You can also pass in parameters for your query such as the ListName or WebUrl using the parameter classes provided by ASP.NET such as the QueryStringParameter and ControlParameter class. As these are all generic ASP.NET controls, however, there is no way of using SharePoint specific information such as properties of the current page, or information from User Profiles. For example it isn’t possible to use this on a SharePoint publishing page and use a metadata value such as the Title, Author or list item ID to filter the results.

Some examples of where this might be useful are:

• Displaying items from a list that has a lookup column pointing to the pages library (e.g. a comments list that contains a lookup to a publishing page)
• Displaying items that are related to properties on the current page (e.g. ‘recent articles by this author’ or ‘other articles in this category’)
• Displaying items using a configurable property stored in SharePoint (e.g. displaying items from a specific list or site that can be altered by an end user)
• Displaying a set of items based on information from the current users SharePoint profile (e.g. pages that relate to the current user’s office)

One easy way of creating these dynamic parameters is to create a custom class that inherits from System.Web.Controls.Parameter. We can then use the Evaluate method to retrieve the information we want. The example below shows how this can be done to retrieve a value from the current page/list item.

public class PageFieldParameter : System.Web.UI.WebControls.Parameter

{

    public string PropertyName { get; set; }

    protected override object Evaluate(HttpContext context, System.Web.UI.Control control)

    {

        if (SPContext.Current != null && SPContext.Current.ListItem != null && !string.IsNullOrEmpty(PropertyName))

        {

            switch(PropertyName)

            {

                case "ID" :

                    return SPContext.Current.ListItem.ID;

                case "DisplayName" :

                    return SPContext.Current.ListItem.DisplayName;

                default :

                    return SPContext.Current.ListItem[PropertyName];

            }

        }

        return null;

    }

}

We can then use this in our SPDataSource to bind to parameters such as the WebURL, ListItemID, or pass these into our CAML query. The example below shows how we could use this on a publishing page to display items from a ‘Comments’ list that contains a lookup field pointing to the pages within this site.

<%@ Register Tagprefix="CustomWebControls" Namespace="Ari.PublicWebsite.ServerControls" Assembly="Ari.PublicWebsite"  %>

<SharePointWebControls:SPDataSource

    runat="server"

    ID="dsComments"

    DataSourceMode="List"

    UseInternalName="true"

    UseServerDataFormat="true"

    selectcommand="&lt;View><Query><Where><Eq><FieldRef Name='Post' LookupId='TRUE' /><Value Type='Lookup'>{PostID}</Value></Eq></Where></Query></View>">

    <SelectParameters>

        <asp:Parameter Name="ListName" DefaultValue="Comments"/>

        <asp:Parameter Name="WebURL" DefaultValue="{sitecollectionroot}"/>

        <CustomWebControls:PageFieldParameter Name="PostID" PropertyName="ID"/>

    </SelectParameters>

</SharePointWebControls:SPDataSource>

Note the addition of a reference to our class at the top of the page and then the parameter inside the SelectParameters element of the SPDataSource. We could easily extend this to create additional properties other than the ‘PropertyName’ that is shown. If we then bind this to a Repeater we get something like the following assuming a list name ‘Comments’ exists with a lookup that references the current page.

<asp:Repeater runat="server" DataSourceID="dsComments">

    <ItemTemplate>

        <h4><%# Eval("FullName") %></h4>

        <span class="comment"><%# Eval("Body") %></span>

    </ItemTemplate>

</asp:Repeater>

If we place this on the default ‘Image on left’ page layout we get something like the example shown below:

Note that in SharePoint 2010 the Content Query Web Part PageFieldValue property could be used to achieve a similar result in this specific scenario but the SPDataSource allows you to bind to controls such as the ASP.NET ListView or the Data View Web Part and this can also be used in SharePoint 2007. Additionally the Content Query Web Part only provides dynamic parameters based on the query string or the page so information from places such as user profiles would need to use this approach.

If you haven’t used this control before check out the SPDataSource documentation on MSDN. Chris O’Brian also has a good series titled SPDataSource every developers friend.

The format has changed since 2007 where the exams were split by SKU/license type and now have a more Developer vs. IT Pro split, and within that a Technology Specialist (TS) and PRO exam. So there are no specific SharePoint Foundation exams – they all cover the full feature set but the PRO exams are targeted at a higher level than the TS e.g. PRO is aimed at dev team leads/senior administrators. The exams have now been fully released and are available for booking via Prometric but there still isn’t a huge amount of material out there so here are some pointers to get you started (with some tips from the Microsoft Learning exam webcasts).

70-573 – TS: Microsoft SharePoint 2010, Application Development

This covers the fundamentals of SharePoint development. Make sure you know your object model, web parts, RESTFUL URL’s, and can develop and deploy the artefacts such as site definitions, custom actions etc listed in the technical tasks.

With this exam it is worth brushing up on the specific object model entities/schema references for each of the skills listed. Some useful resources for these skills are:

• What’s new for developers | SharePoint 2010
• Getting started with SharePoint 2010 for Professional Developers
• SharePoint 2010 Developer Training Course
• Developer hosted virtual hands-on labs or download the SharePoint 2010: Getting Started with Development on SharePoint 2010 Hands-on Labs in C# and Visual Basic
• MSDN – much better than when SharePoint 2007 was released, here are some examples of articles that match the skills listed:
  • Customizing the Server Ribbon
  • Walkthrough: Creating Connectable Web Parts in SharePoint Foundation
  • SharePoint Foundation REST Interface (and OData: URI Conventions)
  • How to: Retrieve User Profile Properties
  • Sandboxed Solution Considerations

70-576 – PRO: Designing and Developing Microsoft SharePoint 2010 Applications

This exam is targeted at lead developers and/or solution architects who are designing SharePoint applications. As per the audience profile:

The candidate is responsible for designing custom code for projects that are deployed to SharePoint servers. This includes technology selection across the many ways to build code in SharePoint, ensuring the team development environment is configured, creating a strategy for code deployment, versioning, configuration, or structure.

As with all the exams experience goes a long way, especially with the PRO exams as they cover designing solutions as well as developing them. MSDN can also be used for this exam as per the above, if you have access to SharePoint conference videos it would be worth looking at the development oriented ones. Books such as Professional SharePoint 2010 Development are also worth a read to get a good overview of the new features.

70-667 – TS: Microsoft SharePoint 2010, Configuring

This exam is focused on configuring SharePoint 2010 through the user interface (or PowerShell when UI settings are not available). I found this exam the easiest by far and think most development leads and/or SharePoint consultants would breeze through this as well as the target audience of SharePoint administrators.

TechNet is a good resource for these concepts – for example installing and configuring, managing search, server and farm administration, service applications, backup etc as per the skills measured. Another helpful resource is the Getting Started with SharePoint Server 2010 for IT Pros video series overview of new and improved features.

70-668 – PRO: SharePoint Server 2010, Administrator

The PRO administrator exam is all about topologies. Again SharePoint development leads/solution architects should have a good chance at passing this as well as infrastructure architects. A high level of what is covered is included in the audience profile:

Candidates for this exam design and deploy Microsoft SharePoint Server 2010 infrastructures. These candidates might be senior administrators who act as the technical lead over a team of administrators. These candidates are responsible for the planning and deployment of SharePoint 2010 environments.  Candidates should have a minimum of two years of experience administering, deploying, managing, monitoring, upgrading, migrating, and designing SharePoint servers.

The candidate typically plans, designs, and maintains:

• Physical topologies and services architecture
• Disaster recovery (backup, restore) and availability
• Infrastructure capacity (users, topology)
• Farm performance and availability
• Migration and upgrade
• Security and compliance requirements
• Information architecture (interprets taxonomy)
• Information search strategy integration with other data sources (LOB, third-party products)
• Client application services deployment

This audience also has a thorough understanding of the following:

• Windows PowerShell scripting
• Server availability and performance concepts (SQL mirroring, load balancing)
• Security concepts and authentication methods
• Windows Server 2008 and Active Directory administration
• Networking infrastructure services including DNS and IIS

Again TechNet is a useful study resource, make sure you know things like the hardware requirements for SharePoint 2010, topology options such as how to create a highly available deployment, search topologies etc as per the skills measured. There are also advanced IT Pro Training resources on the official SharePoint site.

Hopefully these resources prove useful to people wanting to take these exams in the near future. It appears there are plenty of exam focused training resources coming soon so keep an eye on places like the Microsoft SharePoint – Training Portal as well as the SharePoint 2010 books on places like Amazon.

Below are a list of the web parts that are available when creating a team site in the various editions:

There are also a large amount of web parts that appear either when you enable certain features, or add them to the web part gallery manually. Some common examples are the Content Query Web Part and the Media Web Part (added automatically for sites based on the publishing or collaboration site templates). There are a large amount of these so I’m only showing a few to give you an indication of what else is available. To have a look at the full list navigate to Site Actions > Site Settings > Galleries | Web parts from the site collection root and then select Documents > New Document from the ribbon. This will give you a list of all web parts available to add to the new web part menu.

Some of the additional web parts available in SharePoint 2010:

SharePoint 2010 Licensing Overview

Before getting to the numbers there are a few things to understand. I’ve covered the basics here but head to the official Licensing Q&A page for full details.

For the full version of SharePoint Server 2010 there are two licensing models:

• Server + CAL licenses for internal users – for internal users you need to license each server running SharePoint 2010. You also need a Client Access License (CAL) for each person (or optionally each device) accessing a SharePoint Server. All users will need a standard CAL and to access enterprise features users will need both the standard and the enterprise CAL. The difference in Standard vs Enterprise features is covered below.
• Internet sites server licenses for external users – you need a server license for each server running SharePoint 2010. CALs are not required if all content is accessible to external users. If some content is for internal use only then CALs are required for users accessing this content. As well as a difference in features the Internet Sites Standard license only allows sites running on a single domain. As stated in the Microsoft Licensing Product Use Rights “The [SharePoint 2010 Internet Sites Standard] software may only be used to create and host a single site at a time resolved from a single domain name (e.g., contoso.com) and its subdomains (e.g. support.contoso.com).” It comes in at almost a third of the cost of the enterprise license, however, so opens up public SharePoint hosting to companies with smaller budgets.

FAST Search Licensing

FAST Search is licensed separately so to take advantage of all the enterprise search features you will need additional server licenses for servers running the FAST Search software.

It is also possible to use a single server for any of the above server licenses. For example if you wanted to run an Intranet and a public Internet website on the same server you could apply the SharePoint 2010 Server license as well as the SharePoint 2010 Internet Sites license to a single server. A FAST license can also be applied to a SharePoint 2010 server if required (saving hardware costs but still requiring SharePoint Server and FAST licenses).

Indicative SharePoint 2010 License Costs

The table below gives some indicative prices for SharePoint 2010 in the UK based on information from Microsoft. Note these are only intended to provide ballpark estimates only and you will need to contact a Microsoft Licensing Specialist to obtain accurate costs. These figures do not include software assurance. Additionally there are other license costs you will need to take into account such as Windows Server and SQL.

* Note the enterprise CAL is additive i.e. this requires each user to also have a standard CAL

Here are a few examples to give you an idea of how it works:

Small, Standard License, Internal Only Environment

3 server farm – 2 x WFE/Application servers and SQL, SharePoint 2010 running on two servers, 1,000 standard users

License costs would be 2 x £3,100 (SharePoint 2010 Server) + 1,000 users x £60 (Standard CAL) = £66,200

If you wanted to add FAST search you would need to add at least one server at £14,000 and add enterprise CALs (an additional £53 per user) for users accessing these features. The total with FAST would be £66,200 + £14,000 + 1000 x £53 = £133,200 for all users. An alternative would be to only give certain users access to the enterprise features. This can be done through the use of Feature Packs (a.k.a Sets) which allow you to target features so they can only be activated on certain sites. This is useful both for hosted scenarios (e.g. it allows the hoster to restrict enterprise features to site collections that are subscribed to an enterprise plan), and internal scenarios (e.g. only allowing a management site access to enterprise features to reduce license costs).

SharePoint 2010 for a public facing internet site

3 server farm – 2 x WFE/Application servers and SQL, SharePoint running on two servers, content authors editing content that ends up being publicly available (i.e. no internal only content) on a single domain

License costs would be 2 x £7,500 = £15,000

If you wanted to add FAST you would need the Internet Sites Enterprise license to make the search features available and add a license for a FAST Search Server (although this could run on one of the WFE’s to save hardware costs). This would then be 2x £27,000 + £14,000 = £68,000.

Enterprise vs Standard SharePoint 2010 features

So what do you get for an enterprise license? The official Microsoft SharePoint site has a detailed comparison of features in each of the editions but at a high level the additional features provided in the enterprise license are:

• Access Services
• FAST search enhancements (note these also require a FAST server license)
  • Sorting by any managed property
  • Contextual search results (i.e. user or audience targeted)
  • Refinement filter counts
  • Similar results
  • Thumbnails and previews
  • Visual best bets
  • Scale and other search platform enhancements
• Business Intelligence
  • KPI’s
  • Chart Web Parts
  • Dashboards
  • Data Connection Library
  • Excel Services
  • PowerPivot for SharePoint
  • PerformancePoint Services
  • Visio Services
• InfoPath Services
• Web Analytics [update 21/06/10 - corrected - this is in standard]

Related products

• SharePoint Foundation 2010 – this is free with Windows Server
• Office SharePoint Designer – free download from Microsoft
• Office Web Apps – free for each user with a licensed version of Microsoft Office
• SharePoint Workspace – included with Office Professional Plus or available separately for approx. £85

^{Note 1 e.g. four SharePoint 2010 Server licenses @ £3100 + 1000 Standard CALs @ £60 = £72,400. Including FAST would require an additional FAST license @ £14,000 plus 1000 Enterprise CALs @ £53 = an additional £67,000 (i.e. almost double) to give all users access.}

I think the exams are a great way to learn about more than what you focus on day-to-day as they cover a wide range of features included in the SharePoint platform. So if you have been working with SharePoint for a while now is a great chance to have a shot as there is nothing to lose (apart from a bit of pride perhaps).

You can sign up for an exam at http://www.register.prometric.com/ClientInformation.asp although when I booked yesterday it took a few attempts to get through and places were filling up fast. The following exams are available:

Developer exams

71-573: TS: Microsoft SharePoint 2010, Application Development

71-576: PRO: Designing and Developing Microsoft SharePoint 2010 Applications

IT Pro exams

71-667: TS: Microsoft SharePoint 2010, Configuring

71-668: PRO: Microsoft SharePoint 2010, Administrator

There is also a webcast today covering what you need to know for the 70-573 exam – details at http://borntolearn.mslearn.net/btl/b/weblog/archive/2010/05/12/live-meeting-sharepoint-server-information-worker-and-collaboration-month.aspx.

If you are interested in being one of the first to know about new exams check out the Born to Learn blog post about becoming a Subject Matter Expert. This involves filling in a short survey on the Microsoft Connect site about your experience, and which development activities you want to be part of (e.g. take a beta exam).

I’ve put my slides on slideshare for my session on ‘creating a tag driven information architecture using SharePoint 2007’. In the session I focused on making things findable, both in SharePoint 2007 and SharePoint 2010. I also talked about other factors that are important in creating a successful intranet such as engaging the user and used the New Zealand Ministry of Transport as an example of how this can be done. As the slides were mostly visual cues for what I talked about in the session I’ve included a summary of what I covered below.

The presentation focused on using metadata to make things findable. This isn’t anything new, in fact during the Evolution keynote Steve Smith showed how that even in SharePoint 2001 there were basic metadata features but I’m constantly surprised at how many intranets are developed without proper use of what I consider fundamental features such as content types. If you understand how to use content types and metadata to make things findable this post probably won’t include anything new but if you haven’t I think this is one of the most important factors in delivering a successful intranet.

To explain how SharePoint can be used to improve findability I used the analogy of finding ‘curry paste’ in a supermarket (after confirming that the vast majority of the audience have also struggled finding items in a supermarket). To me it made sense to look for this under ‘ethnic foods’, but it wasn’t there – it was under ‘herbs and spices’. I suggested that there were two problems with the supermarket classification scheme:

1. Items are only stored under a single section, even when it may make sense to have them in both locations (e.g. it would be easier to find curry paste if it was in the ‘ethnic foods’ and the ‘baking sauces’ section which was the second place I looked).
2. There is only one classification scheme – the section headings. I know other information about the curry paste such as the colour is red and I may want the size to be 100-200 grams. The supermarket doesn’t let me search by these other metadata facets (but it would make it easier to find things if it did).

While a supermarket is constrained by physical space and storing products in multiple places isn’t feasible this doesn’t apply to content management systems. Once the system is up it doesn’t matter how many pages we show this item on. As a result we can focus on how users look for information and provide multiple classification schemes and put information in places that make sense to different people. Note I’ve built this on a similar concept covered by Zef Fugaz (who was responsible for the User Experience side of the Ministry of Transport Intranet) in his article Card Sorting Doesn’t Cut the Custard.

In the example of the Ministry of Transport site I showed an example of how people might start to think about a document on ‘How to use the Intranet’. Some people might think in terms of the business unit that owns the resources such as human resources (i.e. this is a staff guideline), but others might think it relates more to communications (i.e. the intranet is a communications tool). Equally others might think of the type of content such as a manual or guideline. In this example we have people thinking of multiple facets (business unit and content type) and in one case we have people thinking of different values for the same facet (i.e. HR and Communications business units).

We can use this to create an information architecture as shown below:

In SharePoint the facets translate to site columns. Once we have these defined we can select which site columns relate to different types of content in a matrix as shown below:

I showed how this works in SharePoint, with both documents and pages allowing authors to easily tag documents when they are created or uploaded.

Once we have this content tagged we can utilise this metadata in a variety of ways using standard SharePoint features such as:

Filters – for example showing ‘Business Unit’ and ‘Content Type’ columns in a document library allows you to quickly filter results to find information such as Business Unit = Human Resources and Content Type = Manual to find the ‘how you use the intranet’ guide.

Related items – one easy way to do this is to use the content query web part which makes it easy to constuct a roll up of content matching a query. For example to show a list of recent staff manuals on a page for new starters you could use the CQWP with a filter such as Content Type = Manual and Business Unit = Human Resources.

If the items are not in a single site collection you can also use the search core results web part to construct a query. For example to show the latest research from around the organisation you could use a fixed keyword query such as Content Type = Research (contenttype:research) and order by modified date. Note you can allow your own metadata properties to be used in search queries by creating managed metadata fields in your search configuration.

Search filters – the freely available MOSS Faceted Search components can also enhance search results by displaying relevant facets and allowing users to use these to filter the search results set.

One thing that is important to note is that this system does rely on users tagging information appropriately and people often ask me about the best ways to do this. Some ways to ensure this happens are:

• Provide training to key content authors so they understand the process and see the benefits.
• Configure certain fields to be mandatory – this needs careful consideration, too few may result in poor quality metadata, too many may mean users find it too difficult and save content elsewhere or classify items incorrectly.
• Appoint owners for each section of the Intranet to ensure that content is appropriately tagged.
• Another way is to use some sort of entity extraction tool to dynamically extract metadata. I haven’t looked into this in detail but products such as Fast Search for SharePoint 2010 provide a framework to achieve this.

I also discussed ways to engage with staff so they would want to use the Intranet regularly. Examples of this were a ‘Story of the Day’ feature, frequently updated ‘Alerts’ and ‘Announcements’ listings, a staff marketplace, corporate calendars and opinion polls.

Lastly I covered some of the features that SharePoint 2010 includes that can be used to improve findability. I covered these in an earlier article on 10 ways SharePoint 2010 improves findability.

While the session was in the community track it was fairly well attended and I had lots of questions from the audience which was a good sign people were listening. As always any comments appreciated – I’d especially be interested in hearing about other people’s experiences using the metadata features of SharePoint.

Additional resources

• How We Did It – Tag Driven Information Architecture using MOSS 2007 for the New Zealand Ministry of Transport – an article I wrote for the SharePoint Team Blog
• Card Sorting Doesn’t Cut the Custard – an article by fellow ex-Provoker Zef Fugaz
• Information Architecture and SharePoint – a presentation by fellow ex-Provoker Lulu Pachuau
• 10 ways SharePoint 2010 improves findability – an article I wrote for EndUserSharePoint
• SPThemes – The screenshots in this article show the Cedar Blue theme available from SPThemes.com

Findability is one of the most important factors in the success of a SharePoint site. If users cannot find what they are looking they will quickly use alternate methods to get results. Employees that cannot find information are less productive and less likely to use the system in general. Likewise users that cannot find information on an internet site will look elsewhere for products and services losing the company revenue.

SharePoint 2007 introduced some powerful tools for improving findability but fell short when it compared to larger Enterprise Content Management systems. SharePoint 2010 takes this a huge step forward with cutting edge enterprise ready findability features. Here are 10 new features SharePoint 2010 brings to the table in addition to the features available in SharePoint 2007.

1. Metadata driven navigation

SharePoint 2010 provides a rich set of features that allow users to use metadata to navigate content repositories. Document libraries can be configured to show navigation based on both the corporate taxonomy (or managed metadata) and combined with other metadata filters. For example with a you can filter items from the ‘Bicycle’ product category of content type ‘Sales presentation’ using the navigation as shown below.

2. Search enhancements

SharePoint 2010 includes some impressive enhancements to the search experience. Search facets allow users to filter the results by relevant metadata such as author or content type. Relevancy is improved as it takes the number of views into account. This, along with the addition of related queries, improved query syntax and thumbnail previews help users locate the content they are after.

3. Ratings

The introduction of a ratings field allows community driven content classification. Ratings can be used to improve findability through sortable list columns, or by the creation of ‘highest rated documents’ rollups using the Content Query Web Part, allowing users to see popular content in prominent places.

4. Tagging

SharePoint 2010 includes a tag cloud web part that provides a visual representation of the metadata associated with the content inside a repository. Additionally tag profile pages contain lists of items such as sites, documents or people tagged with a particular term as well as a list of community members and discussions facilitating information retrieval.

5. Document IDs

SharePoint 2010 provides a unique Document ID service that can be used to create absolute references to content regardless of file renames or content moves. As well as resulting in a reduction in broken links the Document ID can be used to search for an individual document and the format of the ID is configurable allowing organisations to create meaningful document identifiers.

Classification

All the findability improvements mentioned above rely on the correct classification of content in the first place. The following five findability improvements aid the correct classification and organisation of content in SharePoint 2010.

6. Managed metadata service

SharePoint 2010 now includes a dedicated service for managing metadata within the enterprise. The managed metadata service allows content owners to maintain a centrally managed structured taxonomy as well as allowing users to contribute to an unstructured ‘folksonomy’ in the form of managed keywords. This makes it much easier for users to classify content, and guides users to use consistent terms, improving the quality of metadata in the system.

Structured classification:

Unstructured classification:

7. Shared content types

One key architectural limitation in SharePoint 2007 was that Content Types could not be shared between site collections. This resulted in the duplication of content types and associated lookup lists which could become out of sync over time. SharePoint 2010 removes this limitation and thus improves the consistency of information stored in different site collections or even separate SharePoint farms.

8. Location based metadata defaults

SharePoint 2010 allows you to set metadata defaults at the document library and folder level. This means that users do not have to enter the same metadata over and over if they are uploading content into a repository that has a shared set of metadata.

9. Content Organiser

In SharePoint 2007 the location in which content was stored was largely up to the end users. The Content Organiser in SharePoint 2010 helps alleviate problems caused by users uploading documents to a variety of different places by allowing routing decisions to be centrally managed. Content can then be routed to the correct location based on the content type and other metadata values. This helps the user to focus on providing quality metadata and results in a well organised repository.

10. Document Sets

A document set allows you to manage a group of documents as a single entity. The ability to apply metadata to the entire set of documents improves consistency and storing related documents together can help users find relevant material easily.

Summary

SharePoint 2010 delivers some massive platform improvements that help in the classification and retrieval of content. It is important to note, however, that the toolset is only a small part of an information management strategy. Information management should start with clear business objectives, a clear strategy and right areas of focus before technology is involved. Once this is in place, however, the significant advancements of SharePoint 2010 make it a more obvious choice for content management than ever before.

Ensuring that the authentication cookie is only sent via SSL/HTTPS is easy, we simply add the ‘requireSSL’ attribute to our forms element in the web.config as shown below:

<authentication mode="Forms">

    <forms loginUrl="https://www.company.com/pages/login.aspx" requireSSL="true" />

</authentication>

The impact it has, however, is that the authentication cookie is only sent when we request an HTTPS page (i.e. via SSL). This means that now if we login and then browse to the homepage we appear logged out! This is because the .ASPXAUTH cookie we covered in the first post “Securing mixed SSL sites in SharePoint” is not sent for HTTP requests so ASP.NET cannot authenticate us. As a result HttpContext.Current.Request.IsAuthenticated will be false and the MembershipUser and SPContext.Current.Web.User will be null. This means that we cannot use a range of controls such as the ASP.NET LoginView, the SharePoint SPSecurityTrimmed control, the SharePoint Welcome controls and the ASP.NET and SharePoint navigation controls for rendering permissions based navigation.

To illustrate if we log in via HTTPS and then view the homepage we will see the following:

The main issues are that the welcome control shows ‘Sign In’ instead of ‘Welcome username’ and the navigation to the restricted ‘My Account’ site does not show.

What we ideally want is similar to what we configured in the previous example where we used the ASP.NET Login controls to create a personalised welcome control as shown below:

Rewriting the SharePoint and ASP.NET controls to work without the help of the ASP.NET security framework elements is not a trivial task and requires some thought. There are, however, several ways that we can resolve this issue:

• Put the entire site under SSL
• Don’t show information that requires authentication on HTTP pages
• Ensure all requests after the user logs in are over SSL
• Store personalisation information in separate cookies that are sent via HTTP

This article will cover the last option as this is often the requirement for public facing SharePoint internet sites. In this post we cover one possible solution to demonstrate the concepts that are required to replicate this functionality but it is not intended for production systems without careful consideration and testing.

Solution overview

This solution involves creating a separate cookie that will be configured to be sent via both HTTP and HTTPS. In this cookie we will store the username of the user when they log into the site so we can display this on HTTP pages.

To create a separate cookie we will need to add custom code to the login method to create this ‘soft authentication’ cookie when a user logs in. We can then use this cookie to display the user name and links relevant to the user on HTTP pages even when they appear to be anonymous. As long as we do not store private or authentication information in this cookie it does not pose a security risk as if an attacker steals this cookie they cannot log in to the site or view any private information (as the secure authentication cookie is still required to view this information.

Step 1- Creating an authentication helper class

To enable us to create and manage the custom cookie we will create a ‘SoftAuthentication’ class that contains methods to create and destroy the cookie when we login or logout. We will also create properties to retrieve a flag to indicate whether a user has logged in, and a property to retrieve the name of the currently logged in user.

An example implementation of this class is shown below.

public static class SoftAuthentication

{

    public const string softAuthCookie = "softAuth";

    /// <summary>

    /// Returns true if the user has previously logged in and is now on an unsecure page

    /// i.e. we cannot currently determine if they are logged in via forms authentication

    /// </summary>

    /// <returns></returns>

    public static bool HasLoggedIn

    {

        get

        {

            if (HttpContext.Current.Request.Cookies[softAuthCookie] == null)

                return false;

            else

                return !string.IsNullOrEmpty(HttpContext.Current.Request.Cookies[softAuthCookie].Value);

        }

    }

    /// <summary>

    /// Retrieves the username of the soft authenticated user

    /// </summary>

    /// <returns></returns>

    public static string LoginName

    {

        get

        {

            if (HttpContext.Current.Request.Cookies[softAuthCookie] == null)

                return null;

            return HttpContext.Current.Request.Cookies[softAuthCookie].Value;

        }

    }

    /// <summary>

    /// Perform a soft login and store the username for retrieval via HTTP

    /// </summary>

    /// <param name="value"></param>

    public static void Login(string value)

    {

        if (HttpContext.Current.Response.Cookies[softAuthCookie] == null)

            HttpContext.Current.Response.Cookies.Add(new HttpCookie(softAuthCookie, value));

        else

            HttpContext.Current.Response.Cookies[softAuthCookie].Value = value;

    }

    /// <summary>

    /// Logout the soft authenticated user

    /// </summary>

    /// <param name="value"></param>

    public static void Logout()

    {

        if (HttpContext.Current.Response.Cookies[softAuthCookie] != null)

            HttpContext.Current.Response.Cookies[softAuthCookie].Value = string.Empty;

    }

}

Step 2 – Creating a custom login view control

To allow us to show different information to anonymous or logged in users we can create a control similar to the ASP.NET LoginView that contains templates for each group of users. The main difference is that we will use the SoftAuthentication.HasLoggedIn flag to determine which template to show instead of Request.IsAuthenticated. An example of this is shown below.

[ParseChildren(true), Bindable(false)]

public class SoftLoginView : Control, INamingContainer

{

    // Fields

    private ITemplate _anonymousTemplate;

    private ITemplate _loggedInTemplate;

    // Methods

    protected override void CreateChildControls()

    {

        ITemplate anonymousTemplate = null;

        if ((base.DesignMode || (this.Page == null)) || (!this.Page.Request.IsAuthenticated && !SoftAuthentication.HasLoggedIn))

        {

            anonymousTemplate = this.AnonymousTemplate;

        }

        else

        {

            anonymousTemplate = this.LoggedInTemplate;

        }

        if (anonymousTemplate != null)

        {

            Control container = new Control();

            anonymousTemplate.InstantiateIn(container);

            this.Controls.Add(container);

        }

    }

    protected override void Render(HtmlTextWriter writer)

    {

        this.EnsureChildControls();

        base.Render(writer);

    }

    // Properties

    [PersistenceMode(PersistenceMode.InnerProperty), Browsable(false), DefaultValue((string)null), TemplateContainer(typeof(LoginView))]

    public virtual ITemplate AnonymousTemplate

    {

        get

        {

            return this._anonymousTemplate;

        }

        set

        {

            this._anonymousTemplate = value;

        }

    }

    public override ControlCollection Controls

    {

        get

        {

            this.EnsureChildControls();

            return base.Controls;

        }

    }

    [TemplateContainer(typeof(LoginView)), Browsable(false), DefaultValue((string)null), PersistenceMode(PersistenceMode.InnerProperty)]

    public virtual ITemplate LoggedInTemplate

    {

        get

        {

            return this._loggedInTemplate;

        }

        set

        {

            this._loggedInTemplate = value;

        }

    }

}

Step 3 – Creating a custom login control

We also need to ensure that when the user logs in we call the SoftAuthentication.Login method. The easiest way to do this is to create a custom control that contains an ASP.NET login control and contains this call in the LoggedIn event. An example of how this can be done is shown below.

ASCX file:

<asp:Login ID="Login1" runat="server" onloggedin="Login1_LoggedIn">

</asp:Login>

C# file:

protected void Login1_LoggedIn(object sender, EventArgs e)

{

    MembershipUser user = Membership.GetUser(Login1.UserName);

    SoftAuthentication.Login(user.UserName);

}

Step 4 – Creating a custom welcome control

The next step is to create a custom welcome/login name control that displays the name of the logged in user, additional navigation links and a logout link. This control will call SoftAuthentication.LoginName to retrieve the logged in username, and SoftAuthentication.Logout when the user clicks the logout link. An example implementation is shown below.

ASCX file:

<asp:Literal ID="usernameText" runat="server"></asp:Literal> |

<a href="/my-account/">My Account</a> |

<asp:LinkButton ID="logoutLink" runat="server" onclick="logoutLink_Click">Logout</asp:LinkButton>

C# file:

protected override void OnLoad(EventArgs e)

{

    base.OnLoad(e);

    string name = SoftAuthentication.LoginName;

    if (!string.IsNullOrEmpty(name))

    {

        usernameText.Text = "Welcome " + name;

    }

}

protected void logoutLink_Click(object sender, EventArgs e)

{

    SoftAuthentication.Logout();

    FormsAuthentication.SignOut();

    Response.Redirect(Request.Url.ToString(), true);

}

Step 5 – Adding controls to the masterpage

Once our controls are in place we can add them to the masterpage as shown below:

<SecureControls:SoftLoginView runat="server">

    <AnonymousTemplate>

        <LoginControls:SoftLogin id="softLogin" runat="server"/>

    </AnonymousTemplate>

    <LoggedInTemplate>

        <LoginControls:SoftWelcome id="softWelcome" runat="server"/>

    </LoggedInTemplate>

</SecureControls:SoftLoginView>

Step 6 – Verifying the solution

We now have a basic set of controls that will allow us to show information about the logged in user without having to send the authentication token over HTTP. Now when we log in we should see our username and links displayed as shown below even though we don’t send the authentication token over HTTP:

To verify that no sensitive data is being transmitted we can use a HTTP monitoring tool such as Fiddler to see detailed requests as shown below (edited for clarity):

1. Logon from the homepage

Request data:

POST https://www.company.com/Pages/default.aspx HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, […]
Referer: http://www.company.com/Pages/default.aspx
Accept-Language: en-GB
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; […]
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: www.company.com
Content-Length: 2856
Connection: Keep-Alive
Cache-Control: no-cache

__SPSCEditMenu=true
&MSOWebPartPage_PostbackSource=
&__REQUESTDIGEST=0xD1[…]
&__VIEWSTATE=%2F[…]
&ctl00%24ctl19%24softLogin%24Login1%24UserName=spuser
&ctl00%24ctl19%24softLogin%24Login1%24Password=pass@word1
&ctl00%24ctl19%24softLogin%24Login1%24LoginButton=Log+In

We can see that this was a POST request to send our login information including username and password to the server. We can also see that it was to a secure page (https) in the URL so this data is being safely transferred via SSL.

Response data:

HTTP/1.1 302 Found
Cache-Control: private
Content-Length: 28370
Content-Type: text/html; charset=utf-8
Location: /Pages/default.aspx
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: .ASPXAUTH=43B75379C778EF78385E7025FF100925[..]; path=/; secure; HttpOnly
Set-Cookie: softAuth=spuser; path=/
X-Powered-By: ASP.NET
Date: Wed, 07 Apr 2010 22:12:25 GMT

The response we get back over the SSL connection shows the server passing the .ASPXAUTH (forms authentication) and softAuth cookies back to the user. We can see that the forms authentication cookie now has the ‘secure’ attribute to ensure it is only sent over HTTPS (this is the result of the requireSSL setting). We can also see that our custom ‘softAuth’ cookie is sent back and does not have the ‘secure’ attribute that restricts it to HTTPS connections.

Note the HttpOnly attribute refers to whether the cookie is visible to client side script such as JavaScript.

2. Subsequent HTTP requests

Request data:

GET http://www.company.com/Pages/default.aspx HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, […]
Connection: Keep-Alive
Accept-Language: en-GB
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; [..]
Accept-Encoding: gzip, deflate
Pragma: no-cache
Cookie: softAuth=spuser;
Cache-Control: no-cache
Host: www.company.com

If we look at subsequent requests to HTTP pages we can see that the forms authentication cookie is no longer send for these unsecured requests. The only cookie sent is the ‘softAuth’ cookie that we use to display the username. If an attacker were to steal this information all they would be able to do is to see our username – as soon as they attempt to access a page secured via SSL the forms authentication would fail and they would simply be presented with the login page.

Specifically we’ll have a look at how we can replace the SharePoint Welcome control with a custom control that meets the following requirements:

• Displays username and password fields in anonymous mode.
• Allow us to login securely (via HTTPS) from a unsecured page (e.g. the homepage).
• Display logged in username and ‘my account’ type navigation links in logged in mode.

The screen shot below shows what this will look like to anonymous users (note login form top right):

Step 1 – Create a custom login control

The first step to enable this scenario is to create a custom user control that shows us a login form to anonymous users, and a welcome message to authenticated users. We can do this really easily adding ASP.NET login controls to our master page as shown below:

<asp:LoginView ID="LoginView1" runat="server">

    <AnonymousTemplate>

        <asp:Login ID="Login1" runat="server">

        </asp:Login>

    </AnonymousTemplate>

    <LoggedInTemplate>

        Welcome <asp:LoginName ID="LoginName1" runat="server" /> |

        <a href="/my-account/">My Account</a> |

        <asp:LoginStatus ID="LoginStatus1" runat="server" />

    </LoggedInTemplate>

</asp:LoginView>

The result for anonymous users using the default login template is shown below:

Step 2 – Customise the login control layout

We can then customise the layout by creating our own LayoutTemplate for the login control. A simple example is shown below:

<asp:Login ID="Login1" runat="server">

    <LayoutTemplate>

        <asp:TextBox ID="UserName" Text="username"

        runat="server"></asp:TextBox>

        <asp:RequiredFieldValidator ID="UserNameRequired" runat="server"

            ControlToValidate="UserName" ErrorMessage="User Name is required."

            ToolTip="User Name is required."

            ValidationGroup="ctl00$ctl00$Login1">*</asp:RequiredFieldValidator>

        <asp:TextBox ID="Password" Text="password" TextMode="Password"

            runat="server"></asp:TextBox>

        <asp:RequiredFieldValidator ID="PasswordRequired" runat="server"

            ControlToValidate="Password" ErrorMessage="Password is required."

            ToolTip="Password is required."

            ValidationGroup="ctl00$ctl00$Login1">*</asp:RequiredFieldValidator>

        <asp:Literal ID="FailureText" runat="server"

            EnableViewState="False"></asp:Literal>

        <asp:Button ID="LoginButton" runat="server" CommandName="Login" Text="Log 

            In" ValidationGroup="ctl00$ctl00$Login1" />

    </LayoutTemplate>

</asp:Login>

At this point if we try and log on the browser is going to post the username and password back to the server using HTTP (i.e. back to the page we originally requested). We can verify this using a HTTP monitoring tool such as Fiddler as shown below:

This shows us that the request is over HTTP and is a POST request so is sending data. We can see the username and password and since this is not over SSL it is sent in clear text. We also see that the authentication cookie is sent back also over HTTP (i.e. the Set-Cookie statement).

Step 3 – Configure the login control to send data securely

If we don’t want to place the homepage under HTTPS we need to configure the sending (i.e. the HTTP POST) to use SSL. The easiest way to do this is in ASP.NET is to set the PostBackUrl of the Login form to be an absolute URL to the secure version of the current page.

To do this in the code behind file for our login control we can add the following:

protected void Page_Load(object sender, EventArgs e)

{

    // ensure we send credentials over a secure connection

    if(!HttpContext.Current.Request.IsSecureConnection)

    {

        string postbackUrl = HttpContext.Current.Request.Url.AbsoluteUri.Replace("http", "https");

        Button loginBtn = (Button)Login1.FindControl("LoginButton");

        loginBtn.PostBackUrl = postbackUrl;

    }

}

This code checks whether we are already on an HTTPS page and if so no action is required. If we are not on an SSL page the code finds the LoginButton and sets the PostBackUrl property to the HTTPS version of the current page.

Step 4 – Update redirect rules

Additionally we need to allow our SSL redirection module to allow POST requests over HTTPS to all pages on the site. If  you followed the example in the previous post to configure this using the IIS Url Rewrite module you will need to edit the HTTPS to HTTP rule by adding the following condition:

• Condition input: {REQUEST_METHOD}
• Check if input string: Matches the pattern
• Pattern: GET

This updates the rule that redirects HTTPS requests to HTTP so that it only applies to GET requests (i.e. POST requests will be allowed via HTTPS). Now when we click the ‘Log In’ button shown below from an HTTP page our details are sent via SSL.

Step 5 – Verify the login credentials are sent via HTTPS

We can verify this by using a tool such as Fiddler to inspect the individual requests.

The above diagram shows:

• The HTTP GET request to the homepage (request number 1 top left)
• The HTTPS POST request to the homepage (top left and right highlights)
  • Inside the HTTPS POST we can see our username and password. As this is part of an HTTPS request we know this information is encrypted.
• The HTTPS response from the server (bottom right)
  • Inside the HTTPS response we see the Set-Cookie statement. Again as this is an HTTPS request we know this cookie is secure.

Another way to verify that the authentication was completed over a secure channel is to set the ‘requireSSL’ attribute of the ‘forms’ element in the web.config to true as shown below:

<authentication mode="Forms">

    <forms loginUrl="https://www.company.com/pages/login.aspx" requireSSL="true" />

</authentication>

This specifies that the authentication cookie should only be sent via SSL. If we had tried to login from an unsecured (HTTP) page, this would have given us the following error as it would have been trying to create the authentication cookie over an unsecure channel:

“The application is configured to issue secure cookies. These cookies require the browser to issue the request over SSL (https protocol). However, the current request is not over SSL.”

Since we have configured the authentication request to be over SSL, however, this will not occur and we can be sure our login credentials are secured. There are some other implications of requiring the authentication cookie to only be transferred via SSL we will cover in the following posts.

Ideally we would enter absolute links when linking to HTTPS pages from HTTP pages and vice versa. In reality, however, there are several reasons why this won’t always work so we need to have a ‘catch all’ method to ensure the correct protocol is used. Some reasons absolute URL’s don’t always work are:

• OOTB web parts such as the summary links web part will convert absolute links to relative links if they find an alternate access mapping for the site entered.
• Content authors may enter relative URL’s to secure pages such as the login page, for example by using the link selector tool.
• Content deployment will automatically replace absolute URL’s with relative URL’s if an alternate access mapping exists for the absolute URL. This affects all content pages and many OOTB web parts.

One way to ensure the correct protocol is used is to use redirection at the IIS level (this can also be done at the firewall but this won’t often be available for development/test environments). With the release of IIS 7 Microsoft has developed a URL Rewrite Module that provides an easy way for us to do this in IIS 7 Manager. The following steps show how to set this up.

Site setup

In this example we will partition the site into three areas.

• Secured and anonymous – pages that display or send sensitive information and therefore require SSL but are available to anonymous users. For example the login page would fit into this category.
• Secured and authenticated – page that display or send sensitive information and require the user to be logged in. For example a ‘My Details’ page that allows the user to view and edit their address details.
• Unsecured – pages that do not require the user to be logged in and do not contain sensitive information. All the remaining pages in the site fall into this category.

This is shown in the diagram below:

The site map above shows; an unsecured, anonymous homepage and ‘Press Releases’ site, a SSL secured and anonymous login page, and a SSL Secured ‘My Account’ site that requires authentication to access.

Enforcing SSL for anonymously accessible SharePoint pages

Step 1. Redirect login requests to the login form

As we are creating a public website we’ll replace the standard SharePoint branded login page with a publishing page that reflects our look and feel. In this example I’m using the Community Kit for SharePoint: Forms Based Authentication (CKS:FBA) solution’s web parts to allow me to quickly create some pages with the ASP.NET login controls packaged up as web parts. So to create the login page I’ve just created a page based on the Welcome Page template and dropped in the CKS:FBA Login web part as shown below:

We can then specify this as the login page by changing the loginUrl attribute of the forms element in the web.config as shown below:

<authentication mode="Forms">

<forms loginUrl="https://www.company.com/pages/login.aspx"/>

</authentication>

This will now redirect us to the login page (using SSL) if we try to access a secured resource.

Step 2. Secure the login page

While requests to secure pages will now be redirected to the login form it is still possible to view the page via HTTP so we need to apply some additional logic to ensure that if the user clicks on a link to the HTTP version of the page or types the HTTP URL into the browsers address bar the page is served via HTTPS. In this example we will use the URL Rewrite Module for IIS 7 but if your firewall supports it that might be a better solution. If you are using an earlier version of IIS you might need to look into third party rewrite tools or create a custom solution either using ISAPI or an HttpModule to do the redirection.

Once you have the URL Rewrite Module installed you should see the feature show up for your site in IIS.

To secure the login page open up the feature and click ‘Add Rules…’ and select the ‘Blank rule’ template

Enter the following information to redirect HTTP requests to the login page to use HTTPS

• Name: HTTP to HTTPS
• Pattern: ^Pages/Login\.aspx
• Condition:
• Condition input: {HTTPS}
• Check if input string: Matches the pattern
• Pattern: off
• Action Type: Redirect
• Redirect URL: https://{HTTP_HOST}/{R:0}
• Redirect type: Permanent (301)

Note: detailed information on creating rewrite rules is covered in the article “Creating rewrite rules for the URL Rewrite Module” on the Official IIS Site.

Now if we type in http://www.company.com/pages/login.aspx we will automatically be redirected to https://www.company.com/pages/login.aspx.

Step 3. Enable authentication

We can extend this approach slightly to secure pages that should be delivered via SSL and only visible to authenticated users. Examples of these types of pages are ‘My Account’ type pages that allow logged in users to edit their personal information and/or view purchase history. In this example we will create a site called ‘My Account’ and create an example ‘Change Password’ page to show how we can control access to these pages and ensure the correct protocol is used.

Remove anonymous access for site

The first step in the process is to log into the forms authenticated site as a user who has administrative privileges. This can be done by specifying a forms user as the site collection administrator in Central Administration or by granting them the full rights policy.

1. Once you have logged in you will need to browse to the ‘My Account’ site and navigate to Site Actions > Site Settings > Modify All Site Settings > Users and Permissions | Advanced permissions.

2. Select Actions > Edit Permissions. This will break permissions inheritance and allow us to remove anonymous access to the ‘My Account’ site.

3. Select Settings > Anonymous Access

4. Select ‘Nothing’ and click OK.

Anonymous users trying to access this site will now be redirected to the login page to authenticate before being able to view pages in this site. We now need to add forms users or roles to one of the groups that does have access to the site to allow them to view these pages. In this example I have created a role in the forms database named ‘AllUsers’ and assigned every user this permission. To give all users read only permission on the ‘My Account’ site we will add the ‘AllUsers’ role to the ‘Restricted Readers’ group in SharePoint.

5. Navigate to Site Settings > Modify All Site Settings > People and Groups and select the ‘Restricted Readers‘ group.

6. Enter the ‘AllUsers’ group into the people picker and select ‘OK’

We now have the correct permissions applied. To check that anonymous users can no longer access this site we can try to browse to the site directly as an anonymous user:

As we don’t have permission ASP.NET will redirect us to the login page specified in the web.config file:

Step 4. Secure additional sites

While the ‘My Account’ site is now restricted to anonymous users the pages within this site are not forced to use SSL. To do this we need to modify our rewrite rule as follows:

1. In IIS manager open the URL Rewrite feature

2. Select the rule we created to secure the login page and click ‘Edit’

3. Update the pattern to the following to additionally redirect HTTP requests to the ‘My Account’ site to use HTTPS:

• Pattern: ^(my-account|pages/login)(.*)\.aspx

This will ensure any requests to the ‘My Account’ site are also sent via SSL.

Step 5. Ensure non-sensitive pages are delivered via HTTP.

The last step is to force non-sensitive pages such as the homepage to use HTTP to avoid the overhead of encrypting and decrypting the page. This can be done by creating an additional rewrite rule as shown below:

1. In IIS manager open the URL Rewrite feature and click ‘Add Rules…’ and select the ‘Blank rule’ template

Enter the following information to redirect HTTPS requests to use HTTP for all other pages:

• Name: HTTPS to HTTP
• Pattern: ^(?!my-account|pages/login)(.*)\.aspx
• Condition:
• Condition input: {HTTPS}
• Check if input string: Matches the pattern
• Pattern: on
• Action Type: Redirect
• Redirect URL: http://{HTTP_HOST}/{R:0}
• Redirect type: Permanent (301)

Note the pattern above is a regular expression that matches any URL’s that do not start with ‘my-account’ or ‘pages/login’.

These rules will now ensure that all pages within the site use the correct protocol (HTTPS for pages that need to be secured, and HTTP for all other pages on the site):

Now if we try to navigate to the SSL version of a page that does not require SSL we will be redirected to the page using HTTP. For example if we enter https://www.company.com into the browsers address bar we will be redirected to http://www.company.com:

We have successfully secured the contents of the page but there is still a gaping hole in our security: the authentication token is sent via HTTP. This means that if we log in and then navigate to a unsecured page (e.g. the homepage) we will be sending our authentication information in the clear (i.e. the .ASPXAUTH cookie I mentioned in the Securing mixed SSL sites in SharePoint post). In the following article I’ll look at what we need to consider when forcing the authentication token to only be sent via HTTPS.