Information Worker Main Feed

User Permissions in SharePoint

2009-07-03 11:47:00

I saw a post on one of the SharePoint Groups on LinkedIn about permissions and security to which I replied. I think this could be useful information for lots of people, so I am blogging it too.

Not knowing how big your organisation is, how you are planning to leverage SharePoint in it, or if it’s an intranet, extranet or internet solution; I won’t know if my information will be of assistance. Ours is an intranet only solution, and I am responsible for the team site web app with 15 000 people across almost 1800 sites on the platform so far. We have 4 web applications, and in the team sites web app, we have dozens of site hierarchies. Each site hierarchy has dozens of subsites across hundreds of business units.

We have Quest installed on our Enterprise platform and it is a nightmare!! I have not been able to get one single sensical report sent to me on user permissions to date. We have just installed a tactical solution called SP Limited Access Discovery. http://www.codeplex.com/SPLimitedAccessDisco. It is EXACTLY what we need on the front line. It is absolutely critical that you have a decent management tool at your disposal to extract reports on permissions. From an external auditor perspective, the first thing they require is to demonstrate security – who has access to what, how and when. Out of box reporting in SharePoint is not enough.

Permissions are an ongoing war and challenge on a daily basis. The primary support team cannot agree on the best way to handle it, but in my personal experience having been sole administrator on the platform for almost the entire life of it, I can tell you that what they say in theory is not necessarily how it works in real world situations. And just because you can do something, doesn’t mean you should.

Plan, plan, plan. I cannot stress this enough. Make sure that whatever you decide to do, is scalable and more importantly, flexible. Ideally you should use Active Directory groups to leverage on SharePoint. If however, your AD user profiles and groups are out of date (like ours are), it is not an option, and you will need to make use of the standard groups in SharePoint. We work with Members, Owners and Visitors and create more groups as required. If you are working with publishing sites too, it is going to have its own set of challenges with the Approvers groups and such.

You have 2 options when creating subsites, to inherit permissions or to create unique permissions. You need to think about this really carefully. Things change. Business units merge. People move. Site administrators take a long time to understand how permissions work.

In my experience, inheriting permissions across 20 or 30 subsites has failed 100% of the time, 100% of the time we have had to redo the permission structure on those site collections, disinheriting, creating new groups etc etc. And while the site owners were adamant that that is what they wanted, it took less than 3 months in every single case for the phone to ring and for us to step in and fix it. This can get very tricky depending on the size of the collection. There are a lot of things you need to remember to do. Site owners lock themselves out of their sites on a daily basis not remembering all the steps to follow.

It also depends on who is going to manage your platform. Are you having one administrator and that person has to add and remove people for the entire organisation? Or are you having individual site owners for each site and letting them manage their space? Ongoing management and administration of your platform will impact how you set up groups.

If you have a large organisation, don’t give business site administrators site hierarchy access. It is too much power. The maximum access they should have is Site Owner. Also, advise business units to have as few site owners as possible. Having 6 or 7 will create a free for all on the site and there will be no control. One or 2 at the most is ideal. Do not give users access to Central Admin and SSP under any circumstances. Those consoles are for the domain of the server administrators and platform owners only.

While it takes marginally more time to create unique permissions in the beginning, from a long term management perspective, it has proved to be the most effective way by far to manage the team sites. Obviously in some circumstances it will make sense to inherit, it really depends on the type of business you have.

If you just have one site collection with all your sites in it, and you are creating unique permissions, make sure you set naming standards for the groups. We did this on our POC environment, and it really helped. Just short abbreviations or initials are fine. If there are multiple business units, put the BU name is in the front, eg: for Marketing – Promotional Material site and subsite, create the groups as Mktg – PM Members, Mktg – PM Owners, Mktg – PM Visitors. This helps your primary support team to manage the environment and assist users that are locked out. You can have hundreds of groups overnight; you need to know where they all belong and naming standards will save a lot of time. This is not such a big a deal if you have different site collections for each business unit. But if that business unit plans on having lots of subsites, it might be a good idea for them.

You need to make sure site owners add users in actual groups, not on a site level – it is impossible to manage in the long run. You will see if they have done this in the Site Permissions view. Also try and avoid creating unique permissions on a library, list or item level. It gets very difficult to manage. Rather keep restricted content on a separate subsite where possible and restrict permissions on that level.

The default Members group has delete rights. We split that out and made a special Delete Rights Only group. This had proved to be a winner across the platform. As most of your staff could end up as Members on a site to update content, you don’t necessarily want them deleting things at will.

If you are new to SharePoint and are going to be in charge of sites or the platform, make sure you get the permissions and inheritance concepts firmly under the belt as soon as possible. If you are planning a large rollout, this is going to be crucial.

Then there is licensing implications. If you have just bought MOSS 2007 Core CALs and are not planning to purchase Enterprise CALs at all, then follow all this advice, likewise if you have bought all Enterprise CALs. If however, you have bought Core and are planning to incrementally buy Enterprise, then you need to rethink this in other ways as well. Remember if you can view it or edit it, you need a license for it, (KPI’s, dashboards, etc). You cannot allocate an Enterprise CAL to a document library with unique permissions. It doesn’t work like that. They are activated on a site level – so whoever has access to that site needs a license. This will impact how you grant permissions and set up your hierarchies again.

Hope this helps. If I think of anything else I’ll let you know.

Zambia's first K2 BlackPoint roll-out

2009-07-03 06:26:00

Reporting to you live from Code|Influence...

My colleague and I have been managing our organization's SharePoint infrastructure for some time now and we have just rolled out the first K2 BlackPoint in the country, intended mostly for SharePoint workflow developments.

OCS Federation with Windows Live, now free!

2009-07-02 11:14:35

Federation is an important goal for the Office Communications Server team and we are excited to announce several changes to public IM federation between Office Communications Server and public IM networks, effective July 1, 2009:

· The Live Communications Sever Public IM Connectivity (LCS PIC) license will be renamed Office Communications Server Public IM Connectivity (OCS PIC) license.

· Customers with Office Communications Server 2007 R2 Standard CAL or Office Communications Server 2007/Live Communications Server 2005 SP1 Standard CAL with Software Assurance will no longer require an additional license to federate with Windows Live. (A license will still be required for federation with AOL & Yahoo!.)

· With Windows Live federation, customers are able to add Windows Live contacts to their Office Communicator contact list, view presence and send and receive instant messages.

We will continue to work with our partners to enable more options that allow you to communicate seamlessly with customers, partners, friends and family on different networks. For more information on public IM connectivity with Office Communications Server, please go to http://www.microsoft.com/communicationsserver/en/us/public-im-connectivity.aspx

--D

Beware Application Pool Changes and the IIS Metabase.XML

2009-07-01 12:51:14

Woohoo! So here was a weird one (I love these).

I recently came across an issue where all the images for SharePoint 2007 were not being displayed (little ‘x’ instead of image).

After much investigation it turned out that the problem was with the IIS Metabase file, what had happened was that the web application pool for the web application had been changed (not just the account) and although the metabase.xml file was updated with the new web application pool not ALL of the settings in the metabase.xml file were updated; specifically the account that was specified to have access to the _layouts folder and the _layouts/images folders.

So, a quick edit of the metabase file to update the old web application pool with the new web application pool resolved the issue.

If this helps you then my work is done :)

Regards,

Doug “bobTheBuilder” McCusker

New Social Computing for the Enterprise SharePoint Site Launched

2009-06-23 15:19:39

Check out http://sharepoint.microsoft.com/social. It’s about organisations using social computing technologies inside the firewall for business benefit. Watch this space (site) as it delivers more information over time which I am sure will be of value to you.

Oh, and yes, it’s built in SharePoint and Silverlight.

Programmatically Edit Content Editor Web Part

2009-06-23 12:21:00

Say you are migrating sites, o nthe landing page you have a CEWP. Inside the content are links, it was not possible to make them relative.

The code finds the default page, open it, get the web part. loads the web part content, changes it and saves changes.

  private static void UpdateCEWPForlandingPageIPLinks(SPWeb updateWebPartWed)
  {
   SPFile file = updateWebPartWed.GetFile("default.aspx");

SPLimitedWebPartManager webPartManager = file.GetLimitedWebPartManager(PersonalizationScope.Shared);
SPLimitedWebPartCollection webParts = webPartManager.WebParts;

   foreach (Microsoft.SharePoint.WebPartPages.WebPart webPart in webParts)
   {
    if (((object)webPart).GetType().ToString() == "Microsoft.SharePoint.WebPartPages.ContentEditorWebPart")
    {
     if (webPart.Title == "New BCM Form")
     {
      string newIPURL = "";
      ContentEditorWebPart contentEditorWebPartWorking = new ContentEditorWebPart();

// Create an XmlElement to hold the value of the Content property.

XmlDocument xmlDocument = new XmlDocument();
XmlElement xmlElement = xmlDocument.CreateElement("Content");

xmlElement.InnerText = ((ContentEditorWebPart)webPart).Content.InnerText.ToString();

      //BIRA
      newIPURL = GetNewBCMLinksList(updateWebPartWed.Site.Url, updateWebPartWed.ServerRelativeUrl, "BIRA");
      xmlElement.InnerText = xmlElement.InnerText.ToString().Replace("BIRAurl", newIPURL);

      //BCS
      newIPURL = GetNewBCMLinksList(updateWebPartWed.Site.Url, updateWebPartWed.ServerRelativeUrl, "BCS");
      xmlElement.InnerText = xmlElement.InnerText.ToString().Replace("BCSurl", newIPURL);

      //BCP
      newIPURL = GetNewBCMLinksList(updateWebPartWed.Site.Url, updateWebPartWed.ServerRelativeUrl, "BCP");
      xmlElement.InnerText = xmlElement.InnerText.ToString().Replace("BCPurl", newIPURL);

      //BCIT
      newIPURL = GetNewBCMLinksList(updateWebPartWed.Site.Url, updateWebPartWed.ServerRelativeUrl, "BCIT");
      xmlElement.InnerText = xmlElement.InnerText.ToString().Replace("BCITurl", newIPURL);

      //BCT
      newIPURL = GetNewBCMLinksList(updateWebPartWed.Site.Url, updateWebPartWed.ServerRelativeUrl, "BCT");
      xmlElement.InnerText = xmlElement.InnerText.ToString().Replace("BCTurl", newIPURL);

contentEditorWebPartWorking.Content = xmlElement;

((ContentEditorWebPart)webPart).Content = contentEditorWebPartWorking.Content;

updateWebPartWed.AllowUnsafeUpdates = true;

      webPartManager.SaveChanges(webPart);
      file.Update();
      updateWebPartWed.Update();

      updateWebPartWed.AllowUnsafeUpdates = false;
     }
    }
   }
  }

Browser Enabled Infopath Forms Error

2009-06-23 12:12:00

Users will intermittantly get this error:

"There has been an error while loading the form. A required resource could not be downloaded. To try to resume the download, refresh the page"

Check the hosts files all the servers in the farm.

C:\Windows\System32\drivers\etc\hosts

InfoPath: Reading Repeating Tables from SharePoint List

2009-06-23 12:06:00

Lets say you have an Infopath form that submits to a list.

Seems easy enough, lets say that IP form has many repeating tables (IP is not up to massive forms).

Then you will have a problem. Seems like the data gets saved in some arcane schema, even using the lists property bags for stuff (crazy!)

After some serious poking around (I could not decrypt the schema), I discovered that the data is a serialized IP form.

This took several days to discover and peice together people

   using (SPSite site = new SPSite("http://moss:777"))
   {
    using (SPWeb web = site.OpenWeb("BCM"))
    {
     SPList list = web.Lists["BCS Forms"];

SPFolder folder = web.GetFolder("BCS Forms");
SPFile file = folder.Files[17];

Byte[] byteBuffer = file.OpenBinary();
MemoryStream xmlStream = new MemoryStream(byteBuffer);

XmlDocument xsd = new XmlDocument();

XmlSerializer serializer = new XmlSerializer(typeof(XmlDocument));

     xsd = (XmlDocument)serializer.Deserialize(xmlStream);
    }
   }

InfoPath: Binding a Web Service to a Repeating Table

2009-06-23 11:59:00

Clients love Rich Text Fields.

But how do you get a custom .net web service node to bind to a RTF in a repeating group?

found some hints:

http://www.officekb.com/Uwe/Forum.aspx/infopath/9216/Issue-adding-a-richtext-box-bound-to-a-field-in-the-database-table

http://support.microsoft.com/kb/826996

then I found through trial and error

that if I added an XHTML node it would work. Talk about hacking.

for example:

XmlElement theFontNode = (XmlElement)tempDocument.CreateNode(XmlNodeType.Element, "font", "http://www.w3.org/1999/xhtml");

When not to use Infopath

2009-06-23 11:45:00

Pre-sales loves the idea that they can sell IP (InfoPath). Telling clients that the end users will be able to maintain the applications.

In many cases this is correct.

However:

1) If its so easy then why are the end users doing the forms?

1) Motivation. Devs don't want to do IP, its not cool

2) There is some learning involved

What happens to code?

Famous software engineer Brooks wrote a paper called "No Silver Bullet"
http://en.wikipedia.org/wiki/No_Silver_Bullet

The paper says, inter alia, it will be used in ways that are not intended.

Well written software gets used for more than intended. If the devs start doing Infopath Forms, the forms will inevitably get used for unscalable applications

If we as devs must write systems that use software designed for end users it creates some problems:

1) Parts of it will be in complicated .net code (end users can forget fixing code behind)

2) Unmaintainable, 50 IP forms all calling one another, IP rules, work arounds etc?

3) IP does not scale in the way devs expect

My rule:

1) Make the end users do it

2) If it would take longer that 2 hours, then code it with the enterprise scale stuff, like asp.net

3) If there are going to be lots of IP forms

4) ANY code behind

Error Deploying Web Service

2009-06-23 11:36:00

Whilst deploying a .net web service that was to be called by InfoPath browser enabled forms I got a wierd error vis:

"The Web Application at could not be found. Verify that you have typed the URL correctly. If the URL should be serving existing content, the system administrator may need to add a new request URL mapping to the intended application."

After googling a bit I changed the changede the WS to be on same app pool as Portal.

Viola problem solved

The MOSS Show – Episode 4

2009-06-21 20:09:52

After a loooong delay, I finally managed to finish editing episode 4 of The MOSS Show. In this episode, I interview our very own Zlatan Dzinic on Records Management in MOSS. It was an interesting editing job – we had some “technical” difficulties, so I had to basically rebuild Zlatan’s side of the conversation word by word, in a hour-long recording!!

SharePoint.Microsoft.com - How MS Did It

2009-06-20 09:26:56

Microsoft recently launched their new SharePoint marketing site on none other than SharePoint itself. Its jam packed with Silverlight and cool menus inlcuding something called a Hero Bar :-) along with Custom Page Layouts and Style Sheets with Targeted Audience content based on your skill level. Very cool indeed.

You can check the site out at

http://sharepoint.microsoft.com/Pages/Default.aspx

and see how they did it at

http://blogs.msdn.com/sharepoint/archive/2009/06/18/how-we-did-it-sharepoint-microsoft-com.aspx

MarcL

SharePoint Podcast - Record Management with Zlatan Dzinic

2009-06-19 17:44:00

I’m being interviewed here by none other but our very own C#.NET MVP Hilton Giesenow (http://hilton.giesenow.com) on Records Management solutions in SharePoint.

The podcast is almost an hours long and was recorded over a coffee on a Saturday afternoon (I think it was a Saturday, not sure). I was not prepared for this interview, to say the least, so please excuse the repetition + other small imperfections.

Enjoy the talk and please send me your comments and feedback.

Here’s the link: http://www.themossshow.com/?p=105

Our Information Worker Community is now member of Culminis

2009-06-19 17:28:00

For those of you that are wandering what Culimnis is, here is a short description from their website (http://www.culminis.com):

Culminis is an international not-for-profit organization devoted to the development and growth of the IT community. After supporting and connecting professional user groups and associations, student organizations, and solution providers for more than two years we have come to understand the goals and needs of each group, as well as the resources they have to share. With this knowledge we are developing programs that ensure a meaningful and equitable exchange of those resources, ultimately elevating the status of the IT Pro both in their industry and in the community.

IT Professionals and IT Students
Culminis is not a super user group and we have no membership for individual IT Professionals, we will accomplish our mission by working in cooperation with the IT Professional community. We strongly encourage you to get involved.

You can see us now proudly showing off our associations on http://www.infromationworker.co.za front page, both ISPA and Culminis.