How To Code

Logging Ubiquiti EdgeRouter firewall events to Wazuh

2026-01-01T15:40:00.016+02:00

Problem

Logging EdgeRouter firewall events to Wazuh needs custom decoder and rules.

Solution

In /var/ossec/etc/rules/edgerouter-fw_rules.xml:

<decoded_as>edgerouter-fw-tcp</decoded_as>

<description>EdgeRouter TCP packet: $(srcip):$(srcport) → $(dstip):$(dstport) via $(in_iface)</description>

<group>edgerouter,tcp,firewall,</group>

</rule>

<decoded_as>edgerouter-fw-udp</decoded_as>

<description>EdgeRouter UDP packet: $(srcip):$(srcport) → $(dstip):$(dstport) via $(in_iface), payload $(payload_len) bytes</description>

<group>edgerouter,udp,firewall,</group>

</rule>

<decoded_as>edgerouter-fw-icmp</decoded_as>

<description>EdgeRouter ICMP packet: $(srcip) → $(dstip), type $(icmp_type) code $(icmp_code)</description>

<group>edgerouter,icmp,firewall,</group>

</rule>

<if_sid>900100</if_sid>

<description>TCP SYN from $(srcip):$(srcport) to $(dstip):$(dstport) blocked by $(chain)</description>

<group>edgerouter,tcp,syn,</group>

</rule>

<if_matched_sid>900200</if_matched_sid>

<same_source_ip />

<description>Possible TCP SYN scan: $(srcip) sent repeated SYN packets to multiple ports</description>

<group>edgerouter,tcp,scan,</group>

</rule>

<if_sid>900110</if_sid>

<description>UDP traffic: $(srcip):$(srcport) → $(dstip):$(dstport)</description>

<group>edgerouter,udp,event,</group>

</rule>

<if_matched_sid>900300</if_matched_sid>

<same_source_ip />

<description>Possible UDP flood: $(srcip) sent $(frequency) packets in $(timeframe)s</description>

<group>edgerouter,udp,flood,</group>

</rule>

<if_sid>900120</if_sid>

<description>ICMP Echo Request (ping) from $(srcip) to $(dstip), seq $(icmp_seq)</description>

<group>edgerouter,icmp,echo,</group>

</rule>

<if_matched_sid>900400</if_matched_sid>

<same_source_ip />

<description>Possible ICMP flood: $(srcip) sent $(frequency) echo requests in $(timeframe)s</description>

<group>edgerouter,icmp,flood,</group>

</rule>

<match>WAN_LOCAL</match>

<description>EdgeRouter WAN_LOCAL rule matched: $(srcip) → $(dstip) on $(proto)</description>

<group>edgerouter,wan_local,</group>

</rule>

<match>WAN_LOCAL-default-D</match>

<description>Inbound traffic blocked by WAN_LOCAL: $(srcip):$(srcport) → $(dstip):$(dstport) proto $(proto)</description>

<group>edgerouter,blocked,wan_local,</group>

</rule>

<if_sid>900200</if_sid>

<match>WAN_LOCAL-default-D</match>

<description>Blocked TCP SYN: $(srcip):$(srcport) → $(dstip):$(dstport) flags $(flags)</description>

<group>edgerouter,tcp,blocked,scan,</group>

</rule>

<if_matched_group>blocked</if_matched_group>

<same_source_ip />

<description>Repeated blocked traffic from $(srcip): $(frequency) events in $(timeframe)s</description>

<group>edgerouter,blocked,scan,</group>

</rule>

</group>

In /var/ossec/etc/decoders/edgerouter-fw.xml. Make sure there are no line breaks inside <regex> node:

<parent>kernel</parent>

<regex type="pcre2">\[([^\]]+)\]IN=(\S*)\s+OUT=(\S*)\s+MAC=([0-9A-Fa-f:]+)\s+SRC=([0-9.]+)\s+DST=([0-9.]+)\s+LEN=(\d+)\s+TOS=(\S+)\s+PREC=(\S+)\s+TTL=(\d+)\s+ID=(\d+)(?:\s+DF)?\s+PROTO=TCP\s+SPT=(\d+)\s+DPT=(\d+)\s+WINDOW=(\d+)\s+RES=(\S+)\s+(\S+)\s+URGP=(\d+)</regex>

<order>chain,in_iface,out_iface,mac,srcip,dstip,len,tos,prec,ttl,id,srcport,dstport,window,res,flags,urgp</order>

</decoder>

<parent>kernel</parent>

<regex type="pcre2">\[([^\]]+)\]IN=(\S*)\s+OUT=(\S*)\s+MAC=([0-9A-Fa-f:]+)\s+SRC=([0-9.]+)\s+DST=([0-9.]+)\s+LEN=(\d+)\s+TOS=(\S+)\s+PREC=(\S+)\s+TTL=(\d+)\s+ID=(\d+)\s+PROTO=UDP\s+SPT=(\d+)\s+DPT=(\d+)\s+LEN=(\d+)</regex>

<order>chain,in_iface,out_iface,mac,srcip,dstip,len,tos,prec,ttl,id,srcport,dstport,payload_len</order>

</decoder>

<parent>kernel</parent>

<regex type="pcre2">\[([^\]]+)\]IN=(\S*)\s+OUT=(\S*)\s+MAC=([0-9A-Fa-f:]+)\s+SRC=([0-9.]+)\s+DST=([0-9.]+)\s+LEN=(\d+)\s+TOS=(\S+)\s+PREC=(\S+)\s+TTL=(\d+)\s+ID=(\d+)(?:\s+DF)?\s+PROTO=ICMP\s+TYPE=(\d+)\s+CODE=(\d+)\s+ID=(\d+)\s+SEQ=(\d+)</regex>

<order>chain,in_iface,out_iface,mac,srcip,dstip,len,tos,prec,ttl,id,icmp_type,icmp_code,icmp_id,icmp_seq</order>

</decoder>

SharePoint: Connect using access tokens in PnP PowerShell

2025-09-11T10:36:00.005+03:00

Task

I had an string array of SPO site collection URLs and I needed to execute PowerShell script that fetches comments and likes of app pages across all of these site collections. For getting actual page specific likes and comments, there is PnP PowerShell commands Get-PnPPageLikedByInformation and Get-PnPListItemComment, and you get nice object array including date, and even comment content. No problem there.

However, in my one-time executable script I didn't want to do interactive login for each of those site collections, so I needed a way to somehow persist the credentials and reuse them every time I called Connect-PnPOnline towards each site collection.

Back in the days, all they way in on-prem SharePoint, you could use Get-Credential once and store the credentials in a variable and include that as the parameter in the connection PS command, whatever that was. It, however, hasn't worked in a long time when there are MFA and other requirements towards signing in to online services such as SharePoint Online.

Good thing there is a solution.

Solution

Access tokens to the rescue!

# first connect normally to SPO, but remember to return the connection using ReturnConnection parameter
$conn = Connect-PnPOnline -ClientId [YOUR_CLIENT_ID] -Url [YOUR_SPO_URL] -ReturnConnection

# magic is here, first get the access token, you only need to do this once (note that token will expire at some point)
$token = Get-PnPAccessToken -Connection $conn -ResourceTypeName SharePoint

# then whenever you want to connect to new site collection, use the token instead of ClientId
$newConn = Connect-PnPOnline -AccessToken $token -Url [NEW_SPO_URL] -ReturnConnection

SharePoint: How to create direct link to list view including search query

2025-01-17T11:43:00.004+02:00

Problem

While going back to basics, that is on-prem SharePoint, I needed to create list view search box to another page. Meaning that the other page (not the the list view page) needed to have search box and button. Typing in query and pressing the button would redirect to the list view and do the search like user would've typed in the search in the list view search box.

I was certain there was some querystring parameter one could define for this to work, but couldn't find, so after some trial and error I found the correct one!

Solution

In your link that points to list view, use querystring parameters View and InplaceSearchQuery. View contains the GUID of the view you want to show, and InplaceSearchQuery contains the query that is executed towards that view.

So a simplest example of this is to add this to Script Editor Web Part:

<input type="text" id="inputBox" placeholder="Enter search query..." style="width:300px">
<button onclick="redirectToURL()" type="button">Search</button>

Only downside here is that the list view search box doesn't show the query text, but that you could do by some JavaScript magic injected to the list view page.

How to use Files.SelectedOperations.Selected permission for SharePoint and OneDrive content

2024-11-28T10:26:00.019+02:00

Problem

I needed to grant permission for an Entra Id application to access SharePoint Online and OneDrive folder. I didn't want to grant the broadest Sites.ReadWrite.All permission to all site collections, nor the second broadest permission Sites.Selected to specific site collection. Instead I needed to go very granular, so limit access to specific folder and use the Files.SelectedOperations.Selected permission.

Backgound: Granting permission to whole site collection

Before realizing Sites.Selected was too broad, I tested using it, and it worked great. In order to use the following commands, I used Graph Explorer to which I granted Sites.FullControl.All permission so that it could modify the permissions for SPO items.

1. Get the site collection

First I queried the site (collection) ID for my SharePoint site collection:

HTTP GET https://graph.microsoft.com/v1.0/sites/xyz.sharepoint.com:/sites/jussi

Then with the site ID (it looks something like this: "xyz.sharepoint.com,8e099463-6a83-48c3-9c0e-59c3ca071054,15a706b9-af56-49dd-97ad-51325cee3b66"), I queried current permissions for the site:

HTTP GET https://graph.microsoft.com/v1.0/sites/[SITE_ID]/permissions

No permissions were found, just as expected.

2. Add permissions

To add permissions, you use the permissions endpoint:

HTTP POST https://graph.microsoft.com/v1.0/sites/[SITE_ID]/permissions

with the following payload in the body section of Graph Explorer:

{
  "roles": [
    "write"
  ],
  "grantedToIdentities": [
    {
      "application": {
        "id": "10facd40-ec88-4c62-b5dc-8170a2ccaba1"
      }
    }
  ]
}

3. Removing permissions

You can remove the permissions too, but for that you need the permission ID. You got the permission ID from the result of the query you used when you added the permission earlier, but in case you missed it, you can list the permissions:

HTTP GET https://graph.microsoft.com/v1.0/sites/[SITE_ID]/permissions

Permission ID is the long non-GUID string like this:

"id": "aTowaS50fG1zLnNwLmV4dHwyMGZhY2Q0NC1lYzg4LTRjNjItYjVkYy04MTcwYTJjY2FiYTFAOTJlNTE2MTUtNDkwOS00OGUzLWJhMDYtMmE1ZmMyMzNiNGJi"

So in order to remove the permission:

HTTP DELETE https://graph.microsoft.com/v1.0/sites/[SITE_ID]/permissions/[PERMISSION_ID]

Granting permission to folder level

Alright, I removed the site collection level permissions and started to grant folder level permissions.

1. Get the drive ID for the library

https://graph.microsoft.com/v1.0/sites/[SITE_ID]/drives

Drive ID is the non-GUID string like:

"id": "b!Y6QJjoNqw0icDlnDygcQVLkGpxVWr91Jl61RMlzuO2a6mn6WqINZRLEDcG_BOOKl"

2. Get the folder ID from the drive by querying all the children items of the folder

HTTP GET https://graph.microsoft.com/v1.0/sites/[SITE_ID]/drives/[DRIVE_ID]/root/children

So, what I now got was the id 01QHBNZNLH6DKOS3GO3FHKHKIC6AGODYML of the folder MyTemplates inside the library Shared Documents, that's the one.

            "createdDateTime": "2024-11-27T07:26:15Z",
            "eTag": "\"{E9D4F067-CE6C-4ED9-A3A9-02F00CE1E18B},1\"",
            "id": "01QHBNZNLH6DKOS3GO3FHKHKIC6AGODYML",
            "lastModifiedDateTime": "2024-11-27T07:26:15Z",
            "name": "MyTemplates",
            "webUrl": "https://xyz.sharepoint.com/sites/jussi/Shared%20Documents/MyTemplates",
            "cTag": "\"c:{E9D4F067-CE6C-4ED9-A3A9-02F00CE1E18B},0\"",
            "size": 20558,
            "createdBy": {
                "user": {
                    "email": "admin@xyz.onmicrosoft.com",
                    "id": "45a44407-f372-45f5-a69d-9f4dd4f704fa",
                    "displayName": "xyz Admin"
                }
            },

3. Add permissions

Following my earlier steps when granting permission to site level, I made call:

HTTP POST https://graph.microsoft.com/v1.0/sites/[SITE_ID]/drives/[DRIVE_ID]/items/[FOLDER_ID]/permissions

using same payload as earlier

{
  "roles": [
    "read"
  ],
  "grantedToIdentities": [
    {
      "application": {
        "id": "10facd40-ec88-4c62-b5dc-8170a2ccaba1"
      }
    }
  ]
}

╯︿╰ I get "Invalid request" error:

{
    "error": {
        "code": "invalidRequest",
        "message": "Invalid request",
        "innerError": {
            "date": "2024-11-28T08:12:45",
            "request-id": "62a82827-5c26-4883-934e-7eabeceead88",
            "client-request-id": "f6cd7714-2199-3a94-3a4b-5df804f1ec37"
        }
    }
}

What is this? Documentation is rather brief. There was a great article by Vasil that discusses permissions that indicated that this should (or at least was) possible, so I started testing further, and finally found a solution.

Solution

When granting application permissions to folder objects (probably same goes for files and lists), the payload you send is slightly different. You don't use grantedToIdentities array, but instead grantedTo object:

{
  "roles": [
    "read"
  ],
  "grantedTo": {
    "application": {
      "id": "10facd40-ec88-4c62-b5dc-8170a2ccaba1"
    }
  }
}

NOTE! This payload doesn't work when granting permission on a site level.

SharePoint: How to find out if you have legacy add-ins that are affected by the SharePoint Add-in model retirement

2023-12-14T10:19:00.007+02:00

Question

How to find out if my SharePoint Online tenant has legacy add-ins that stop working when the legacy add-in model is retiring?

Answer

In order to list add-ins, you can use few techniques:

Easiest in my opinion is the CLI for Microsoft 365, as it will give you the result in just a two commands. If you wish to build further automation, you will want to pick the PnP PowerShell library to use in your PowerShell script or the PnP CSOM if you're using .NET.

To get a quick list or add-ins using the CLI for Microsoft 365, first login to your tenant with command:

m365 login

then list the add-ins with command:

m365 spo app list

in order to output the add-in JSON array to a file, use command:

m365 spo app list > add-ins.json

The output will contain array of add-ins, and the property IsClientSideSolution will tell you if the application is legacy and will be retiring.

If IsClientSideSolution is false, it is legacy and will be retired.

If IsClientSideSolution is true, it is modern and will NOT be retired.

Kuluttajariitalautakunnan päätös: Puutteet auton varusteissa

2022-01-12T15:42:00.003+02:00

Kuluttajariitalautakunta käsitteli tapaukseni kun tammikuussa 2020 ostamastani autosta puuttui varusteita, jotka tilaushetkellä oli varustelistauksessa. Lautakunta päätyi suosittamaan hyvitystä. Hyvitysvaateissanne voitte viitata Kuluttajariitalautakunnan julkiseen päätökseen Dnro 6279/33/2020.

Päätöksen PDF:n saa Kuluttajariitalautakunnalta tai allekirjoittaneelta pyydettäessä. Alla copy&paste julkisen päätöksen tekstisisällöstä.

KULUTTAJARIITALAUTAKUNTA PÄÄTÖS Dnro 6279/33/2020

Esitelty 28.10.2021

IVa jaosto

Myyjän vastuu auton puuttuvista varusteista

Lautakunnan ratkaisu

Kuluttajariitalautakunta suosittaa, että Autokeskus Oy maksaa N.Nlle 300 euroa.

Asiaselostus

Kuluttaja osti 26.10.2019 myyjäliikkeeltä uuden Skoda Superb henkilöauton 53 136,95

eurolla. Autolle annettiin kahden vuoden pituinen takuu. Auto toimitettiin kuluttajalle

29.1.2020.

Kuluttajan mukaan autosta puuttuu sellaisia varusteita, joiden kuuluisi olla siinä kaupassa

sovitun mukaisesti. Lisäksi Infotainment-järjestelmä toimii hitaasti. Osapuolet ovat eri mieltä

siitä, onko kyseessä myyjän vastuulla oleva kaupan kohteen virhe, ja mikä on

hinnanalennuksen määrä.

Ostajan vaatimukset perusteluineen

Kuluttaja vaatii myyjäliikkeeltä hyvityksenä 3 000 euroa. Vaatimus perustuu kaupan

kohteessa ilmenneeseen varusteiden ongelmiin ja siihen sisältyy 2 500 euroa puuttuvista

varusteista, 400 euroa puutteellisesti toimivista varusteista ja 100 euroa puhelinkuluista ja

huoltokäynneistä.

Joitain varusteita puuttuu ja jotkin toimivat puutteellisesti. Kuluttaja totesi virheen keväällä

2020 ja ilmoitti siitä 9.9.2020. Kuluttaja viittaa vastaukseen ja toteaa, että Personalisointi ei

toimi eikä ole toiminut syyskuusta 2020 alkaen.

Kuluttaja on myöhemmin todennut, että mahdollisesti schuko-latausjohdon ongelma saatiin

poistettua 28.12.2020 eli 11 kuukautta luovutuksesta. Kuluttaja ei pidä järkevinä ratkaisuna

varusteiden ongelmiin korvata integroidut järjestelmät irrallisilla laitteilla tai manuaalisilla

toiminnoilla. Muuten ongelmiin ei ole tarjottu ratkaisua. GPS-antenni uusittiin 12.1.2021,

mikä ei poistanut ongelmia. Infotainment järjestelmälle on lupailtu päivitystä useita kertoja

turhaan.

Ratkaisupyynnön liitteenä on ajoneuvon käyttöohjekirja.

Myyjän vastaus perusteluineen

Myyjäliike ja maahantuoja ovat antaneet asiassa yhteisen vastauksen, ja toteavat voivansa

maksaa 300 euroa hyvityksenä puuttuvista varusteista.

Maahantuojan toimittamaan myyntimateriaaliin oli jäänyt virheellisesti aiemman

Infotaiment järjestelmän tiedot. Puuttuvia varusteita ovat DVD-soitin 2 SD-korttipaikkaa In

Car Commonication ja Personalisation 1.1.

Autossa on uuden sukupolven Infotainment järjestelmä, jossa on lataushybridijärjestelmälle

tärkeitä ominaisuuksia kuten akun lataukseen liittyvät toiminnot. Järjestelmässä

karttapäivitykset tehdään internetyhteydellä. In Car Communication vahvistaa kuljettajan

ääntä takapenkille ja on tarpeen etenkin seitsenpaikkaisessa autossa. Personalisointi 1.1

tallentaa kuljettajan istuimen säädöt ym. avaimeen. Tässä autossa tallennus voidaan tehdä

istuimen muistipaikkapainikkeisiin ja se on ollut käytettävissä Connect-palvelun kautta

viimeistään syyskuusta 2020 alkaen.

Mode 2 -latausjohtoa varten on olemassa ohjelmistopäivitys veloituksetta. Sen jälkeen

voidaan käyttää täyttä 8A latausvirtaa (n. 1,8 kW). Ennen päivitystä latausvirta oli enintään

6A ja muut lataustavat olivat normaalisti käytettävissä. Asiakkaalle on lähetetty tästä tieto

3.12.2020 ja 11.12.2020. Mahdollisten Infotainment-järjestelmän ongelmien vuoksi asiakasta

on pyydetty tuomaan auto huoltoon tarkistettavaksi 16.9. ja 3.12.2020 sekä myös

11.12.2020. GPS-antenni on uusittu, koska Connect-yhteys oli pätkinyt. Infotainment järjestelmälle on tulossa päivitys viikkoon 29 mennessä vuonna 2021.

Vastauksen liitteenä on Autokeskuksen työmääräyksiä.

Ratkaisun perustelut

Virheellisyyden arviointi

Virheen arvioinnin lähtökohta on osapuolten välisen sopimuksen sisältö. Uuden auton

kaupassa virheen olemassa oloa arvioidaan kuluttajansuojalain 5 luvun 12 §:n mukaan.

Virhearvioinnin perustana ovat ostajan aiheelliset odotukset.

Asiassa on riidatonta, että autosta on puuttunut siihen kuuluneita varusteita. Kuluttaja on

perustellusti voinut edellyttää, että autossa on hänelle ilmoitetut varusteet, joten kaupassa

on tällä perusteella kuluttajansuojalain 5 luvun 12 §:n mukainen virhe. Kauppa ei ole kaikilta

osin vastannut sitä, mistä asiassa on sovittu.

Infotainment-järjestelmän osalta autoon on tehty päivityksiä, ja tältä osin asiassa ei ole

tarkempaa tietoa siitä, mikä on järjestelmän tilanne päivitysten jälkeen. Asiassa ei ole

esitetty ulkopuolista selvitystä siitä, voidaanko kuluttajan esiin nostama ongelma katsoa

kuluttajansuojalain mukaiseksi virheeksi. Tältä osin asiassa ei esitetyn näytön valossa ole

todettavissa virhettä.

Virheen seuraamukset

Myyjäliike saa omalla kustannuksellaan korjata virheen, jos se tarjoutuu tekemään

korjauksen viipymättä saatuaan tietää virheestä. Myyjällä on oikeus osoittaa ostajalle myyjän

lukuun tehtävän korjauksen paikka. Ostaja saa kieltäytyä virheen korjaamisesta vain

erityisestä syystä, esimerkiksi, jos siitä aiheutuisi hänelle olennaista haittaa.

Tässä tapauksessa virheen korjaaminen ei ole mahdollista, koska ajoneuvoon ei ole

asennettu puuttuvia varusteita, vaan ne on tarjottu käytettäviksi ulkoisina järjestelminä, joita

ei ole integroitu autoon. Näin ollen tarjottu korjaustapa ei ole asianmukainen, ja asiaa on

arvioitava hinnanalennukseen perustuen.

Hyvityksen määrän arviointi perustuu ilmenneen virheen laadun ja merkityksen ohella

kauppahintaan sekä ostajan aiheellisiin odotuksiin.

Nämä seikat huomioon otettuna lautakunta katsoo, että myyjäliikkeen tulee suorittaa

ostajalle hinnanalennuksena ja korvauksena tarpeellisista kuluista yhteensä 300 euroa.

Päätös oli yksimielinen.

SharePoint: Transport-level error has occurred when receiving results from the server

2021-11-02T10:26:00.006+02:00

Problem

SharePoint 2016 (on-prem) farm had weird issues on few application and WFE servers. Namely, the servers couldn't connect to SQL Server, but ULS logs showed error:

Unknown SQL Exception 64 occurred. Additional error information from SQL Server is included below. A transport-level error has occurred when receiving results from the server. (provider: TCP Provider, error: 0 - The specified network name is no longer available.)

When testing the connection with UDL file, the behavior was also strange, i.e., when testing the connection to server without defining any specific database, the test succeeded:

Also when defining a specific database, the test succeeded:

However, when attempting to list the databases by expanding the "Select the database on the server" dropdown, there was first "Unspesified error" error:

Followed by error "Microsoft Data Link
Login failed. Catalog information cannot be retrieved.":

Solution

Solution was (eventually) to fix the Jumbo Packet setting on the servers having the issue. Other servers had value 1514, while the problematic servers had value 9014 and changing value to 1514 made all the SharePoint servers immediately connect to SQL Server, and also the UDL DB listing started working.

Edge: Reverting to classic authentication dialog a.k.a disable Windows Hello for HTTP authentication

2021-09-29T09:52:00.007+03:00

Problem

In recent Microsoft Edge browser versions 90+, the classic authentication dialog (or NTLM authentication dialog, or Windows authentication prompt) has been replaced by Windows Hello authentication prompt. It's all nice and secure, but at the moment at least, browser password vault extensions such as 1Password cannot fill in the credentials to that modern prompt. What it means is that you need to close the Windows Hello prompt, open password extension, copy username/password to notepad, refresh browser window, paste credentials from notepad to Windows Hello prompt. *yawn*

This is cumbersome in enterprise scenarios with various internal systems such as SharePoint that may require you to login with different credentials from the one you're currently logged into Windows.

Solution

For now the only solution is to disable the Windows Hello prompt in Edge. It will require using Group Policies either on AD level, or on individual machine. The following steps are for individual machine, but if you're an AD admin, you can pick the essential pieces from the instructions and do the same on AD level policy.

First download MS Edge policy file from https://aka.ms/EdgeEnterprise, from the drop-downs, select the version of your Edge, then press GET POLICY FILES
Extract the .cab, and .zip 🙄
Navigate to .\MicrosoftEdgePolicyTemplates\windows\admx folder
Copy msedge.admx to C:\Windows\PolicyDefinitions
Navigate to .\MicrosoftEdgePolicyTemplates\windows\admx\en-US folder (NOTE! or the language of your Windows installation, if not en-US)
Copy msedge.adml to C:\Windows\PolicyDefinitions\en-US
Open Local Group Policy Editor, and navigate to Computer Configuration / Administrative Templates / Microsoft Edge / HTTP Authentication
Edit Windows Hello For HTTP Auth Enabled setting, and set it to Disabled
Click OK to confirm policy setting, and refresh page in Edge - no restart needed
Applauds! Classic authentication prompt is back and you can also access the browser extension

Auth0: Invalid RSAES-OAEP padding

2021-09-20T10:43:00.005+03:00

Problem

After configuring Auth0 with custom certificates via API, you get Access Denied error when attempting to login.

{ "error": "access_denied", "error_description": "Invalid RSAES-OAEP padding." }

Solution

Add an additional decryptionKey to the connection's options with the following format.

options: {

  //... other options

  "decryptionKey" : {

        "key": "-----BEGIN PRIVATE KEY-----\n...",

        "cert": "-----BEGIN CERTIFICATE-----\n..."

Keep in mind that options are replaced, not merged - so you'll need to send the whole options object to the PATCH call.

Azure B2C: Adding missing translations on Page Layouts

2021-04-28T14:22:00.002+03:00

Problem

After starting to use Azure B2C custom Page Layout versions newer than 2.0.0, you will find translations are missing on many controls. Documentation is lacking behind, so it will take some trial and error to figure out some of the translation IDs. In the following pictures, you see missing translations marked with beautiful hand drawn red arrows.

Solution

As B2C _should_ already include these translations, the only workaround currently is to manually provide the missing strings in your Custom Policy. The following will work for urn:com:microsoft:aad:b2c:elements:contract:unifiedssp:2.1.4 and urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.4.

So first of all, add LocalizedResourceReference elements in the ContentDefinition elements.

<ContentDefinition Id="api.signuporsignin">
  <LoadUri>https://xyz.blob.core.windows.net/customui/ocean_blue/unified.html</LoadUri>
  <RecoveryUri>https://xyz.blob.core.windows.net/customui/ocean_blue/exception.html</RecoveryUri>
  <DataUri>urn:com:microsoft:aad:b2c:elements:contract:unifiedssp:2.1.4</DataUri>
  <Metadata>
    <Item Key="DisplayName">Signin and Signup</Item>
  </Metadata>
  <LocalizedResourcesReferences MergeBehavior="Prepend">
    <LocalizedResourcesReference Language="fi" LocalizedResourcesReferenceId="api.signuporsignin.fi" />
  </LocalizedResourcesReferences>
</ContentDefinition>
<ContentDefinition Id="api.selfasserted">
  <LoadUri>https://xyz.blob.core.windows.net/customui/ocean_blue/selfAsserted.html</LoadUri>
  <RecoveryUri>https://xyz.blob.core.windows.net/customui/ocean_blue/exception.html</RecoveryUri>
  <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.4</DataUri>
  <Metadata>
    <Item Key="DisplayName">Collect information from user page</Item>
  </Metadata>
  <LocalizedResourcesReferences MergeBehavior="Prepend">
    <LocalizedResourcesReference Language="fi" LocalizedResourcesReferenceId="api.localaccountpasswordreset.fi" />
  </LocalizedResourcesReferences>
</ContentDefinition>

Then the actual strings you will add in the Localization element.

<LocalizedResources Id="api.signuporsignin.fi">
  <LocalizedStrings>
    <LocalizedString ElementType="ClaimType" ElementId="signInName" StringId="DisplayName">Sähköpostiosoite</LocalizedString>
    <LocalizedString ElementType="ClaimType" ElementId="password" StringId="DisplayName">Salasana</LocalizedString>
    <LocalizedString ElementType="UxElement" StringId="local_intro_generic">Kirjaudu sisään aiemmin luodulla tililläsi</LocalizedString>
  </LocalizedStrings>
</LocalizedResources>
<LocalizedResources Id="api.localaccountpasswordreset.fi">
  <LocalizedStrings>
    <LocalizedString ElementType="ClaimType" ElementId="email" StringId="DisplayName">Sähköpostiosoite</LocalizedString>
    <LocalizedString ElementType="ClaimType" ElementId="VerificationCode" StringId="DisplayName">Vahvistuskoodi</LocalizedString>
    <LocalizedString ElementType="ClaimType" ElementId="signInNames.emailAddress" StringId="DisplayName">Sähköpostiosoite</LocalizedString>
    <LocalizedString ElementType="DisplayControl" ElementId="emailVerificationSSPRControl" StringId="email">Sähköpostiosoite</LocalizedString>
    <LocalizedString ElementType="DisplayControl" ElementId="emailVerificationSSPRControl" StringId="ver_input">Vahvistuskoodi</LocalizedString>
    <LocalizedString ElementType="DisplayControl" ElementId="emailVerificationSSPRControl" StringId="verificationcode">Vahvistuskoodi</LocalizedString>
    <LocalizedString ElementType="DisplayControl" ElementId="emailVerificationSSPRControl" StringId="intro_msg">Syötä sähköpostiosoitteesi ja paina Lähetä vahvistuskoodi -painiketta.</LocalizedString>
    <LocalizedString ElementType="DisplayControl" ElementId="emailVerificationSSPRControl" StringId="but_send_code">Lähetä vahvistuskoodi</LocalizedString>
    <LocalizedString ElementType="DisplayControl" ElementId="emailVerificationSSPRControl" StringId="but_verify_code">Vahvista koodi</LocalizedString>
    <LocalizedString ElementType="DisplayControl" ElementId="emailVerificationSSPRControl" StringId="but_send_new_code">Lähetä uusi koodi</LocalizedString>
    <LocalizedString ElementType="DisplayControl" ElementId="emailVerificationSSPRControl" StringId="success_send_code_msg">Vahvistuskoodi on lähetetty sähköpostiisi. Kopioi se alla olevaan syöteruutuun ja paina Vahvista koodi -painiketta.</LocalizedString>
  </LocalizedStrings>
</LocalizedResources>

Please note that this is not a comprehensive list of missing translations, so feel free to comment below if you happen to have a full tested list of translations that will work with the new Page Layouts.

Office Add-In: Empty group label

2021-03-23T13:31:00.004+02:00

Problem

I needed to create Outlook Add-In Ribbon button without Group label, like the Insights Add-In does.

Solution

As the Group element requires Label, and the String of the Label requires DefaultValue to have some value, the workaround was to set the DefaultValue as one space character.

Ta-daa!

WebView2: How to hide scrollbars

2021-02-26T09:58:00.026+02:00

Problem

When using the new Microsoft Edge WebView2 control, it often displays scroll bars and the control doesn't have any explicit property to hide the scroll bars.

Solution

You need to use custom Javascript at the NavigationCompleted event to hide the scrollbars.

Simply add a new NavigationCompleted event handler for the WebView2 control and use the ExecuteScriptAsync method to run a Javascript that hides the scroll bars.

private void WebView2_NavigationCompleted(object sender, CoreWebView2NavigationCompletedEventArgs e)
{
    if (e.IsSuccess)
    {
        ((WebView2)sender).ExecuteScriptAsync("document.querySelector('body').style.overflow='hidden'");
    }
}

Note! Code above hides scrollbars AND disables scrolling. If you would like to hide scrollbars but retain scrolling (with touch for example), please use this code instead.

private void WebView2_NavigationCompleted(object sender, CoreWebView2NavigationCompletedEventArgs e)
{
    if (e.IsSuccess)
    {
        ((WebView2)sender).ExecuteScriptAsync("document.querySelector('body').style.overflow='scroll';var style=document.createElement('style');style.type='text/css';style.innerHTML='::-webkit-scrollbar{display:none}';document.getElementsByTagName('body')[0].appendChild(style)");
    }
}

Azure Managed Identity: Obtaining token gives error ‘invalid_client’

2021-01-27T15:01:00.004+02:00

Problem

One of our Azure App Services suddenly started behaving badly and throwing HTTP 400 errors. From Application Insights we could see the error was coming from a call to LOCALHOST:PORT/MSI/token which is the location where access token is requested in case your code wants to access other Azure resources using Managed Identity (formerly MSI).

Troubleshooting

I went to Kudu PowerShell console of the given App Service and tried to manually get the access_token, but couldn’t.

Command for that is:
Invoke-WebRequest -Uri 'http://127.0.0.1:41332/MSI/token/?resource=https://management.azure.com/&api-version=2017-09-01' -Method GET -Headers @{Metadata="true";Secret="$env:MSI_SECRET"} -UseBasicParsing

Note! Port in the URL is different in your App Service, you can get it via @env:MSI_ENDPOINT.

All I got was HTTP 401 error with ‘invalid_client’ error code. Strange. In respective DEV App Service there was no errors and access_code was returned nicely.

By the way, details of the Uri and other parameters can be found here. Header is different if you’re using more recent api-version.

By the way, if you just run the Invoke-WebRequest, you will get error:

Win32 internal error "The handle is invalid" 0x6 occurred while reading the console output buffer. Contact Microsoft Customer Support Services.

No point in contacting MS Support, just run the following command and retry:

$ProgressPreference="SilentlyContinue"

Solution

Now, for the solution…good old IISRESET. Of course in Azure you restart the App Service in question. After restarting the App Service, you can re-run the Invoke-WebRequest, and access_token is returned correctly, and App Service works.

MS Flow: Simplest retry logic for SharePoint Online HTTP 400 errors

2020-06-26T13:15:00.001+03:00

Problem

When setting SharePoint Online document properties from Flow, you will run into issues if the document is locked, i.e., someone has it open. In this case, SharePoint throws HTTP 400 that cannot be caught by the built-in retry-logic of the Update Item Flow action.

Solution

Simplest Do Until loop I came up with can be seen below. I didn’t find using Scope action necessary. In case you need to re-use this elsewhere in your Flow, it is quite straight forward to copy the Do Until action and paste it elsewhere. Just remember to add Set Variable action before each Do Until and set the fileLocked variable to true.

At first, the two Set variable actions were a bit confusing, the first one is only set to run after the SharePoint Update Item action has succeeded (and in that you set the fileLocked to false). The second one, however, is set to be run if the previous Set variable action is skipped (and in that you set the fileLocked to true), and as the first one is skipped if the Update Item fails, we then know it did NOT succeed.

It feels a bit weird to have the second Set variable (Set variable 2) as fileLocked variable value is not changing, but this is the high level logic people seem to do this so there may be some room for further improvement.

Microsoft Flow: Using HTTP Webhook action with Azure Automation Runbook

2020-05-14T12:07:00.003+03:00

Task

I needed to create new SharePoint Online Document Library and amongst other things set a Retention Label on that newly created Document Library using Microsoft Flow. Creating new doclib is straightforward using Flow, but I just couldn’t set the the Retention Label via REST from Flow. There is an API for that, but due to reasons I couldn’t get it to work from Flow.

We had an Azure Automation Runbook that was called at the end of the Flow anyway, so I decided to use that to set the Label on the SPO Library using SharePoint Online PnP’s Set-PnPLabel. No problem. However, it takes a while for the Label to be applied to the Library and as email was sent to users at the end of the Flow, they found themselves in the library too early, i.e., the Label was not yet set.

Solution

FLOW

I could’ve used a “Do Until” loop in Flow and poll the list but that’s not something we like to do, right? We like events and triggers, so why not use the HTTP Webhook action, sounds exciting!

In the screenshot above, I’m calling the Azure Automation Runbook, but you can really call anything that is capable of listening to your request and at the and making a HTTP request back to the callback URL you define. You define your endpoint address in the Subscribe - URI field.

In the Subscribe - Body you must at least pass in the listCallbackUrl() so that you know the endpoint of this specific Flow instance you need to call in your backend code. Note that listCallbackUrl() is generated automatically, is specific to this running instance of the Flow, and can only be called once. Flow processing will halt at this action and it will continue when your backend code calls the listCallbackUrl(). You can define timeout of how long the action waits for the callback in the action settings.

Here I’m also passing in the title of the SharePoint Library as I’m also doing some tricks on the library but you would pass in anything you need in your scenario.

BACKEND

In the backend code you will do whatever you need, but when you’re done, make HTTP POST call to the URL you received as a parameter in your backend code, in my case that would look like this in PowerShell.

param(
    [Parameter (Mandatory = $true)]
    [object]$webhookData
)

# If runbook was called from Webhook, WebhookData will not be null.
if ($WebhookData) {
    # Retrieve VMs from Webhook request body
    $body = (ConvertFrom-Json -InputObject $WebhookData.RequestBody)

    ####
    # Do something in your code...
    ###
    
    # ...and when you're done, call the callback URL
    Invoke-WebRequest $body.CallbackUrl -Method POST -UseBasicParsing
}

If you look at the Flow when it is running, you see it pause at the HTTP Webhook action, and continue as soon as the backend calls the callback URL. You can also manually call the callback URL using e.g., Postman, just paste in the callback URL and make sure method is POST. You will get HTTP 200 when the callback call succeeds.

Cloning OneNote Tab without /clone REST endpoint

2020-04-14T12:12:00.001+03:00

Series

This is series of blog articles showing how to clone Teams Channels and Tabs without using the Clone REST endpoint or direct REST queries. Except we use the Microsoft.Graph (3.1.0). First post discusses things in general, details about different tab types are separated to individual articles.

Cloning Teams Channels and Tabs without /clone REST endpoint
Cloning Planner Tab without /clone REST endpoint
Cloning OneNote Tab without /clone REST endpoint <<YOU ARE HERE>>
Cloning Web Tab without /clone REST endpoint (TBD)
Copying Teams Files tab content using MoveCopyUtil

Solution

In this piece of code, we first determine current source tab is of type OneNote. We must first create new Notebook for the tab, and for this we add simple retry logic as you cannot have Notebooks with duplicate name. This retry logic adds running integer to Notebook name until the creation succeeds.

Now, after we have successfully created the Notebook, it is time to create the Tab. Do note the special format of the EntityId parameter for the tab, as well as rather identical URLs.

Finally, note that you may end up getting ServiceException although tab creation succeeds, thus the scary Exception swallowing.

Using term cloning when it comes to this tab type can be a bit misleading, as we’re not cloning the tab content, but only the tab and creating new content. Perhaps think of this as cloning from the Team perspective, while the individual tabs

if (sourceTab.TeamsApp.Id.Equals(TeamsAppId.OneNote))
{
logger?.LogInformation($"Creating OneNote. Channel: {sourceChannel.DisplayName}. {newTeamId}");

var newNotebook = await retry.ExecuteAsync(async () =>
{
    var i = 0;
    Notebook nb = null;
    string nbName;

    while (i < 100 && null == nb)
    {
        nbName = $"{TextTools.RemoveSpecialCharactersForNotebook(requestData.title)}{(i > 0 ? $" {i}" : "")} Notebook";

        try
        {
            nb = await graphClient.Groups[newGroup.Id].Onenote.Notebooks.Request().AddAsync(new Notebook()
            {
                DisplayName = nbName
            });

            break;
        }
        catch (ServiceException ex)
        {
            if ((int)ex.StatusCode == 409)
            {
                // this is fine, Notebook with such name already exists, let's find first available by appending integers to name
                logger?.LogWarning($"Notebook with name '{nbName}' already exists, trying next integer. Channel: {sourceChannel.DisplayName}. {newTeamId}");
            }
        }
        finally
        {
            i++;
        }
    }

    return nb;
});

try
{
    logger?.LogInformation($"Adding OneNote tab. Channel: {sourceChannel.DisplayName}. {newTeamId}");

    await retry.ExecuteAsync(async () =>
    {
        await graphClient.Teams[newTeamId].Channels[channelId].Tabs.Request().AddAsync(new TeamsTab()
        {
            ODataType = null,
            DisplayName = newNotebook.DisplayName,
            Configuration = new TeamsTabConfiguration()
            {
                EntityId = $"{Guid.NewGuid()}_{newNotebook.Id}",
                ContentUrl = $"https://www.onenote.com/teams/TabContent?entityid=%7BentityId%7D&subentityid=%7BsubEntityId%7D&auth_upn=%7Bupn%7D&notebookSource=New&notebookSelfUrl=https%3A%2F%2Fwww.onenote.com%2Fapi%2Fv1.0%2FmyOrganization%2Fgroups%2F{{groupId}}%2Fnotes%2Fnotebooks%2F{newNotebook.Id}&oneNoteWebUrl={newNotebook.Links.OneNoteWebUrl.Href}&notebookName={newNotebook.DisplayName}&ui={{locale}}&tenantId={{tid}}",
                RemoveUrl = $"https://www.onenote.com/teams/TabRemove?entityid=%7BentityId%7D&subentityid=%7BsubEntityId%7D&auth_upn=%7Bupn%7D&notebookSource=New&notebookSelfUrl=https%3A%2F%2Fwww.onenote.com%2Fapi%2Fv1.0%2FmyOrganization%2Fgroups%2F{{groupId}}%2Fnotes%2Fnotebooks%2F{newNotebook.Id}&oneNoteWebUrl={newNotebook.Links.OneNoteWebUrl.Href}&notebookName={newNotebook.DisplayName}&ui={{locale}}&tenantId={{tid}}",
                WebsiteUrl = $"https://www.onenote.com/teams/TabRedirect?redirectUrl={newNotebook.Links.OneNoteWebUrl.Href}"
            },
            AdditionalData = new Dictionary<string, object>()
            {
                {
                    "teamsApp@odata.bind", $"https://graph.microsoft.com/v1.0/appCatalogs/teamsApps/{sourceTab.TeamsApp.Id}"
                }
            }
        });
    });
}
catch (ServiceException ex)
{
    HandleTabCreationException(ex, logger, sourceTab, newTeamId);
}
}

Cloning Planner Tab without /clone REST endpoint

2020-04-09T13:38:00.001+03:00

Series

Cloning Teams Channels and Tabs without /clone REST endpoint
Cloning Planner Tab without /clone REST endpoint <<YOU ARE HERE>>
Cloning OneNote Tab without /clone REST endpoint
Cloning Web Tab without /clone REST endpoint (TBD)
Copying Teams Files tab content using MoveCopyUtil

Solution

In this piece of code, we first determine current source tab is of type Planner. Then comes the tricky part: you cannot use Application permissions to create the Planner Plan itself, but you must use Delegated permissions, so basically what you need is a dedicated user account, and use a GraphServiceClient that uses UsernamePasswordProvider as IAuthenticationProvider for the Graph API calls. Yes, you really gotta put username and password of that user in Key Vault and fetch those here.

Now, after we have successfully created the Planner Plan, we will do a small trick and do not create the contentUrl property for the new tab manually, but take the ContentUrl from the source Tab and just replace the old Planner Id with the Id of the newly created Planner. Lovely. Just note that the WebsiteUrl needs to be done separately, otherwise the “Go to website” link on top right of the Planner tab is broken and will be stuck loading and give error “Error loading user settings. Please try again. If this continues please contact customer support.” after few minutes.

For creating the new Tab, there’s not much to say. These are the parameters you need to define based on a bit of trial and error. As Graph API evolves and improves, this is the part that will most probably need updating, but at least with Microsoft.Graph v. 3.1.0 it works – which is already old version as 3.2.0 was released few hours ago.

Finally, note that you may end up getting ServiceException although tab creation succeeds, thus the scary Exception swallowing.

// Planner
if (sourceTab.TeamsApp.Id.Equals(TeamsAppId.Planner))
{
    logger?.LogInformation($"Creating Planner. Channel: {sourceChannel.DisplayName}. {newGroup.Id}");

    var newPlannerPlan = await retry.ExecuteAsync(async () =>
    {
        return await Authentication.GetGraphApiClientClientUsernamePasswordProvider(keyvault).Planner.Plans.Request()
            .WithUsernamePassword(keyvault.GetSecret("teamsClone--SPOUser"), new System.Net.NetworkCredential("", keyvault.GetSecret("teamsClone--SPOPassword")).SecurePassword)
            .AddAsync(new PlannerPlan()
            {
                Owner = newGroup.Id,
                Title = $"{TextTools.RemoveSpecialCharactersForNotebook(requestData.title)} Planner"
            });
    });

    try
    {
        string contentUrl = sourceTab.Configuration.ContentUrl.Replace(sourceTab.Configuration.EntityId, newPlannerPlan.Id);
        string websiteUrl = $"https://tasks.office.com/YOURTENANT.onmicrosoft.com/Home/Planner#/plantaskboard?groupId={newTeamId}&planId={newPlannerPlan.Id}";

        logger?.LogInformation($"Adding Planner tab. Channel: {sourceChannel.DisplayName}, ContentUrl: {contentUrl}. {newGroup.Id}");

        await retry.ExecuteAsync(async () =>
        {
            await graphClient.Teams[newTeamId].Channels[channelId].Tabs.Request().AddAsync(new TeamsTab()
            {
                ODataType = null,
                DisplayName = sourceTab.DisplayName,
                TeamsApp = sourceTab.TeamsApp,
                Configuration = new TeamsTabConfiguration()
                {
                    EntityId = newPlannerPlan.Id,
                    ContentUrl = contentUrl,
                    RemoveUrl = contentUrl,
                    WebsiteUrl = webSiteUrl
                },
                AdditionalData = new Dictionary<string, object>()
    {
        {
            "teamsApp@odata.bind", $"https://graph.microsoft.com/v1.0/appCatalogs/teamsApps/{sourceTab.TeamsApp.Id}"
        }
    }
            });
        });
    }
    catch (ServiceException ex)
    {
        HandleTabCreationException(ex, logger, sourceTab);
    }
}

Cloning Teams Channels and Tabs without /clone REST endpoint

2020-04-09T12:54:00.001+03:00

Series

Cloning Teams Channels and Tabs without /clone REST endpoint <<YOU ARE HERE>>
Cloning Planner Tab without /clone REST endpoint
Cloning OneNote Tab without /clone REST endpoint
Cloning Web Tab without /clone REST endpoint (TBD)
Copying Teams Files tab content using MoveCopyUtil

Task

As cloning a Microsoft Teams Team using the https://graph.microsoft.com/v1.0/teams/{sourceeamId}/clone has few things that might surprise you (such as described here), you will anyway need go through all cloned tabs to verify they’re working. Why not instead create a fresh Channel based on the source Team Channel, then enumerate source Team tabs and recreate new tabs in the destination Channel based on the properties of the source Tab?

Solution

Enough chit-chat, lets dive in!

What happens in the code is that we first get source Team, Channels, and their Tabs. Having already created new Group and related Team (out of scope of this specific article), we start creating Channels in the new Team based on source Team Channels.

Reason why I didn’t include details of creating new Group and related Team here is because you could apply this same logic on existing Teams as well. Maybe if you’d like to push new Channel or Tab to existing Teams? Welcome, this code will work just nice.

After creating each Channel, we loop through the source Channel Tabs. Based on the source Tab type, and also how it is eventually been configured, we recreate identical Tab.

Good thing in this way of doing this is that you have full control of the Tab cloning operation.Then again it also means that you will have to implement that full control logic and program code.

Depending on the tab type, term cloning might be a bit misleading, as in all cases we’re not cloning tab content but creating new background resource (such as Planner Plan or OneNote Notebook) and just binding to it from the tab. Maybe think of cloning here as cloning the Team structure including channels and tabs.

logger?.LogInformation("Getting source team channels and tabs");

var sourceTeamChannels = await retry.ExecuteAsync(async () =>
{
    return await graphClient.Teams[sourceTeamId].Channels.Request().GetAsync();
});

foreach (var chan in sourceTeamChannels)
{
    chan.Tabs = await retry.ExecuteAsync(async () =>
    {
        return await graphClient.Teams[sourceTeamId].Channels[chan.Id].Tabs.Request().Expand("TeamsApp").GetAsync();
    });
}

foreach (var sourceChannel in sourceTeamChannels)
{
    var newChannel = await retry.ExecuteAsync(async () =>
    {
        logger?.LogInformation($"Adding channel {sourceChannel.DisplayName}. {newGroup.Id}");
        return await graphClient.Teams[newTeamId].Channels.Request().AddAsync(new Microsoft.Graph.Channel()
        {
            ODataType = null,
            DisplayName = sourceChannel.DisplayName,
            Description = sourceChannel.Description
        });
    });

    channelId = newChannel.Id;

    // here you should remove the Wiki tab (see separate article)

    foreach (var sourceTab in sourceChannel.Tabs)
    {
        // here you will have switch or if/else construct to determine source tab type
        if (sourceTab.TeamsApp.Id.Equals(TeamsAppId./*TAB TYPE*/))
        {
            // and actual tab type specific creation and configuration logic
        }
    }
}

By the way, you’ll be needing this Exception handler later, as tab creation will throw specific ServiceExceptions even though creation succeeds.

private static void HandleTabCreationException(ServiceException ex, ILogger logger, TeamsTab sourceTab)
{
    if (ex.StatusCode.ToString() == "BadRequest" && ex.Error.Message == "Value cannot be null.\r\nParameter name: entity")
    {
        // this is fine: https://stackoverflow.com/questions/59784200/programmatically-creating-teamtab-used-to-work-but-now-gives-error-after-updati
        logger?.LogInformation($"Tab {sourceTab.TeamsApp.Id} created: {sourceTab.DisplayName}");
    }
    else
    {
        logger?.LogInformation($"Error creating tab: {sourceTab.TeamsApp.Id}: {sourceTab.DisplayName}");
    }
}

Also, extending Laura’s TeamsAppId class a bit will come handy, thank you Laura!

public static class TeamsAppId
{
    public static readonly string OneNote = "0d820ecd-def2-4297-adad-78056cde7c78";
    public static readonly string Planner = "com.microsoft.teamspace.tab.planner";
    public static readonly string SharePoint = "2a527703-1f6f-4559-a332-d8a7d288cd88";
    public static readonly string Web = "com.microsoft.teamspace.tab.web";
    public static readonly string Wiki = "com.microsoft.teamspace.tab.wiki";
}

Copying Teams Files tab content using MoveCopyUtil

2020-04-08T12:55:00.001+03:00

Series

Cloning Teams Channels and Tabs without /clone REST endpoint
Cloning Planner Tab without /clone REST endpoint
Cloning OneNote Tab without /clone REST endpoint
Cloning Web Tab without /clone REST endpoint (TBD)
Copying Teams Files tab content using MoveCopyUtil <<YOU ARE HERE>>

Task

As part of Teams provisioning, content of Files tab needed to be copied from source Team to the destination Team. As you might know, in practice it just means copying folders and files across SharePoint site collections.

Solution

Microsoft.SharePoint.Client.MoveCopyUtil will do the trick UNLESS a folder name contains special characters, see here for example. This has been an issue for long in CSOM, and if at all possible, I recommend not having special characters in folder names, and not in file names either for that matter.

If you must support special character scenarios, it is doable, but will require carefully splitting and constructing the query parameters and effectively means you need to loop and create/copy folders and files one by one. I’ve spent some time creating SPFx solution that manages to do this, and I recommend thinking not twice, but ten times before agreeing to support special characters in this case. Good thing is that in this Teams provisioning scenario you will have control over the source Team and should be able to work around any needs for special characters.

Explanation of the code

What happens in this code can probably be read quite well by looking at the LogInformation entries, but the idea is that we get hold of the Drive item of the source and destination Group. Drive.WebUrl is then absolute URL to the document library where Teams File tab contents are in their own sub-folders.

As a reminder, each File tab in a Team Channel maps to one root level folder (Channel name = folder name) in that document library you find at Drive.WebUrl.

Another nice thing about Group.Drive is that whenever we get hold of that, and it is not returning HTTP 404, we know Group provisioning (the process that runs in the background and creates all back-end dependencies, such as the SharePoint site) has been completed.

retry object is Polly’s AsyncRetryPolicy and ensures retry logic in case provisioning would not be yet ready at this point. It will retry the call as configured, in my case every 5 seconds, until the .GetAsync() completes successfully.

Next up there is some ugly parsing of the source document library path, namely we’re removing the document library part from the URL, leaving us with URL of the SPWeb. There are many ways of doing this, and I admit this one is quite verbose way of doing it but doesn’t at least require additional HTTP query.

Then we get to the actual point, initializing SharePoint context using the source SPWeb, and credentials stored in Azure Key Vault.

After getting all the root level folders (each corresponding a Channel, yes, good), we loop through each folder item and use MoveCopyUtil.CopyFolder to copy it to destination document library. Just remember to set the MoveCopyOptions to KeepBoth, indicating this is a Copy operation and not Move operation.

I felt more comfortable doing .ExecuteQuery for each folder, although it means few more HTTP calls, but allows improved error handling in case of those special characters, or some other problems that might occur during the copy operation.

public static async Task CopyDocuments(string srcGroupId, string dstGroupId, AsyncRetryPolicy retry, GraphServiceClient graphClient, KeyVault keyvault, ILogger logger)
{
    var sourceDrive = await retry.ExecuteAsync(async () =>
    {
        return await graphClient.Groups[srcGroupId].Drive.Request().GetAsync();
    });

    var destDrive = await retry.ExecuteAsync(async () =>
    {
        return await graphClient.Groups[dstGroupId].Drive.Request().GetAsync();
    });

    try
    {
        logger?.LogInformation($"Copying SPO files, source drive: {sourceDrive.WebUrl}");
        logger?.LogInformation($"Copying SPO files, destination drive: {destDrive.WebUrl}");

        var sourceUri = new Uri(sourceDrive.WebUrl);
        string sourceSiteUrlWithoutLastSegment = sourceUri.AbsoluteUri.Remove(sourceUri.AbsoluteUri.Length - sourceUri.Segments.Last().Length);

        using (var srcContext = new OfficeDevPnP.Core.AuthenticationManager()
            .GetSharePointOnlineAuthenticatedContextTenant(sourceSiteUrlWithoutLastSegment, keyvault.GetSecret("teamsClone--SPOUser"), keyvault.GetSecret("teamsClone--SPOPassword")))
        {
            logger?.LogInformation($"Copying SPO files, getting root folders");

            // get folders at root                   
            var targetList = srcContext.Web.Lists.GetByTitle(sourceDrive.Name);

            // This method only gets the folders which are on top level of the list/library
            FolderCollection oFolderCollection = targetList.RootFolder.Folders;

            // Load folder collection
            srcContext.Load(oFolderCollection);
            srcContext.ExecuteQuery();

            MoveCopyOptions option = new MoveCopyOptions
            {
                KeepBoth = true
            };

            logger?.LogInformation($"Copying SPO files, looping folders");

            foreach (var folder in oFolderCollection)
            {
                if (folder.Name.Equals("Forms"))
                {
                    continue;
                }

                try
                {
                    logger?.LogInformation($"Copying SPO files, copying folder '{sourceUri.GetLeftPart(UriPartial.Authority) + folder.ServerRelativeUrl}' -> '{destDrive.WebUrl}/{folder.Name}'");

                    MoveCopyUtil.CopyFolder(
                        srcContext,
                        sourceUri.GetLeftPart(UriPartial.Authority) + folder.ServerRelativeUrl,
                        $"{destDrive.WebUrl}/{folder.Name}",
                        option);

                    srcContext.ExecuteQuery();

                    logger?.LogInformation("Copying done");
                }
                catch (Exception ex)
                {
                    logger?.LogError($"Error copying SPO folder {folder.Name}. {ex.Message}");
                }
            }
        }
    }
    catch (Exception ex)
    {
        logger?.LogError($"Error copying SPO content. {ex.Message}");
    }
}

Remove Wiki tab during provisioning of Teams channels

2020-04-03T12:01:00.004+03:00

Task

Remove Wiki tab during provisioning of Teams channels.

Solution

As I’m not cloning my Team, but instead enumerating channels and tabs of the source Team used as a template, it was quite straightforward to include the Wiki tab remove logic to the stage where I’m anyway fetching Tabs for each source Team Channel.

This one includes Polly retry-logic for the DELETE operation (my first time using Polly so there’s probably lot of room for improvement).

It would also be nice to bake the Polly retry-logic into the GraphServiceClient itself instead of surrounding all calls. If you know it has already been done, please comment below. I’m always looking forward to improve my code.

I’m currently using version 3.21.0 of Microsoft.Graph library.

Code updated to latest version March 30, 2021.

var team = new Team()
{
    ODataType = null,
    MessagingSettings = sourceTeam.MessagingSettings,
    FunSettings = sourceTeam.FunSettings,
    GuestSettings = sourceTeam.GuestSettings,
    MemberSettings = sourceTeam.MemberSettings
};

team.MessagingSettings.ODataType = null;
team.FunSettings.ODataType = null;
team.GuestSettings.ODataType = null;
team.MemberSettings.ODataType = null;

Team newTeam;

try
{
    newTeam = await retry.ExecuteAsync(async () =>
    {
        return await graphClient.Groups[newGroup.Id].Team
        .Request()
        .PutAsync(team);
    });
}
catch (Exception ex)
{
    logger?.LogError($"Error adding team to group: {ex.Message} {newGroup.Id}");
    return;
}

// get new team channels
var newTeamId = newTeam.Id;

logger?.LogInformation($"Getting new team channels {newTeamId}");

var newTeamChannels = await retry.ExecuteAsync(async () =>
{
    return await graphClient.Teams[newTeamId].Channels.Request().GetAsync();
});

logger?.LogInformation($"Getting new team tabs {newTeamId}");

// and tabs
foreach (var chan in newTeamChannels)
{
    chan.Tabs = await retry.ExecuteAsync(async () =>
    {
        return await graphClient.Teams[newTeamId].Channels[chan.Id].Tabs.Request().Expand("TeamsApp").GetAsync();
    });

    await Content.RemoveWikiTab(newTeamId, chan, retry, graphClient, logger);
}

// Define RemoveWikiTab somewhere else

/// <summary>
/// Removes wiki tab from given channel
/// </summary>
/// <param name="newTeamId"></param>
/// <param name="channel"></param>
/// <param name="retry"></param>
/// <param name="graphClient"></param>
/// <param name="logger"></param>
/// <returns></returns>
public static async Task RemoveWikiTab(string newTeamId, Microsoft.Graph.Channel channel, AsyncRetryPolicy retry, GraphServiceClient graphClient, ILogger logger)
{
    for (int i = channel.Tabs.Count - 1; i >= 0; i--)
    {
        if (channel.Tabs[i].TeamsApp.Id == TeamsAppId.Wiki)
        {
            try
            {
                await retry.ExecuteAsync(async () =>
                {
                    logger?.LogInformation($"Removing wiki on channel {channel.DisplayName}. {newTeamId}");

                    await graphClient.Teams[newTeamId].Channels[channel.Id].Tabs[channel.Tabs[i].Id].Request().DeleteAsync();
                });

                channel.Tabs.RemoveAt(i);
            }
            catch (Exception ex)
            {
                logger?.LogError($"Error removing wiki tab on channel: {channel.DisplayName}. {ex.Message}");
            }
        }
    }
}

SharePoint: Story of an orphan assemblyBinding and a misleading SPSite error message

2020-03-31T12:43:00.001+03:00

Error

I have .NET console application doing all kinds of magic, but as a first step it creates instance of SPSite using the same piece of code I’ve used hundreds, if not thousands, of times over the last two decades:

using(var site = new SPSite(“http://xyz”))

But no, after few seconds it threw exception:

The Web application at http://xyz could not be found. Verify that you have typed the URL correctly. If the URL should be serving existing content, the system administrator may need to add a new request URL mapping to the intended application.

Thoughts

Having done all the suggested steps in here (including comments), and in all blog and forum posts related to this issue on the internet, I finally looked at ULS logs. Should’ve done it sooner. It had logged this error message when creating instance of SPSite:

Unexpected error while verifying backwards compatibility for [SPConfigurationDatabase] [e6f4eb31-959b-48da-a3a9-44d23f908f2e]: Microsoft.SharePoint.Upgrade.SPUpgradeException: Failed to call GetTypes on assembly Microsoft.Office.Server.Search, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c. Could not load file or assembly 'Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies. The system cannot find the file specified. Could not load file or assembly 'Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies. The system cannot find the file specified. Could not load file or assembly 'Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies. The system cannot find the file specified.

What on earth, I don’t use Newtonsoft.Json in my project…?!

But I did! Only for a short while, though.

During some stage of the development I had added Newtonsoft.Json from NuGet, then removed it. It left orphan assemblyBinding reference pointing to Newtonsoft.Json in the app.config of the console application.

So basically my app.config in Visual Studio eventually the consoleapp.exe.config looked like this:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
     <startup>
         <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6"/>
     </startup>
   <runtime>
     <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
       <dependentAssembly>
         <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/>
         <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0"/>
       </dependentAssembly>
     </assemblyBinding>
   </runtime>
</configuration>

This caused the slightly misleading Exception being thrown when doing the SPSite thing.

Solution

I removed the orphan <assemblyBinding></assemblyBinding> under <runtime> in my app.config, rebuilt the app, and sun started shining, and all was good:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
     <startup>
         <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6"/>
     </startup>
</configuration>

SharePoint: Web part SPUserCodeNoAvailableServersFoundException error

2020-02-04T11:15:00.001+02:00

Problem

Web part is not loading, you see exception SPUserCodeNoAvailableServersFoundException.

Solution

Start “Microsoft SharePoint Foundation Sandboxed Code Service”.

Go to Central Admin
Go to System Settings –> Manage services in this farm
At “Microsoft SharePoint Foundation Sandboxed Code Service” click “Enable Auto Provisioning”

SharePoint: Setting list view specific persisted spcolumnsize programmatically

2020-01-30T16:10:00.001+02:00

Problem

I needed to set default list view column widths programmatically on SharePoint Online modern list. I was using PnPjs to create and configure the list.

Thoughts

In modern SPO list view you can change column width, it is then temporarily stored in browser Local Storage as spcolumnsize-unsaved-VIEWGUID. However, you also have the option of saving it into View somehow, as asterisk (*) appears next to view name on SharePoint and you can "Save View As" to persist the column width somewhere. After saving the view even if you remove the spcolumnsize-unsaved-VIEWGUID Local Storage key, and refresh the page, it comes back as spcolumnsize-VIEWGUID, so clearly it is stored somewhere in SharePoint.

Solution

Column widths are persisted in ListViewXml view property inside ColumnWidth element as FieldRef elements. Do note that the FieldRef Names must be column display names, NOT internal field names. I didn’t implement fancy XML parsing, just injected the ColumnWidth element at the end just before ending View tag.

// set field widths
let lv: any = await list.defaultView.select('ListViewXml').get();

let lvXml: string = lv.ListViewXml.replace(
'</View>', '<ColumnWidth><FieldRef Name="Column title 1" width="370" /><FieldRef Name="Some other column" width="90" /></ColumnWidth></View>');

await list.defaultView.setViewXml(lvXml);

SPFx: Changing Folder Content Type using PnPjs

2019-12-12T12:15:00.001+02:00

Task

Needed to create Folders with custom Content Type in SharePoint document library from my SPFx web part, as there was a need to add some custom fields, such as Description, to the Folder item.

Solution

This one took a few hours to figure out, you need to do it in few steps as you cannot change the content type of a folder using sp.web.folders…update as REST API doesn’t allow ContentTypeId parameter when updating Folder content types, and you will get error:

“The property 'ContentTypeId' does not exist on type 'SP.Folder’. Make sure to only use property names that are defined by the type”

Also if you would use …folder.getItem(), it will fail if folder has special characters.

Create folder as normal Folder
Get list item ID of the folder
Update folder as a list item

let etfn = await sp.web.getList(listUrl).getListItemEntityTypeFullName();

// first create folder
let far: FolderAddResult = await sp.web.folders.add(listUrl + '/' + targetParentFolderName + targetFolderName);

// then get list item ID of the folder
let fData: any = await sp.web.getFolderById(far.data.UniqueId).select('ID').listItemAllFields.get();            

// then get folder as list item
let item: Item = sp.web.getList(listUrl).items.getById(fData['ID']);

await item.update({
    ContentTypeId: 'CUSTOM_FOLDER_CONTENTTYPE',
    PF_FolderDescription: 'Some description...'
}, '*', etfn);

Office Online Server: X-WOPI-ServerError "Verifying signature failed"

2019-09-17T11:53:00.001+03:00

Problem

After migrating from old OOS (WAC) server to new one, integration between SharePoint and Office Online Server stopped working, and no documents could be opened in browser.

Looking at the network traffic using WireShark, you see X-WOPI-ServerError "Verifying signature failed".

Solution

Ensure HTTPS (TCP 443) flows from SP servers to OOS
Run Update-SPWOPIProofKey -ServerName YOUR_OOS_URL

This will update the required keys in SharePoint and documents can again be opened in browser.