009-09-09T09:41:00.000-04:00

SharePoint’s SPList class contains the GetItems method which is used to query the contents of a SharePoint list. Rather than iterating through all of the list’s items, the GetItems method allows you to specify a collaborative application markup language (CAML) query to return just the collection of items in which you are interested. It is like sending a SQL query to the SharePoint list. Clearly this is an indispensible method to know about when dealing with any non-trivial list.

One would expect that in order for a call to GetItems to return data, the user invoking the code would need only Read permissions to the list. However, I have run into situations where a user had Read permissions to a list but the call to GetItems returned no data. I had already validated that the query worked by invoking the call to GetItems from another user.

In those situations I could not get a call to GetItems to return any data unless the user had at least Contribute permissions to the SharePoint web site that contained the list. This was the case even if the user had Contribute permissions to the list. Read permission to the SharePoint site or list were insufficient.

I have not yet had time to nail down exactly what circumstances or configuration settings trigger this behavior. If others have seen this behavior and have more insight, I’d love to hear about it. For now, if you have a GetItems call that should be returning data but is not, before spending hours or days changing around your code, try invoking the call from a user who has Contribute permissions to the site.

Technorati Tags: WSS,SharePoint,MOSS,SPList,GetItems

SharePoint WebConfigModifications.Add deletes elements from web.config

2009-09-08T09:32:00.000-04:00

I was writing a SharePoint feature that had to register a custom HTTP module. Naturally I started looking at the SPWebConfigModification class and soon had some code that looked like it would add my HTTP module to the httpModules element in the SharePoint web.config file. I compiled, deployed, and activated the feature, and sure enough it worked. My HTTP module was added to the the httpModules element, and the code was even smart enough to detect that if my HTTP module were already registered it would not be registered more than once.

I could have stopped there, but instead I stared getting fancy. I thought: I should check for the existence of the httpModules element itself. I recompiled, redeployed, reactivated the feature, and …. SharePoint died :( I checked the web.config and found that the only HTTP module registered was my HTTP module. All of SharePoint’s default HTTP modules were gone.

I was dumbfounded. How could adding an element end up removing elements? I tried revising my code many different ways but to no avail. I looked at many code samples online that seemed to do the same thing I was doing and comments indicated that those code sample worked.

Finally, a theory occurred to me. There was one difference I could think of between the code samples I saw and my coed: my code was checking for the existence of an element that is created by default when SharePoint creates a new IIS web site, while the online code samples were all checking for the existence of completely custom elements. I did a little digging and found that SharePoint seems use a static web.config file template rather than the SPWebConfigModification infrastructure to generate its baseline web.config files. As such, SPWebConfigModification.SPWebConfigModificationType.EnsureSection will not detect the existence of element provisioned through the file, because there are no records in the SharePoint hierarchical object store regarding those elements. For your reference, the template web.config file is located at:

C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\CONFIG\web.config

Where does that leave a coder who needs to add entries to SharePoint web.config files? Sadly it looks like the code needs to have two different logic paths: one logical path for adding completely custom element that needs to check for each part of the element path being added, and one logical path that only checks for the existence of custom elements within an element path that is part of an element provisioned from the web.config template file referenced above. Using this split logical flow, I’ve generated a code base that can reliably add web.config elements to any part of a SharePoint web.config file.

Technorati Tags: WSS,MOSS,SharePoint,SPWebConfigModification,Web.config

Expanding your blog readership

2009-09-08T09:19:00.000-04:00

In a previous post I was happy the my readership increased to 3000 readers per month, and I promised to share how some of my strategy reaching my next goal: 10,000 readers per month. Here’s some of advise I got from fellow MVPs, some Internet research, and my wife, who was involved in marketing for some big-name advertising agencies…

Post regularly. It is better to post smaller amounts of content on a regular basis, than to post a lot of content sporadically. This will help you to get a reader base that is used to checking back with your blog on a regular basis rather than relying on the search engines to keep bringing you fresh readers with each post. In the past I would write very long articles that would take me a few weeks to complete. Now if I have a long article, I will break it into a multi-part series and publish each part as a separate post.

Read and comment on other blogs. While writing your own content is great, you should also take the time to read other people’s posts on similar topics to your own. Comment on the posts. Many blogging engines allow you to associate you blog Url with the profile you use to make the comment. This will attract readers in two ways:

People who read the other posts may visit your blog if they feel that you have content similar to the post they are already interested and reading.
Search engines will see that other sites are linking to your blog and will increase your blog’s standing in the search results.

Don’t mis-interpret what I’m suggesting. I’m not promoting spamming other people’s blog comments. What I am saying is that you should be active in the online community of which your blog is a part, beyond your own blog.

My wife had told to me that the best time to send out a newsletter or announcement email was on Tuesday or Wednesday morning. Timing the an email that way could dramatically increase the likelihood that it would get read over sending it out on other days or times of days. I thought I would try and apply this same strategy to timing the publishing of my blog posts. No longer would I publish a post at 2:00 AM on a Thursday even if that is when I wrote the post. I would wait until the next Tuesday morning and publish the post by 9 AM local time. That way the new publication is at the top of everyone’s lists of new posts in the morning of a work day (Tuesday) when they’ve had a chance to catch up from the weekend (usually people catch up on Monday).

So how are things going? So far so good. In the past 30 days, my readership has increased to 4,300 visits. That’s an increase of 43%. I’ll keep you posted.

Technorati Tags: Blog readership

How to: Choose between an ASP.Net Web Part and a SharePoint Web Part

2009-09-03T06:46:00.001-04:00

A colleague of mine recently asked me if the WebPart he was writing should inherit from the ASP.Net WebPart class or the SharePoint WebPart class. He was a bit confused because he had seen a few articles online that talked about the benefits of inheriting from one class or the other.

Some articles recommend using ASP.Net WebPart class for general ASP.Net interoperability while other articles recommend using the SharePoint WebPart class to gain access to its additional features. This MSDN article enumerates the list of features provided exclusively by the Windows SharePoint Services WebPart class:

Cross page connections
Connections between Web Parts that are outside of a Web Part zone
Client-side connections (Web Part Page Services Component)
A data caching infrastructure that allows caching to the content database

My colleague was confused. He wanted the ASP.Net interoperability but he wasn’t sure if he would regret not having access to the additional SharePoint WebPart class’ feature.

To my mind, the decision is very simple for most SharePoint developers: use the the SharePoint WebPart class. While the idea of general ASP.Net interoperability is nice, it is not likely to pan out. The reason: if you are writing a web part for SharePoint, you will likely want access to the SharePoint object model to work with list and document data, get SharePoint context, etc…. As soon as you add a reference to the Microsoft.SharePoint.dll assembly to your project and use any of its types, your assembly has already been strongly tied to SharePoint and will not work on a plain ASP.Net web site. If your assembly is already tied to SharePoint, then you may as well get the added functionality of the SharePoint WebPart by inheriting from it.

Technorati Tags: WSS,SharePoint,MOSS,ASP.Net

How to: Get started with SharePoint on the cheap

2009-09-01T16:50:00.001-04:00

I’ve seen a lot of articles about how it costs a lot of money to stand up a SharePoint server. I will show that this is simply not the case. In fact, you can stand up a production SharePoint server for less than $1100 USD, including both hardware and software costs. Now, I am specifically refereeing to doing so in production environment, so while you can use MSDN licenses for development, you can not use those here. Still, $1100 for hardware and software… that’s not too bad at all. Let’s see how.

We need to start with the base operating system. SharePoint runs on the Windows Server operating system. Most SKUs of Windows Server require a client access license (CAL), except for Windows Server Web Edition. Windows Server Web Edition retails for $470 USD per server. The only catch is that the 2003 version of Windows Server Web Edition does not allow you to install the database software SharePoint uses for its database. You can of course run the database on a separate SQL Server instance, but that is more costly. Since we want to do SharePoint on the cheap, I will show you another option.

Use SQL Server Express Edition. SQL Server 2005 or 2008 Express Edition is free, $0 USD. It has everything you need to stand up a single-server (not to be confused with Standalone) instance of SharePoint. Combine it with the SQL Server Express with Advanced Features, and you will also get a limited version of Reporting Services and SQL Server Management Studio. There is a nice description here about the licensing terms of Windows Server Web Edition and its restrictions.

Next, we need SharePoint. Since we’re doing this on the cheap, we’re obviously not looking at Microsoft Office SharePoint Server 2007 (MOSS) or Microsoft SharePoint Server 2010 (SharePoint 2010). We’re looking at Windows SharePoint Services 3.0 or 4.0 (WSS). WSS is an add-on for Windows Server. There is no additional server license cost or CAL associated with WSS. Once you pay for Windows Server, WSS is free, $0 USD.

Finally we need some hardware. Thankfully hardware capable of running WSS has really come down in price over the past few years. Windows Web Server edition can handle up to 4 CPUs and 32 GB RAM. while the more quad-processor systems are still on the expensive side, you can pick up a dual-processor, multi-core system with up to 16 GB RAM for a very reasonable price. And, if you go for a refurbished system from a reputable reseller, you can walk away with a steel. My colleague found this advertisement on Buy.com: Dell PowerEdge SC1425 Dual Xeon 3.6GHz 4GB 160GB CD 1U Server with 4 GB RAM onboard, expandable to 12 GB RAM for $320. Max out the RAM with an additional 8 GB for $260 and add an optional 3-year warranty for $50, and you’ve got a very capable SharePoint server for $630 USD.

Here’s the final price list:

Item	Cost
Windows Server 2008 x64 Web Edition	$470
Client Access Licensees	$0
SQL Server 2008 Express Edition with Advanced Features	$0
Windows SharePoint Services V3	$0
1U, Dual Proc server with 12 GB RAM, refurbished	$630
Total	$1100

This setup would make for a great workgroup or even departmental server. it could easily handle the a 500 user load. It’s not quite free SharePoint, but for $1100, it’s pretty darn close.

Technorati Tags: WSS,SharePoint,Free

Server-side Office Development with SharePoint

2009-08-20T13:51:00.000-04:00

I’ve talked to many developers who have recently started doing some SharePoint programming and have gotten hooked. In fact, they like SharePoint development so much, especially the event receivers, that these developers are starting to think about using SharePoint as a central clearinghouse for document processing.

SharePoint event receivers allow developers to programmatically interact and alter data before or after the data is saved into, updated in, or removed from SharePoint. Event receivers can work on list items as well as documents, including Office documents.

A world of possibilities

Combined with SharePoint’s metadata storage and workflow capabilities, you can imaging some pretty compelling applications built using event receivers. For example, you could create some code to run as a document is saved into SharePoint. If the document is in a draft state according to its metadata, the code would alter the document to include a “Draft” watermark right in the contents of the document. Once the metadata changes to a published status, the code could remove the watermark and also save a PDF copy of the document.

What not to do

A common implementation strategy is to use a SharePoint event receiver or workflow to invoke the Word object model using the office primary interop assemblies (OPIA). Then using the OPIA add or remove the watermark or otherwise after the contents of the document according to the metadata associated with the document.

This is a bad architecture.

For details on why this does not work, please see my post: “AnyCPU, x86, x64 – What’s the Difference?” To summarize that post, when SharePoint is installed on a 64-bit operating system, the various SharePoint processes are running in 64-bit mode, therefore your assemblies will be running in 64-bit mode. A 64-bit process can not load a 32-bit DLL. Office is a 32-bit application and so are the primary interop assemblies most .Net developers use to automate Office. So you will receive a BadImageFormatException when trying to invoke any of the Office applications from your SharePoint code when SharePoint is running on an x64 operating system.

Beyond the issue of x86 vs. x64 interoperability, there are other reasons to avoid this software design. First, to save money many developers will implement the software in a way that requires installing Office on the SharePoint web front end servers. That’s a very bad idea, period. Security, threading, and DCOM issues will make the software a nightmare to maintain.

Even if the approach functions on the developer’s x86 development SharePoint machine with a single user and the test documents are 20 KB, what will happen in a production environment where there are thousands of users and 10 MB documents? What happens when 20 documents per minute are being checked in and need to be processed?

A better idea

Don’t get me wrong. I am not saying that you should not try to write an application that does document processing using the SharePoint and Office technology stacks. Document processing applications can serve to increase the data quality of documents and increase worker productivity by reducing the labor involved in document maintenance. Just don’t use the approach outlined earlier. Use the shared a services approach instead.

Document processing as a shared services

The concept of shared services was introduced in SharePoint Portal Server 2003 (SPS) and greatly expanded upon in Microsoft Office SharePoint Server 2007 (MOSS). In a nutshell, the bulk of SharePoint is content driven. Shared services provide data storage and processing that are available globally to the SharePoint farm and are not tied to a particular SharePoint content repository.

Content indexing is a good example. The content indexer is a process that runs outside the scope of any SharePoint web application. The data the indexer stores is not user content and so does not go into any SharePoint content database. The data the indexer collects and processing the indexer performs is available to all SharePoint web applications in the farm, and potentially to other farms.

I am advocating that the document processing operations described earlier should be treated the same way. Sure the documents themselves are user content and reside in a SharePoint content database, but the process of adding a watermark to or removing a watermark from a Word document has nothing to do with a SharePoint web application and thus should not be performed in an event receiver, or from anywhere within the w3wp.exe process.

How do you Easily create a SharePoint Shared Service?

There are a couple of constraints our solution needs to adhere to in order to function properly. The solution needs to be able to:

detect document changes
process document changes
process long-running operations
support both x86 and x64 SharePoint installations
support both XML (.docx) and legacy file formats (.doc)

Detecting document changes is fairly easy. Use a list item event receiver to catch the changes.

Processing the document changes, especially changes to large documents can be more involved. If you throw in the requirement to support legacy Office document formats and x64 installations, there seems to be only one way to do it: create a Windows Service (can’t use a timer job) that is compiled with the x86 option. See my post on the differences between AnyCPU, x86, and x64 compiler options for details on why we need to be explicit about the target platform. This service can reside on one of the SharePoint application servers in the farm, on on a server that is outside of the farm. How?

Create a web service interface that accepts document processing requests and triggers the processing service to do its work. The web service doesn’t actually do any work, it simply accepts documents as input and drops them into a folder on the file system that the processing service is watching. The web service must be compiled with the AnyCPU option so that it will run properly on IIS on both x86 and x64 systems. Because the document acceptor web service and the document processing Windows service are communicating out of process, the web service can run as an x64 process for compatibility with x64 IIS, and the Windows service can run as an x86 process for compatibility with Office.

That reminds me, Office will need to be installed on the server that is running the document processing service. While it is easy to work with the XML Office file formats without Office, working with the legacy file formats either requires that you have Office installed or that you use third party middleware.

Putting everything together

What does the final solution look like and how does it operate? The list item event receiver detects a change to a document that needs processing. The event receiver invokes the document acceptor web service running on a SharePoint application server or on an external server. The document acceptor service receives the file to be processed and save the file to a file system folder. The document processor service sees the saved file on the file system and processes the file. Once processing is complete, the document processing service saves the file back to the SharePoint document library.

For a more in-depth discussion of using Shared Service architectures in a SharePoint environment, join me at the Best Practices Conference. I will be covering this and related topics in my presentation: Using Service Oriented Methodologies to Create SharePoint Products.

Technorati Tags: x64,SharePoint,WSS,MOSS,Office,Best Practices Conference

Run STSADM commands remotely

2009-08-17T07:55:00.000-04:00

Are you tired of having to bring up a Remote Desktop to your SharePoint server just to run an stsadm command? I sure was. Here’s a very simple way to remotely execute stsadm commands against any SharePoint server to which you have a LAN connection. Best of all, unlike some other methods out there, this method does not require deploying anything to the SharePoint server. However, this method is primarily for LAN scenarios, and it is very unlikely to work over the Internet.

What you’ll need

PsExec.exe by Sysinternals (now part of Microsoft) is a great utility that allows you to execute any command line against any Windows computer to which you have a LAN connection and proper credentials without installing any software on the remote server. PsExec sits on the workstation computer that you are using. Since stsadm is a command line tool and PsExec is designed to execute command lines, we can combine stsadm with PsExec to create a very nifty way to work on SharePoint servers remotely using only a command prompt.

PsExec uses Windows RPC ports to execute the commands, so if you will need to have the RPC ports open between your workstation and the SharePoint server that you want to manage. This is why it is unlikely to work over the Internet. This article has a nice primer on Windows TCP ports and references to other resources.

How to use PsExec with Stsadm

Here’s what you do. Remember that you will do all of these steps from your desktop computer, not the SharePoint server.

Download PsExec from Microsoft’s web site to your computer, not to the SharePoint server.
Open a command prompt (in administrative mode if you are using Vista with UAC enabled), and change to the directory where you have downloaded and extracted the PsExec tool.
Execute stsadm.exe through the PsExec command. Use the following format:
psexec \\[SharePoint_Server_NetBIOS_Name] –u [username] –p [password] “C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\stsadm.exe” –o [stsadm_parameters]

Note: You need “\\” in front of the remote SharePoint computer’s name.

Notice that all files names and paths should be absolute paths and in the context of the remote SharePoint on which you are executing the stsadm command.

A few sample commands

Here’s a sample that will enumerate all solutions:

psexec \\wss01 –u mydomain\administrator –p password “C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\stsadm.exe” –o enumsolutions

Here’s a sample that will do a SharePoint backup to the “c:\backup folder” directory on the SharePoint server. Notice that parameters that contain spaces need to be enclosed in quotes:

psexec \\wss01 –u mydomain\administrator –p password “C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\stsadm.exe -o backup –directory “c:\backup folder” -backupmethod full

Here’s a sample that will copy a WSP solution to a remote SharePoint server, add the solution to the solution store, and deploy the solution to the farm

REM Set an environment variable to point to stsadm. This is just for convenience

set s=“C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\stsadm.exe”

REM Copy the WSP solution file to the remote SharePoint server through the admin$ administrative share. This share points to the Windows directory. You must have administrative rights on the server to access this share. The “net use” command will establish credentials on the remote server share.

net use \\wss01\admin$ /USER:mydomain\administrator password

copy C:\Deploy\MySolution.WSP \\wss01\admin$\temp\MySolution.WSP

REM Add the WSP solution to the solution store

psexec \\wss01 –u mydomain\administrator –p password “%s%” –o addsolution –filename c:\windows\temp\MySolution.WSP

REM Create a timer job to deploy the solution to all content web applications in the SharePoint farm

psexec \\wss01 –u mydomain\administrator –p password “%s%” –o deploysolution -name MySolution.WSP –allcontenturls –allowgacdeployment –immediate

REM Start the deployment timer job

psexec \\wss01 –u mydomain\administrator –p password “%s%” –o execadmsvcjobs

Why not PowerShell

You’ve probably noticed that I’ve been using all batch command statements in this article. The natural question to ask is: “Why not use PowerShell" instead?” After all, PowerShell is certainly far more powerful than the dated DOS commands that are available through batch files. While this is true, the fact is that PowerShell is not installed on a fairly large portion of SharePoint servers because PowerShell was not released when Windows Server 2003 came out, which still forms a very large percentage of the base operating system used for SharePoint deployments. Because one of the goals of this article was to come up with a remote SharePoint management method that could be used with all LAN SharePoint servers with no additional server software install, PowerShell was out.

Technorati Tags: WSS,SharePoint,MOSS

RunAs in C#

2009-08-10T08:16:00.000-04:00

I do a lot of server programming. I frequently need to be able to run some code as a different user than the currently logged-in user. Unfortunately, the .Net Framework does not make this particularly easy. Sure, there is the WindowsIdentity class and its Impersonate method. But how do you create an instance of a WindowsIdentity object? You need to pass the constructor a logon token. How do you get a logon token? Well, .Net is rather silent on that point.

PInvoke is your friend

The Win32 API does have a LogonUser function in the advapi32.dll DLL. Thanks to the wonderful work of PInvoke (now part of RedGate), you can easily get the signature of the LogonUser function translated into .Net. It looks like this:

[DllImport("advapi32.dll", SetLastError = true)]  
public static extern bool LogonUser(string lpszUserName, string lpszDomain, string lpszPassword, int dwLogonType, int dwLogonProvider, out IntPtr phToken);

I found a nice code snippet by Viji RAJKUMAR that showed how to use the LogonUser function, handle the Win32 error codes, and handle the .Net impersonation contexts. But do you really want deal with all of that whenever you have to run some code as someone else? I sure don’t.

Inspiration from SharePoint’s RunWithElevatedPrivileges

One thing that the SharePoint API has is a very handy method on the SPSecurity class called RunWithElevatedPrivileges. RunWithElevatedPrivileges takes a function pointer (called a delegate in .Net) and executes the code in the function in the context of a pre-defined user identity (the identity of the IIS application pool in which the code is running). I really liked the ease of invocation of RunWithElevatedPrivileges method, but I needed to have a method that allowed me to specify the user name and password of any arbitrary user account.

The RunAs method is born

I used Viji’s code snippet as a starting point, and enhanced it to accept a delegate function. The result is that I can easily call RunAs, passing in a username and password, and a block of code I want executed under that user’s identity. Calling RunAs looks like this:

   1:  BlackBlade.Utilities.SecurityUtilities.RunAs(delegate()

   2:      {

   3:          File.Move(“local_file”, “network_file_location”);

   4:      },

   5:      “a_username”,

   6:      “some_password”);

Line 3 in the above code snippet is the code that will be executed with the credentials supplied to the RunAs method. You can have as many lines of code between lines 2 and 4. And those lines of code can interact with variables outside the code block. The RunAs method takes care of the details of interoperating with the Win32 API and handling the impersonation and reversion of .Net security contexts.

RunAs implemented

Here’s the full implementation of the RunAs method. Less than 75 lines of code. You can compile this as an assembly and reference it form other projects. It’s very handy.

   1:  using System;

   2:  using System.Collections.Generic;

   3:  using System.Text;

4:

   5:  using System.Security.Principal;

   6:  using System.Runtime.InteropServices;

7:

   8:  namespace BlackBlade.Utilities

   9:  {

  10:      public class SecurityUtilities

  11:      {

  12:          [DllImport("advapi32.dll", SetLastError = true)]

  13:          private static extern bool LogonUser(string lpszUserName, string lpszDomain, string lpszPassword, int dwLogonType, int dwLogonProvider, out IntPtr phToken);

  14:          public delegate void RunAsDelegate();

15:

  16:          public static void RunAs(RunAsDelegate MethodToRunAs, string Username, string Password)

  17:          {

  18:              string userName;

  19:              string domain;

20:

  21:              if (Username.IndexOf('\\') > 0)

  22:              {

  23:                  //a domain name was supplied

  24:                  string[] usernameArray = Username.Split('\\');

  25:                  userName = usernameArray[1];

  26:                  domain = usernameArray[0];

  27:              }

  28:              else

  29:              {

  30:                  //there was no domain name supplied

  31:                  userName = Username;

  32:                  domain = ".";

  33:              }

34:

  35:              RunAs(MethodToRunAs, userName, Password, domain);

  36:          }

37:

  38:          public static void RunAs(RunAsDelegate MethodToRunAs, string Username, string Password, string Domain)

  39:          {

  40:              IntPtr imp_token;

  41:              WindowsIdentity wid_admin = null;

  42:              WindowsImpersonationContext wic = null;

43:

  44:              try

  45:              {

  46:                  if (LogonUser(Username, string.IsNullOrEmpty(Domain) ? "." : Domain, Password, 9, 0, out imp_token))

  47:                  {

  48:                      //the impersonation suceeded

  49:                      wid_admin = new WindowsIdentity(imp_token);

  50:                      wic = wid_admin.Impersonate();

51:

  52:                      //run the delegate method

  53:                      MethodToRunAs();

  54:                  }

  55:                  else

  56:                      throw new Exception(string.Format("Could not impersonate user {0} in domain {1} with the specified password.", Username, Domain));

  57:              }

  58:              catch (Exception se)

  59:              {

  60:                  int ret = Marshal.GetLastWin32Error();

  61:                  if (wic != null)

  62:                      wic.Undo();

63:

  64:                  throw new Exception("Error code: " + ret.ToString(), se);

  65:              }

  66:              finally

  67:              {

  68:                  //revert to self

  69:                  if (wic != null)

  70:                      wic.Undo();

  71:              }

  72:          }

  73:      }

  74:  }

Line 53 in the previous code block invokes the caller-supplied code that should be run unsung the new impersonation context.

Technorati Tags: .Net,C#,Impersonation,LogonUser

Windows 7 RTM now available for MSDN Subscribers

2009-08-06T13:57:00.001-04:00

The Windows 7 RTM along with support and technical content is now available for download to MSDN subscribers.

Technorati Tags: Windows 7,MSDN

Missing History in TFS

2009-08-05T21:20:00.000-04:00

A few months ago our Team Foundation Server (TFS) box failed and we lost some data. I thought our new TFS box was headed for the same end the other day when I pulled up a history list for a Visual Studio project and saw that there were not nearly as many entries in the history list as there should have been.

A few minutes and a few valiums later, I figured out why there were so few entries in the history list. It turns out there are two ways to get the TFS history from Visual Studio.

View History from Solution Explorer

The first way is to select the View History option from the context menu of a file in in the Visual Studio Solution Explorer (see screenshot below). This way of viewing TFS history only pulls up the history items for the specifically selected item (the selected project file in this case), and not a rolled-up history for its child items (the files within the project). The screenshot below and the right shows the history list for just the selected project.

View History from Source Control Explorer

The other way to view TFS from Visual Studio is to do so from an item’s context menu in the Source Control Explorer in Visual Studio. From the screenshot below and to the left, there is no visual distinction between the View History menu item in the Source Control Explorer and the one in the Solution Explorer. However, look at the change-sets returned by the View History menu item from the Source Control Explorer in the screenshot below and to the right. There are three change-sets that for the project that were not present in the history view returned by the Solution Explorer. These additional change-sets represent a rolled-up view of changes that were made to files within the project (code changes), but that did not include changes to the project file itself (like adding a file to or removing a file from the project). The history view from the Source Control Explorer shows a complete roll-up of all changes made to the selected item as well as child items.

Summary

The moral of this story is:

If you want to see TFS change history for just the selected item, use the View History command from the items context menu in the Visual Studio Solution Explorer.
If you want to see a rolled-up TFS change history for the item and any child items, use the use the View History command from the items context menu in the Visual Studio Source Control Explorer.

Say “No” to Java Trial-ware

2009-08-05T01:07:00.000-04:00

The latest update to the Sun Microsystems’ (Sun) Java Runtime Environment (JRE) for Windows comes with a trial-ware Internet backup service called “Carbonite Online Backup”. Unsuspecting users who install the Java update will also be installing potentially unwanted software that could cost them $5 per month.

I’m a seasoned geek. I’ve grown to expect such antics from less reputable Internet companies. No names need be mentioned. But I’ve generally considered Sun a trust-worthy software provider, especially in terms of its JRE for Windows. This is a low move, trying to sneak trial-ware into a software distribution channel that in the past has had a high degree of integrity. Sun: please remove the trial-ware from future JRE updates.

AnyCPU, x86, x64 – What’s the Difference?

2009-08-04T12:37:00.000-04:00

A colleague of mine recently posed an interesting question: Why would you ever want to specifically target an assembly compilation to x86 or x64? Wouldn’t you always want to use the AnyCPU option?

What are the options?

Here’s a bit of background on what each option does:

AnyCPU – The assembly is compiled in a CPU-independent manner. If you are compiling an EXE, the EXE will run as an x64 processes when loaded by an x64 version of the .Net Framework on an x64 operating system. Otherwise the EXE will run as an x86 process. When you’re compiling a DLL, the DLL will load as an x64 DLL when loaded from an x64 process. Otherwise, the DLL will load as an x86 DLL.
x86 – The assembly will always load as an x86 assembly, regardless of the operating system or .Net Framework version. The assembly will not load from an x64 process.
x64 – The assembly will always load as an x64 assembly, regardless of the operating system or .Net Framework version. The assembly will not load on an x86 operating system or from an x86 process.

Well, it looks like the AnyCPU option is definitely the way to go. You get the most flexibility with the least amount of headaches due to platform and process differences. In most cases (99 out of 100) that is true.

Subtleties of assembly loading

However, there is one subtlety to how assemblies load into processes. A process can only load assemblies that are of the same architecture at runtime as the process itself. An x64 process can only load x64 assemblies, and x86 processes can only load x86 assemblies. This restriction still applies to assemblies compiled with the AnyCPU option. Even though assemblies compiled with the AnyCPU option are processor architecture-independent at compile-time, the assemblies do get tied to a particular processor architecture when they are loaded for execution. If a process tries to load an assembly with an incompatible architecture, a BadImageFormatException will be thrown.

Why does that matter? Wouldn’t all of this be irrelevant if all assemblies were compiled with the AnyCPU option? Yes. Except, that not all code your assembly needs to load or that will be loading your assembly is processor architecture-independent. In particular, this is most apparent when you need to interoperate with un-managed code, such as COM.

So what? I only use managed code

Many .Net developers believe that all of .Net is a brand new, shiny framework that frees them from the headaches or working with legacy runtimes and unmanaged binaries. This is not true. In fact, a large portion of the .Net Framework simply wraps existing un-managed operating system components, such as the EnterpriseServices and DirectoryServices namespaces. Here’s a screenshot of a COM+ component EnterpriseServices uses to extend transaction support into the .Net Framework:

There are also many components and products that are based on un-managed code and only wraps this code for interoperability with .Net assemblies. Many Microsoft applications fall into this category as well, such as Microsoft Office, even if you are using the Office primary interop assemblies.

When do I need to specify x86 or x64 target for my assembly?

Given what we now know about how assemblies are loaded, we can now see that when we need to interoperate with un-managed code, even code that has .Net wrappers, we may need to target our assemblies, particularly when our process or assembly is likely to be loaded as a 64-bit (x64) architecture but the unmanaged code is of 32-bit (x86) architecture.

For example, say we need to automate a Microsoft Office application and our assembly is running on an x64 operating system. We need to have a 32-bit process, since Office is strictly a 32-bit application (that is until Office 2010 is released), but because our process is running on an x64 operating system, the process will be loaded in x64 mode. In this case, we want to specify that our assembly should always be targeted to x86 architecture, even when running on an x64 operating system.

Creating 64-bit Virtual Machines

2009-07-30T10:43:00.001-04:00

I’ve heard a bit of confusion recently over just what is needed to create 64-bit virtual machines using Microsoft technologies. Part of the confusion stems from the very liberal use of the term “64-bit support” by much of the Microsoft marketing folks in relation to their virtualization offerings. So lets clear things up.

First, here’s the list of Microsoft operating system virtualization products:

Virtual PC 2007
Virtual Server 2005 R2
Hyper-V for Windows Server 2008
Hyper-V R2 for Windows Server 2008 R2

Next, lets get some terms straight:

Host: This is the physical server that is running the operating system virtualization software.
Guest: This is the virtual machine running within the operating system virtualization software on the host.

The confusion I mentioned earlier comes from the Microsoft marketing folks use of the term “64-bit support”. So what does “64-bit support” mean?

According to Microsoft marketing:

The operating system virtualization software that can be installed on a 64-bit host.

According to everyone else:

The virtualization software can be used to create 64-bit guests.

Now that we have our terms in order, we will answer the real question: what Microsoft products can be used to create 64-bit guests? The answer: Hyper-V and Hyper-V R2. That’s it. Virtual PC and Virtual Server can only create 32-bit guests, even when installed on 64-bit hosts. What does this mean for you?

If you want to create 64-bit virtual machines using Microsoft products, you need:

Windows Server 2008 x64, Standard or Enterprise or Windows Server 2008 R2 x64, Standard or Enterprise running on a 64-bit host computer
Hyper-V or Hyper-V R2
The host computer CPU(s) must have the VT extensions turned on. These are turned off by default on many desktop and workstation class machines.

It also means that you can not run 64-bit guest virtual machines using Microsoft virtualization software on Windows XP, Vista, Windows 7, or Windows Server 2003 host operating systems, even if using the 64-bit versions of these operating systems. If you want to run 64-bit guests on any of these operating systems, you will need to look at virtualization software from another vendor, such as VMware, which also has a number of free virtualization offerings: VMware Server and VMware ESXi.

Over 3000 visits last month

2009-07-29T01:06:00.001-04:00

This blog just hit a milestone: over 3000 visits last month! Now I know that 3000 visits in a month pales in comparison to the stats many of my fellow SharePoint MVPs get on their blogs, but this is a personal best for me. So, I’m twisting open a cap on a 20oz Mountain Dew and tearing open a movie-sized bag of Peanut M&Ms, and I’m celebrating. These stats are just beautiful <wiping away the tears of joy>:

But I’m not resting. I’m going to put some effort in over the next few months to try and expand the readership of this blog. I got a lot of good advice from several of my fellow MVPs, and I wanted to take a moment and thank them:

Stay tuned for the progress reports. In my next post on this subject, I’ll tally up what I’ve done so far. And of course, thanks for reading.

File not found error uploading multiple files to SharePoint

2009-07-28T10:34:00.000-04:00

A colleague of mine recently had an odd issue when trying to uploading files to a SharePoint site. Here’s what happened…

When he tried to upload multiple document to a MOSS 2007 document library from a Vista desktop that has IE8, things worked fine if he was using documents that are in his user profile. But when he selected documents that were not in his user profile (Ex: folder on c: drive or USB drive), he got a file not found message when trying to upload. If he upload a single file from the same location, or if he dragged and dropped via the explorer view he have no issue.

I hadn’t seen that particular issue before, but I have seen weird behavior with Vista about accessing certain files when UAC is enabled. Basically, Vista wants to raise the UAC dialog box to allow you to access files off of root drive directories, including USB drives. But, I thought I remembered that Vista sometimes cannot or does not display the UAC from Internet Explorer. So IE just fails if it needs to access these files.

I recommended that he disable UAC on his Vista machine as an easy way to test. Good news: it worked. The moral of the story: if Internet Explorer is behaving oddly when needing to access certain files on a Vista machine, try disabling UAC.

Microsoft’s Tim Sneath has a how-to on disabling Vista UAC.

Things that Should be Easy

Stormy Skies for Cloud Computing

What the vendors tell you

What the vendors don’t tell you

Conclusion

The Next Web: Twitter-Facebook AND Twitter-Microsoft deal confirmed

SharePoint 2010 public beta and general release announced

Watch SharePoint Conference 2009 video highlights on demand

Watch the SharePoint Conference 2009 keynote on demand

Getting paid for your SharePoint software, part 4

Table of contents

Option 4: Localized Software as a Service (LSaaS)

Which option is best?

Conclusion

Visual Studio 2010 Beta 2 has new SharePoint 2010 development tools

Impersonation options in SharePoint code

Impersonate the application pool identity

Impersonate the application pool identity, take 2

Impersonate a named user account

Impersonate the Local System Account

Technorati Tags: WSS,SharePoint,MOSS 2007,C#

VMware Workstation networking not working in Windows 7

How to: Add a folder to a SharePoint list using C#

GetItems List Query Returns no Items

SharePoint WebConfigModifications.Add deletes elements from web.config

Expanding your blog readership

How to: Choose between an ASP.Net Web Part and a SharePoint Web Part

How to: Get started with SharePoint on the cheap

Server-side Office Development with SharePoint

A world of possibilities

What not to do

A better idea

Document processing as a shared services

How do you Easily create a SharePoint Shared Service?

Putting everything together

Run STSADM commands remotely

What you’ll need

How to use PsExec with Stsadm

A few sample commands

Why not PowerShell

RunAs in C#

PInvoke is your friend

Inspiration from SharePoint’s RunWithElevatedPrivileges

The RunAs method is born

RunAs implemented

Windows 7 RTM now available for MSDN Subscribers

Missing History in TFS

View History from Solution Explorer

View History from Source Control Explorer

Summary

Say “No” to Java Trial-ware

AnyCPU, x86, x64 – What’s the Difference?

What are the options?

Subtleties of assembly loading

So what? I only use managed code

When do I need to specify x86 or x64 target for my assembly?

Creating 64-bit Virtual Machines

Over 3000 visits last month

File not found error uploading multiple files to SharePoint