Wednesday, July 2, 2008

Office SharePoint Server 2007 - Forms Based Authentication (FBA) Walk-through - Part 1

A while back a client asked me to set up Forms Based Authentication (FBA) for them. I said sure (of course) and started to research the steps required to accomplish this. In my oodles and oodles of research I had found many useful but somewhat partial posts. What I mean by this is that not one of the posts I have encountered in my research had ALL of the steps required to get this to work, I was left to aggregate steps from different areas. Most posts assumed you were running as an administrator, maybe even that your SharePoint application pools were running as system accounts with unlimited privileges (on both the operating system and in the database), no "real world" scenarios if you will. Also, all of the posts never made mention of Office SharePoint Server, they all centered around Windows SharePoint Services (more on that later). My aim here is to provide a series of posts that include the following:

  1. Each and every step required to setup FBA using the built in Asp.Net Membership and Role providers (Part 1). I will demonstrate one way to accomplish this. There are others and they will be mentioned, but not looked at in any detail.
  2. How to enable MySites and the Personalization features included with Office Server and have them actually work with a site using (FBA).
  3. A natural extension of 1 and 2 that will demonstrate how to hook into the ADAM membership provider, and get it functioning with MySites and the Personalization features as well.

Initially, after setting FBA up successfully (Part 1), my client then asked me to enable MySites. That's when all hell broke loose. Not only did this not work right away, but after 3 unsuccessful calls to Microsoft support (they could not get it to work and kept parading me in circles, and still are for that matter, maybe they will read this and call me back), and quotes from Microsoft employees saying "it's not supposed to work" or "it does not work", I am pleased to say that it does in fact work and I will show you how (Part 2).

Before we begin I have to say that since I have been told that "it's not supposed to work" or "it does not work", and since I have not found any reliable documentation indicating how to do this, I must add a disclaimer that if it does not work for you, something is different between our environments, or to please call Microsoft . I will do my best to be as detailed as possible about my environment and all of the steps involved. If anything is unclear, please leave a comment and I will do my best to make it a little clearer. One last thing I would like to mention is that I have successfully implemented MySite functionality as well as the other Personalization features of Office SharePoint Server 2007 with Forms Authentication using both the built in Asp.Net Membership and Role providers as well as with an ADAM Membership provider. I have recently received an ADAM Role provider from Adam Buenz and plan on testing that soon but fully expect it to integrate seamlessly (with his help if needed, I hope).

So here we go, this is going to be a long one so bear with me. In the end of the series you will have MySite and the Personalization features working seamlessly with Forms Authentication in your Office SharePoint Server 2007 environment! Good Luck!

One assumption I have made in this process is that you have already created a Shared Services Provider and started the Office SharePoint Server Search service. Also, I am logged on to the development machine as a domain administrator. The term browser in this series means Internet Explorer 7. All of the below steps are to be performed on the Guest machine.

Environment

My environment is as follows. Keep in mind that any variation from this could produce different results. Again, if I forget to mention something obvious, please let me know and I will update the list.

Host Machine

  1. Intel(R) Pentium(R) M processor 1.86GHz 1.86GHz
  2. 2.00 GB of RAM
  3. Microsoft Windows XP Professional, Version 2002, Service Pack 2
  4. VMWare Workstation, Version 5.5.3 build-34685

Guest Machine

  1. Intel(R) Pentium(R) M processor 1.86GHz 1.86GHz
  2. 1.00 GB of RAM
  3. Microsoft Windows Server 2003, Standard Edition, Service Pack 1
  4. Active Directory (Domain Controller)
  5. Microsoft SQL Server 2005, Service Pack 1
  6. Microsoft Visual Studio 2005
  7. Microsoft Office Server 2007, Version 12.0.0.4518

FBA User & Role Store

Database Creation

We need a place to put our users. The Asp.Net 2.0 Membership and Role providers include a database. The steps to install the database are as follows:

  1. Open up a command prompt by clicking Start...Run, then typing cmd and pressing Enter.
  2. Switch to the Asp.Net 2.0 Framework directory by typing
    cd c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727
    and pressing Enter.
  3. Type aspnet_regsql to launch the ASP.NET SQL Server Setup Wizard.


  4. Click Next.
  5. Choose Configure SQL Server for application services (the default choice) on the Select a Setup Option screen and click Next.


  6. Specify the SQL Server name (your machine name), database name to create (I used AspNetDb_FBADemo), and the credentials to use for this process (database creation). I generally prefix my Membership and Role provider databases with AspNetDb_ such that they appear together in Microsoft SQL Server Management Studio and are easily identifiable should I need to access them, such as to update Security (Step 10). Click Next.


  7. Confirm your settings on the Confirm Your Settings screen and click Next.


  8. The process takes a few seconds and then The database has been created or modified screen appears. Click Finish to close the wizard.


  9. Open Microsoft SQL Server Management Studio and confirm that the database was successfully created.
  10. One step that I have not seen mentioned ANYWHERE is to make sure that the account that is running the application pool that will be used by the sites you create below have access to the database we just created. This step is critical as SharePoint will NOT be able to find your users and roles if it does not have the permissions to look for them. This step is what I like to refer to as the MAGIC step that no one tells you about, so I am ruining the surprise and telling you the secret. You will thank me later.

User and Role Creation

Microsoft has given us a great database schema to use as a membership and role provider data store but has not really supplied a "good" tool to manage its contents. When you think about it, this actually makes sense. The providers are intended to be used by other applications so maybe one of the assumptions made was that the tools to maintain the users and roles will be provided by the applications that consume them.

Thankfully, the Microsoft Visual Studio 2005 team had the foresight to create a somewhat rudimentary web application to help us manage the membership and role provider data store. The caveat is that the tool must be launched from Microsoft Visual Studio 2005. You can immediately see that this is not a very good option for those that will be managing the users and roles, i.e.: real users of your application.

I will now walk you thru a set of steps to create a few users and roles that we will be using later.

  1. Create a folder on your desktop called FBA Management Site.
  2. Open Microsoft Visual Studio 2005.
  3. Select File...Open...Web Site.
  4. In the Open Web Site dialog, choose the File System icon on the left side of the dialog, then browse to and select the FBA Management Site folder created in step 1.


  5. Click Open.
  6. In the Solution Explorer, right-click on the web site and select Add New Item.
  7. Select Web Configuration File and click Add. There is no need to rename the file, web.config is fine.
  8. Replace the empty element with the following snippet. Be sure to replace both
Posted by at No comments:

Using the Active Directory Membership Provider with Forms Authentication in MOSS 2007

Because MOSS 2007 supports the ASP.NET membership provider model there are new worlds in which SharePoint can tread that it has not be able to in the past. Specifically, MOSS 2007 represents a fantastic platform for the presentation of a public internet web presence. In fact, there is a site template that allows for the establishment of a public web site. In order to successfully present a public site, there are several considerations that had to be added to MOSS to enable this. Foremost is the degree of integration with ASP.NET 2.0 features. Specifically, for a internet web site that presents secure content, MOSS will support Forms authentication with ASP.NET 2.0 Membership and Role providers. Whenever there is an established Active Directory in the DMZ (as is becoming really populare for auditability, group and user membership and provisioning and management, etc.) MOSS can use Active Directory as its ASP.NET Membership provider store thorugh the ActiveDirectoryMembershipProvider found in ASP.NET 2.0.

Challenge: Allowing public internet users to connect to a public web site hosted in MOSS 2007 using Forms authentication and Active Directory as the information store

Solution: Configure MOSS 2007 to support forms authentication with the Active Directory Membership provider

Result: Users can now log into a public web site without NTLM prompts and using a custom login page and have their security credentials established using Active Directory

TODO: Determine if the full MOSS user profile is available. It seems that some of it is, but further testing and customization testing is required.

Implementation Details:

* Modify the web.config of the site collection
o For the specified site collection which should use Forms/Active Directory authentication (assuming you have already created a Web Application and an Site Collection), browse to and open the web.config (This file can be found by interrogating the IIS web site for the web application's virtual directory home directory)
o Insert the following sesctions into the web.config
+ After the configSections section insert the following (be sure to replace the ldap string with a valid one for your domain)


LDAP://win2003eebase.charrandev.com/CN=Users,DC=charrandev,DC=com
name="ADServices"/>

+ In the system.web section insert the following (note the version of the ActiveDirectoryMemberShipProvider class found in the GAC by looking at c:\Windows\Assembly)




o Do this for the default SharePoint Administration Site as well. This will allow you to add the first site collection administrator.
+ Note the attributeMapUserName attribute because it allows you to enter just the username and not the UPN (format of account@domain.com)
* Go To SharePoint Central Administration and change the Authentication Provider for the Web Application
o In SharePoint Central Administration, select Authentication Providers under Applation Management's Application Security section.
o Click the Defaul provider and modify the authentication Type to be Forms authenitcation (make sure you have the right web application selected)
o Enable anonymous access and specify the name of the provider we placed into the web.config file (in this case "ADProvider")
o For public sites, I usually disable client integration
o Go to to the site collection administrators on Aplication Management and select the first administrators for the site from the domain specified in the ldap connection string of the ADProvider

You should now be able to visit the site and get prompted for forms authentication based on a standard login form that MOSS/WSS maintains for forms authentication. Ostensibly, you can modify this page, or supplant another page using SharePoint Designer 2007.
Posted by at No comments:

SharePoint and Microsoft Learning Gateway Links/Resources

-on (Free)

Education SharePoint add-ons (Purchase)

SharePoint/Education Website

Microsoft Learning Gateway

Case Studies

Resources

Videos

The Future

Posted by at No comments:

Interfarm Shared Services

Overview

If Intra-farm shared services are web apps consuming from SSPs within the same farm, then Inter-farm are web app(s) consuming from SSPs outside the farm. (MSDN:Shared Services Overview) (TechNet:Plan Shared Services Providers). Because of the WAN limitation, (can't consume SSP across the WAN) many people discount a solution with more than 1 farm. Before you dismiss this whole post, consider this... It really isn't that strange to create 2 farms in the same region... Why you may ask... You may decide that you want to do collaboration with Out of the box functionality maybe some custom master pages and layouts, but pretty much no custom assemblies or custom site defs or web parts. On the other farm, you create your Intranet Portal with custom web apps for your business and it becomes much more application centric. Sean Livingston has put together a service offering white paper focused on hosting customizations that we should be sharing as soon as we can get it published.

Let's say you have a few web apps, quite a bit of content. (Don't waste your time with this if you have one web app.)

Why have the SSP in a separate farm? (Sam from MSW is a fan.)

1. If you have Multiple farms then it consolidates management for Search, Profiles, My sites, etc...

2. Can reduce number of servers and disk space for Query. If high availablity of the site is important, but search isn't, you could save a bunch on disk space by having your Index/Query/WFE SSP farm all on one box thus reducing the storage needed on query since it would be on the same box. You could even use the same SQL environment for the 2 farms.

3. Politics - The SSP is a very hot commodity, by putting it in it's own farm you can optimize the disks, SQL, the management from top to bottom could then be managed in a vacuum. This doesn't have to make sense from a technical point of view to see how multiple groups could divide their farms then consume a common "enterprise search" experience.

What to avoid...

You may think, why not run Search in a separate farm with the Search SKU (Microsoft Office SharePoint for Search Standard or Enterprise) and have it provide shared services. Won't work. Both parent and child farms need to be the same SKU (hence same features).

What you may not know...

Excel services although it shows up as a shared service, it's basically config for the safe locations. The Excel services are still with the consuming farm for rendering and calc purposes.

Forms services are always on the front ends for rendering. There's actually no real way off offloading the forms rendering to an app server if you wanted to, but you can offload document conversions i.e. the document HTML transformation service.

Contrary to some rumors there is no magic latency calculation to consuming shared services over the WAN.

Some Additional Information

Some data from the multi farm Visio deployment docs. I noticed this doesn't come up in search. Guess our favorite Internet search engines like Live don't have Visio Ifilters.

Model: Office SharePoint Server Inter-Farm Shared Services

Snippet from the Visio (good stuff):

Shared Services Providers can be configured to provide services to multiple Microsoft® Office SharePoint® Server 2007 farms. Utilizing Shared Services Providers across farms:

  • Reduces the number of services that provide the same role.
  • Dramatically reduces hardware, resource, and network bandwidth use.

Centralize administration of Shared Services Providers.

· Intra-farm shared services are offered by a parent farm to one or more child farms [Joel: One to one or one to many relationship]

· A parent farm is configured to provide shared services to other child farms.

· Child farms are configured to consume shared services from the parent farm.

· A farm cannot be both a parent farm and a child farm. (Joel: This is not saying the same as Intra-farm)

Only one Shared Services Provider can participate in inter-farm shared services:

· Parent farms can only share one Shared Services Provider to child farms. However, a parent farm can include more than one Shared Services Provider for its own use (see Parent Farm left).

· Child farms can only consume services from one Shared Services Provider. However, a child farm can include more than one Shared Services Provider for its own use. (see diagram)

Shared services consumption for child farms can be reconfigured at any time (not true in SPS2003):

· A child farm can disassociate from a parent farm and be configured to either consume shared services from a different parent farm or use its own Shared Services Provider.

· Child farms can consume shared services from a parent farm when connected to the central network and then switch to consume services from its own Shared Services Provider when it is disconnected. Child Farm 3 (see diagram) illustrates a farm with a standby Shared Services Provider that is used when the farm is disconnected.

· Parent farms can be re-configured as stand-alone farms at any time. Parent farm administrators should alert administrators of affected child farms before reconfiguring the Shared Services Provider as a stand-alone Shared Services Provider.

The following limitations apply to Inter-farm shared services:

· Parent and child farms must reside within the same Active Directory forest. If the farms reside in different domains, there must be a trust relationship configured between the domains.

· Inter-farm shared services is not supported across a WAN. A child farm cannot be associated with a Shared Services Provider at a parent farm if the two farms are separated by WAN links.

· Parent farms must have all Office server products installed that are used by child farms. For example, if a child farm includes Microsoft Office Project Server, then Office Project Server must be installed on the parent farm for shared services to work correctly. If a child farm uses the [Enterprise] CAL of Office SharePoint Server, then the parent farm must also use the [Enterprise] CAL (as opposed to the [Standard] CAL).
Posted by at No comments:

Simulate Parent / Child relationship in SharePoint 2007 with Folders & Content Types

One can create Parent / Child (A.K.A. Master / Detail) relationships in SharePoint 2007 by using lookups to reference a parent list from a child list. I will discuss another way of creating a Parent / Child relationship by adding a content type inside a folder.

We will create a parent / child relationship between company and employees. Here are our sample entities:

Company Parent (CompanyId, CompanyName)
Employee Child (Name, EmployeeId, Branch)

The strategy will be to make the "Company Parent" entity a folder which contains "Employee Child" items. To accomplish this we will create two new content types for each entity.

The "Company Parent" content type:

1) Site Actions ==> Site Settings ==> Site Content Types

2) Create

• Name: Company Parent
• Select parent content type from: Folder Content Types
• Parent Content Type: Folder
• Existing group: Custom Content Types
• Click OK

3) Click on "Add from new site column" on the "Site Content Type: …" page under column.

• Column name: CompanyId of type Number
• Click OK
Parent Company Content Type
NOTE: We will reuse the "Title" field to be the CompanyName.

The "Employee Child" content type:

1) Site Actions ==> Site Settings ==> Site Content Types
2) Create

• Name: Employee Child
• Select parent content type from: List Content Types
• Parent Content Type: Item
• Existing group: Custom Content Types
• Click OK

3) Click on "Add from new site column" on the "Site Content Type: …" page under column.

• Column name: EmployeeId of type Number
• Click OK

4) Click on "Add from new site column" on the "Site Content Type: …" page under column.

• Column name: Branch of type "Single line of text"
• Click OK
Employee Child Content Type
NOTE: We will reuse the "Title" field to be the EmployeeName.
Now we can go about our normal business of creating a custom list and using our two newly created content types "Company Parent" and "Employee Child".

1) Site Settings ==> Create
2) Click on "Custom List" under the "Custom Lists" column.

• Name: CompanyEmployees
• Click OK

3) Settings ==-> List Settings
4) Click on "Advanced Settings" under the "General Settings" column
5) At the very top, change Allow management of content types?" to Yes.
6) Click on OK
7) Under "Content Types" click on "Add from existing site content types".
8) On the "Add Content Types:" page

• Select site content types from: Custom Content Types
• Add "Company Parent" and "Employee Child" content types.
• Click on OK

Let’s add some dummy data.
1. Click on the "CompanyEmployees" list
2. Click on the little arrow beside New. You should see this:
New Parent
3. Select "Company Parent"
4. Add the following bogus company data:

• Name: ACME Corporation; CompanyId: 123
• Name: Bogus Enterprises: CompanyId: 456

5. Add bogus company employees to "ACME Corporation"

• Click on "ACME Corporation". This causes the folder to open.
• Add the following employees to the ACME Corporation by clicking on New ==-> Employee Child:
• Title: Jane Doe; EmployeeId: 111; Branch: Downtown
• Title: James White; EmployeeId: 222; Branch: Airport
• Click on "Bogus Enterprises". This causes the folder to open.
• Add the following employees to Bogus Enterprises by clicking on New ==-> Employee Child:
• Title: Judy Black; EmployeeId: 333; Branch: Main Street
• Title: Brandon Wiley; EmployeeId: 333; Branch: Riverside
• Add another employee to ACME:
This concludes configuration and data entry. Let us now use the SharePoint 2007 Object Model to get at this data.
using System;
using System.Collections.Generic;
using System.Text;
using Microsoft.SharePoint;
public class CompanyEmployees {
static void Main(string[] args) {
SPSite site = new SPSite("http://srvr/");
SPWeb web = site.AllWebs["/"];
SPList list = web.Lists["CompanyEmployees"];
foreach (SPListItem order in list.Folders) {
Console.WriteLine("Company ID : {0}", order["CompanyId"]);
Console.WriteLine("Company Name : {0}", order["Title"]);
SPQuery empItemsQuery = new SPQuery();
empItemsQuery.Folder = order.Folder;
SPListItemCollection empItems = list.GetItems(empItemsQuery);
foreach (SPListItem empItem in empItems) {
Console.WriteLine("\tEmployee ID {0}: {1} {2}",
empItem["EmployeeId"],
empItem["Title"],
empItem["Branch"]);
}
}
}
}

The above application will produce the following result:
Company ID : 123
Company Name : ACME Corporation
Employee ID 111: Jane Doe Downtown
Employee ID 222: James White Airport
Company ID : 456
Company Name : Bogus Enterprises
Employee ID 333: Judy Black Main Street
Employee ID 444: Brandon Wiley Riverside
Posted by at No comments:

Thursday, June 26, 2008

Microsoft Sharepoint and Widows Sharepoint Services

Microsoft Sharepoint and Windows Sharepoint Services
Posted by at No comments:
Labels:
Subscribe to: Posts (Atom)