After a bit of digging I uncovered the Get-AdfsSslCertificate and Set-AdfsSslCertificate.    Sure enough when I executed Get-AdfsSslCertificate the thumbprint of the original expired certificate was returned.   This is because the change in the ADFS management console only updates the ADFS configuration database.    It does not change the binding in HTTP.SYS.    Since 2012R2 has no IIS dependency there is no user interface to manage the SSL certificate binding.   As a result we must use powershell to do it.

Relevant TechNet link: https://technet.microsoft.com/en-us/library/dn479374.aspx

I've been working on deploying Web Application Proxy with one of my customers recently in an effort to transition them off UAG.   We were successful in getting SharePoint working quickly but we ran into some problems with CRM.   Given how new WAP is I thought it would be appropriate to document what we had to do in order to get it working.

The customer has 3 externally facing URLs that we need to publish via WAP:

https://auth.crm.contoso.com/

https://org.crm.contoso.com/

https://discovery.crm.contoso.com/

Additionally WAP and ADFS are published at

https://fs.contoso.com/

The default configuration of WAP is to translate internal URLs to external URLs when you do pass-through authentication.   We had configured the org URL as ADFS pre-auth.  The discovery and auth URLs both used pass-through authentication.    The
external and internal names were the same and we used split DNS to handle internal versus external traffic.

The way CRM does authentication when using an internet facing deployment and ADFS is with the HTTP POST binding back to the auth URL.   The auth URL issues a DOMAIN cookie and redirects to the org URL.  In our case the domain cookie was scoped to *.crm.contoso.com.   The org web application gets the cookie and lets the user in. 

This breaks down with WAP because it attempts to remap the outbound cookie from the auth web application and reissue it under the external name (auth.crm.contoso.com).    When we redirect to the org URL it can't see the cookie because the browser doesn't pass it back.   The org URL then redirects back to ADFS, which redirects to auth, which reissues the cookie.   As you can see we're stuck in an infinite redirect loop.   Eventually ADFS gets tried of this and fails issuing the following error in the log:

Microsoft.IdentityServer.Web.InvalidRequestException: MSIS7042: The same client browser session has made '6' requests in the last '3'
seconds. Contact your administrator for details.

   at
Microsoft.IdentityServer.Web.Protocols.PassiveProtocolHandler.UpdateLoopDetectionCookie(WrappedHttpListenerContext
context)

   at
Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationProtocolHandler.SendSignInResponse(WSFederationContext
context, MSISSignInResponse response)

   at
Microsoft.IdentityServer.Web.PassiveProtocolListener.ProcessProtocolRequest(ProtocolContext
protocolContext, PassiveProtocolHandler protocolHandler)

   at
Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext
context)

The solution for this is to tell Web Application Proxy not to translate the outbound URLs in the response header.   This can be done via powershell and the Set-WebApplicationProxyApplication cmdlet.

https://technet.microsoft.com/en-us/library/dn283415.aspx

 
 Set-WebApplicationProxyApplication -ID <id of auth web app> -DisableTranslateUrlInResponseHeaders
 

Now WAP will ignore the outbound cookie and let it pass along to the client as CRM had intended.   Presto!

There are several ways to skin this cat in .NET.   You could use the System.DirectoryServices.AccountManagement (https://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement(v=vs.110).aspx)  namespace.  It was introduced in .NET 3.5 so you can use it with SharePoint 2010 full trust code.

I'm a big fan of doing things the old fashioned way so to speak using System.DirectoryServices (https://msdn.microsoft.com/en-us/library/system.directoryservices(v=vs.110).aspx).   That stuff has been around since .NET 1.1.   By using ADSI you can query via LDAP and manually manipulate the DirectoryEntry objects.   I find this solution just makes more sense to me.  It also is transportable and if for some reason you weren't using Active Directory and instead you were using some other LDAP provider your code would still work.

To that end I created a simple helper class that can be used to add, remove, and verify group membership for a user.   Here is a class you can use followed by an example of how to utilize it from a console app.

using System;
 using System.DirectoryServices;
 
 namespace ADHelper
 {
 public class ADHelper
 {
 
 private string username;
 private string password;
 public string domain;
 
 public ADHelper(string username, string password, string domain)
 {
 this.username = username;
 this.password = password;
 this.domain = domain;
 }
 
 //Looks up the DN for a user based on the sAMAccountName
 public string GetUserDN(string identity)
 {
 //Split out the identity to get just the username portion
 if (identity.Contains("\\"))
 {
 string[] identityList = identity.Split('\\'); 
 string userName = identityList[1];
 using (var rootEntry = new DirectoryEntry("LDAP://" + domain, this.username, this.password, AuthenticationTypes.Secure))
 {
 using (var directorySearcher = new DirectorySearcher(rootEntry, String.Format("(sAMAccountName={0})", userName)))
 {
 var searchResult = directorySearcher.FindOne();
 if (searchResult != null)
 {
 using (var userEntry = searchResult.GetDirectoryEntry())
 {
 return (string)userEntry.Properties["distinguishedName"].Value;
 }
 }
 }
 }
 }
 return null;
 }
 
 
 //Looks up the DN for the group based on the name
 public string GetGroupDN(string groupname)
 {
 using (var rootEntry = new DirectoryEntry("LDAP://" + domain, this.username, this.password, AuthenticationTypes.Secure))
 {
 using (var directorySearcher = new DirectorySearcher(rootEntry, String.Format("(&(objectCategory=group)(cn={0}))", groupname)))
 {
 var searchResult = directorySearcher.FindOne();
 if (searchResult != null)
 {
 using (var userEntry = searchResult.GetDirectoryEntry())
 {
 return (string)userEntry.Properties["distinguishedName"].Value;
 }
 }
 }
 }
 return null;
 }
 
 
 
 //Checks to see if a user is in a group and returns a bool
 public bool isUserInGroup(string userDn, string groupDn)
 {
 bool match = false;
 
 
 DirectoryEntry user = new DirectoryEntry("LDAP://" + userDn, this.username, this.password, AuthenticationTypes.Secure);
 foreach (string group in user.Properties["memberof"])
 if (group == groupDn)
 match = true;
 
 return match;
 }
 
 
 //Adds a given user to a group 
 public bool AddToGroup(string userDn, string groupDn)
 {
 bool success = false;
 try
 {
 DirectoryEntry dirEntry = new DirectoryEntry("LDAP://" + groupDn, this.username, this.password, AuthenticationTypes.Secure);
 dirEntry.Properties["member"].Add(userDn);
 dirEntry.CommitChanges();
 dirEntry.Close();
 success = true;
 }
 catch (System.DirectoryServices.DirectoryServicesCOMException ex)
 {
 success = false;
 }
 
 return success;
 }
 
 //Removes a user from a group
 public bool RemoveUserFromGroup(string userDn, string groupDn)
 {
 bool success = false;
 try
 {
 DirectoryEntry dirEntry = new DirectoryEntry("LDAP://" + groupDn);
 dirEntry.Properties["member"].Remove(userDn);
 dirEntry.CommitChanges();
 dirEntry.Close();
 success = true;
 }
 catch (System.DirectoryServices.DirectoryServicesCOMException ex)
 {
 
 success = false;
 }
 return success;
 }
 }
 }

 namespace ADHelper
 {
 class Program
 {
 static void Main(string[] args)
 {
 
 string username = "jason";
 string password = "supersecretpassword";
 string domain = "home.vallery.net";
 
 //Create new helper object with the username and password of service account
 ADHelper helper = new ADHelper(username, password, domain);
 
 //Lookup the DN of our user
 string userDN = helper.GetUserDN("home\\jason");
 
 //Lookup the DN of our group
 string groupDN = helper.GetGroupDN("AWESOME PEOPLE GROUP");
 
 
 //Determine if our user is in the group
 Console.WriteLine(string.Format("Is {0} a member of {1}: {2}", userDN, groupDN, helper.isUserInGroup(userDN, groupDN).ToString()));
 
 //Add our user to the group
 helper.AddToGroup(userDN, groupDN);
 
 //Determine if our user is in the group
 Console.WriteLine(string.Format("Is {0} a member of {1}: {2}", userDN, groupDN, helper.isUserInGroup(userDN, groupDN).ToString()));
 
 //Remove user from the group
 helper.RemoveUserFromGroup(userDN, groupDN);
 
 //Determine if our user is in the group
 Console.WriteLine(string.Format("Is {0} a member of {1}: {2}", userDN, groupDN, helper.isUserInGroup(userDN, groupDN).ToString()));
 
 Console.ReadLine();
 
 }
 }
 }

My customer recently faced this problem and asked me for a solution.   They wanted a simple integer ID that was incremented whenever a form was submitted to SharePoint.  Nothing fancy.   At first we investigated using the list service to query for the MAX(ID) and using that number.   We quickly ran into the concurrency situation though and had duplicate forms.   I decided to take matters into my own hand and find an infallible solution once and for all.

The approach we took was to use an ItemAdded event receiver on the forms library.   Under the hood a forms library is no different than any other SPList and the form is no different than any other SPListItem.   The SPListItem object already has a property called ID which is a unique auto sequential ID.   The challenge is renaming the file to match the ID and populating that in the form.  I used LINQ to XML to change the contents of the submitted form and store the newly assigned ID on save.   

Once you have the ID in the form you can use it to populate the form name for subsequent saves in case a user makes an update.

 If you need a basic overview on how to implement and bind an event receiver here is a good tutorial: https://msdn.microsoft.com/en-us/library/gg749858(v=office.14).aspx

For a refresher on how to configure your InfoPath form to submit to SharePoint and to pull in our FormID here is a good tutorial: https://office.microsoft.com/en-001/infopath-help/submit-form-data-to-a-sharepoint-library-HA010107057.aspx

Here is the complete code for the ItemAdded event receiver.

using System;
 using System.IO;
 using System.Text;
 using System.Linq;
 using System.Xml.Linq;
 using Microsoft.SharePoint;
 using Microsoft.SharePoint.Administration;
 
 namespace EventReceivers
 {
 public class AutoNumberFormID : SPItemEventReceiver
 {
 public override void ItemAdded(SPItemEventProperties properties)
 {
 base.ItemAdded(properties);
 try
 {
 //Turn off event firing so we don't end up with a conflict 
 base.EventFiringEnabled = false;
 
 //Populate our current user so we can keep track of it
 SPUser user = properties.Web.CurrentUser;
 
 //Run the code elevated so we can rename our item
 SPSecurity.RunWithElevatedPrivileges(delegate()
 {
 using (SPSite site = new SPSite(properties.Web.Site.ID))
 {
 using (SPWeb web = site.OpenWeb(properties.Web.ID))
 {
 //Grab a new copy of our list and listitem under the new security context
 SPList list = web.Lists[properties.List.ID];
 SPListItem item = list.Items.GetItemById(properties.ListItemId);
 
 //Change name and title to match item ID
 item.File.CheckOut();
 item["Title"] = item.ID;
 item["Name"] = item.ID;
 
 //System update instead of update so we don't add a new version or update the modified dates
 item.SystemUpdate(false);
 item.File.CheckIn("Changed name");
 
 //Get a fresh copy of the object to ensure we don't end up with a conflict
 item = list.Items.GetItemById(properties.ListItemId);
 
 //Read contents of XML and update the FormID field to match the ID of the document 
 SPFile file = item.File;
 
 //Load the XML byte array and then convert it to a string using default encoding 
 string xml = Encoding.Default.GetString(file.OpenBinary());
 
 //Parse the XML into a LINQ compatible XDocument
 XDocument doc = XDocument.Parse(xml);
 
 //We must specify the namespace that InfoPath uses for the "My" fields
 XNamespace myNamespace = "https://schemas.microsoft.com/office/infopath/2003/myXSD/2013-09-18T16:52:38";
 
 //Using LINQ to XML we query the document for all instances of a element named "FormID" 
 var fields = from field in doc.Root.Descendants(myNamespace + "FormID") select field;
 
 //Loop through the results and set the value of that element based on the ID of the current item
 foreach (XElement field in fields)
 field.Value = item.ID.ToString();
 
 //If we made any changes to the document we convert back to a byte array and save it into the file object
 if (fields.Count() > 0)
 file.SaveBinary(Encoding.Default.GetBytes(doc.ToString()));
 
 //Check out, push to DB, check in the file
 file.CheckOut();
 file.Update();
 file.CheckIn("Changed name and ID");
 
 }
 }
 });
 }
 catch (Exception ex)
 {
 //Log an errors to the ULS
 SPDiagnosticsService.Local.WriteTrace(0, new SPDiagnosticsCategory("FBMS Event Reciever", TraceSeverity.Unexpected, EventSeverity.Error), TraceSeverity.Unexpected, String.Format("[FBMS Item Level Permissions] Unexpected exception on item added. Error: {0}", ex.Message), null);
 }
 finally
 {
 //Turn event firing back on
 base.EventFiringEnabled = true;
 }
 }
 
 }
 }
 

By using the DirectorySearcher class we can build complex LDAP queries to find objects in Active Directory.   With this information you can do all kinds of fun scripting things.

Here is a sample script:

#Specify the search criteria
 $samname="jasonv"
 $domain="dev.lcl"
 
 #Get a list of domains in the forest and grab the DN of the one matching the above parameter.
 $forest= [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
 $domain= $forest.Domains | ? {$_.Name -eq$domain}
 $domainDN=$domain.GetDirectoryEntry().distinguishedName 
 Write-Output "Found the remote domain, the full LDAP distinguished name is $DomainDN"
 
 #Create an LDAP searcher object and pass in the DN of the domain we wish to query
 
 $Searcher=New-Object System.DirectoryServices.DirectorySearcher([ADSI]"LDAP://$domainDN")
 
 #Pass in the ceriteria we are searching for.
 #In this case we're looking for users with a particular SAM name.
 
 $Searcher.filter="(&(objectCategory=person)(objectClass=user)(sAMAccountName= $samname))"
 
 $results=$Searcher.Findall()
 
 #Loop through the results
 Foreach($result in $results){
 $User=$result.GetDirectoryEntry()
 $userDN=$user.DistinguishedName
 Write-Output "Found a user matching with the distingused name of $userDN"
 }
 

#Define our configuration. This is the name you gave the import connection to AD
$url="https://sharepoint.vallery.net/";
$connectionName="Profile Sync";

#Setup our SharePoint objects
$site=Get-SPSite$url;
$serviceContext= Get-SPServiceContext($site);
$upManager=new-objectMicrosoft.Office.Server.UserProfiles.UserProfileConfigManager($serviceContext);
$syncConnection=$upManager.ConnectionManager[$connectionName];

#This is a collection of mappings to AD that we will use later
$pmc=$syncConnection.PropertyMapping;

#This is a collection of all of the properties which we will iterate
$properties=$upManager.GetProperties();

# Create a new XML writer settings object
$settings=New-Objectsystem.Xml.XmlWriterSettings;
$settings.Indent=$true;
$settings.OmitXmlDeclaration=$false;
$settings.NewLineOnAttributes=$true;

# Create a new string writer to capture the output
$sw=new-objectSystem.IO.StringWriter;

# Create a new XmlWriter
$writer= [system.xml.XmlWriter]::Create($sw, $settings);

#Start the document and add the root node
$writer.WriteStartDocument();
$writer.WriteStartElement("properties");

#Iterate through the properties
foreach ($item in $properties)
{
    #Create the property element
 $writer.WriteStartElement("property");

    #Add in the fields as attributes
 $writer.WriteAttributeString("Name", $item.Name);
    $writer.WriteAttributeString("DisplayName",$item.DisplayName);
    $writer.WriteAttributeString("ManagedPropertyName",$item.ManagedPropertyName);
    $writer.WriteAttributeString("Type",$item.Type);
    $writer.WriteAttributeString("ChoiceList",$item.ChoiceList);
    $writer.WriteAttributeString("Description",$item.Description);
    $writer.WriteAttributeString("URI",$item.URI);
    $writer.WriteAttributeString("IsSystem",$item.IsSystem);
    $writer.WriteAttributeString("AllowPolicyOverride",$item.AllowPolicyOverride);
    $writer.WriteAttributeString("IsUserEditable",$item.IsUserEditable);
    $writer.WriteAttributeString("IsAdminEditable",$item.IsAdminEditable);
    $writer.WriteAttributeString("IsImported",$item.IsImported);
    $writer.WriteAttributeString("Length",$item.Length);
    $writer.WriteAttributeString("IsMultivalued",$item.IsMultivalued);
    $writer.WriteAttributeString("ChoiceType",$item.ChoiceType);
    $writer.WriteAttributeString("DefaultPrivacy",$item.DefaultPrivacy);
    $writer.WriteAttributeString("UserOverridePrivacy",$item.UserOverridePrivacy);
    $writer.WriteAttributeString("IsReplicable",$item.IsReplicable);
    $writer.WriteAttributeString("PrivacyPolicy",$item.PrivacyPolicy);
    $writer.WriteAttributeString("DisplayOrder",$item.DisplayOrder);
    $writer.WriteAttributeString("IsColleagueEventLog",$item.IsColleagueEventLog);
    $writer.WriteAttributeString("IsAlias",$item.IsAlias);
    $writer.WriteAttributeString("IsSearchable",$item.IsSearchable);
    $writer.WriteAttributeString("IsUpgrade",$item.IsUpgrade);
    $writer.WriteAttributeString("IsUpgradePrivate",$item.IsUpgradePrivate);
    $writer.WriteAttributeString("IsVisibleOnEditor",$item.IsVisibleOnEditor);
    $writer.WriteAttributeString("IsVisibleOnViewer",$item.IsVisibleOnViewer);
    $writer.WriteAttributeString("IsTaxonomic",$item.IsTaxonomic);
    $writer.WriteAttributeString("Separator",$item.Separator);
    $writer.WriteAttributeString("MaximumShown",$item.MaximumShown);
    $writer.WriteAttributeString("IsSection",$item.IsSection);
    $writer.WriteAttributeString("IsRequired",$item.IsRequired);
    $writer.WriteAttributeString("SubtypeName",$item.SubtypeName);

    #Look up any AD mappings in the PropertyManagerCollection and include them
 $writer.WriteAttributeString("IsImport",$pmc.Item($item.Name).IsImport);
    $writer.WriteAttributeString("IsExport",$pmc.Item($item.Name).IsExport);
    $writer.WriteAttributeString("DataSourcePropertyName",$pmc.Item($item.Name).DataSourcePropertyName);
    $writer.WriteAttributeString("OriginalDataSourcePropertyName",$pmc.Item($item.Name).OriginalDataSourcePropertyName);
    $writer.WriteAttributeString("AssociationName",$pmc.Item($item.Name).AssociationName);
    $writer.WriteAttributeString("Connection",$pmc.Item($item.Name).Connection.DisplayName);
    $writer.WriteEndElement();

}

#Finish up
$writer.WriteEndElement();
$writer.WriteEndDocument();
$writer.Flush();
$writer.Close();

#Capture the output into a string
$result=$sw.ToString();

# Write the XML out
Write-Output$result;

Of course in future releases these field names might change so you should verify before using this script.  In my case this was SharePoint 2010 October CU and NewsGator Social Sites 1.2.2419.

#Load the SharePoint snap-in
Add-PsSnapinMicrosoft.SharePoint.PowerShell;

#Load the SharePoint assemblies
[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.Office.Server");
[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.Office.Server.UserProfiles");

#Specify the MySite URL
$MySiteUrl="https://sharepoint.vallery.net/";

#Get the server context for the profile manager
$site=Get-SPSite$MySiteUrl;
$ServerContext=Get-SPServiceContext$site;
$UPManager=new-objectMicrosoft.Office.Server.UserProfiles.UserProfileManager($ServerContext);

#Count variables$ucount=0;
$enumProfiles=$UPManager.GetEnumerator();
"Total User Profiles available:"+$UPManager.Count
$count=0;

#Loop through the profile entries and update the property
#Recieve Instant Notifications - NGAllowMetaEmail (bool)
#24 Hour Digest Email - NGReceiveDigestEmail (bool)
#RSS NewsFeed Email - NGAllowRssEmail (bool)
#SharePoint Notification emails - SPS-EmailOptin (int)
#This field has 3 values one for each email type
foreach ($oUserin$enumProfiles)
{
    $count=$count+1;
    $u=$oUser.Item("Accountname");
    Write-Output"($count):  Setting values for $u";

    $oUser["NGAllowMetaEmail"].Value =$false;
    $oUser["NGReceiveDigestEmail"].Value =$false;
    $oUser["NGAllowRssEmail"].Value =$false;
    $oUser["SPS-EmailOptin"].Value =111;

    $oUser.Commit();
}

#Dispose of site object
$site.Dispose();

First a bit about the infrastructure and topology of my development environment.   I’ve got a dedicated VMWare ESXi 5.0 box in my basement with an i7-920, 24GB of ram, and 4x2TB hard drives in Raid 1+0.  I’m using an Adaptec hardware raid controller all inside of  a Super Micro tower.

With that box I’m able to run quite a number of virtual machines for a lot of different tasks beyond SharePoint development.   I’ve got a combination of Linux and Windows servers and clients setup for building and testing various applications.   A couple boxes are mainstays however and provide resources that are shared across the rest.   These are my domain controller and SQL box.   Both are running server 2008R2.   The SQL box has multiple SQL instances on it (2008R2 and 2012).   I have a couple of different SharePoint VMs and fire them up depending on what I’m working on.

When setting up the development box I always turn to AutoSPInstaller to actually install the SharePoint bits.   It automates the process and makes it repeatable.   It can handle installing the prequisites, configuring the farm, configuring service applications, creating web applications, creating site applications, etc.   It is really very powerful and saves a ton of time in setting up a new environment.   You can get it at https://autospinstaller.codeplex.com/.

For my primary 2010 development box I also have the following tools installed:

• Server 2008R2 made to be just a bit more workstation friendly with tools and guide over at https://www.win2008r2workstation.com/
• Visual Studio 2010 Ultimate
• Community Kit for SharePoint Tools - https://cksdev.codeplex.com/, https://cks.codeplex.com/
• ULS Viewer for viewing log files - https://archive.msdn.microsoft.com/ULSViewer
• ILSpy for reflecting the SharePoint assemblies - https://wiki.sharpdevelop.net/ILSpy.ashx --   You could also use RedGate’s reflector but it is no longer free.   It is a better product but I don’t feel like buying a license https://www.reflector.net/
• PowerGUI is really a must for tweaking configuration, deployment scripts, etc -  https://powergui.org/index.jspa
• Pex and Moles for unit tests - https://research.microsoft.com/en-us/projects/pex/
• Fiddler for looking at raw HTTP requests - I’ve been doing a lot of authentication work recently so this is important for me but maybe not for the average SP developer – https://www.fiddler2.com/fiddler2/
• SharePoint Manager allows you to explore site properties and settings which is handy - https://spm.codeplex.com/
• HttpWatch is good for performance tuning - https://www.httpwatch.com/
• Firefox with the Firebug add-on for looking at elements on the page and watching XmlHttpRequest when debugging AJAX code - https://www.mozilla.org/en-US/firefox/new/, https://getfirebug.com/

And while I hesitate to admit it given how much I hate the headache it can cause, I do also use SharePoint Designer from time to time.   While I’m a firm believer that you shouldn’t do SharePoint customizations with it (everything should be done via Visual Studio and packaged into a WSP) the truth is that SharePoint Designer is really good for working on masterpages.   If you’re doing branding work then I’d recommend it be included into your tool arsenal.

A quick powershell one-liner did the trick:

[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() | % { $_.DomainControllers } | %{Test-Connection $_.Name}

Similarly this one-liner connects to port 389 (LDAP) on the DC to ensure there is no firewall blocking. If the connection hits the timeout limit or failed it throws an exception.:

[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() | % { $_.DomainControllers } | %{$o=new-object Net.Sockets.TcpClient;$o.Connect( $_.IPAddress, 389); new-object PSObject -Property @{name=$_.Name;connected=$o.Connected}}

To troubleshoot I first opened up Fiddler to see what was happening under the hood.   When word (or any office app) requests the file from SharePoint it first sends the OPTIONS verb to the folder in which the file lives.  The request would come back from SharePoint as a 404 (even though the folder was there) with an interesting HTTP header.

X-MS-InvokeApp: 1; RequireReadOnly

When I did the same request on the environment that worked I would get a 200 with the expected list of valid operations:

Allow: GET, POST, OPTIONS, HEAD, MKCOL, PUT, PROPFIND, PROPPATCH, DELETE, MOVE, COPY, GETLIB, LOCK, UNLOCK

Digging further I discovered that in our production environment there was an additional entry in the web.config.   This limited the OPTIONS verb.

<system.webServer>

<security>

<requestFiltering allowDoubleEscaping="true">

<verbs allowUnlisted="true">

<add verb="OPTIONS" allowed="false" />

<add verb="PROPFIND" allowed="false" />

</verbs>

<requestLimits maxAllowedContentLength="2147483647" />

</requestFiltering>

</security>

After removing the verbs section everything started working as expected.