Joe Talks Microsoft

(SharePoint) Retrieving User Profile Properties

JoeMVP — Mon, 23 Jul 2018 09:59:28 GMT

This isn't going to tell you or give you code examples. This post is to give you the one piece of information that seems to be lacking in most posts on the subject. The following functions all have this issue.

The getMyProperties method and the getPropertiesFor method return a PersonProperties object.
The getUserProfilePropertiesFor method and the getUserProfilePropertyFor method return the values of the user profile properties that you specify.

Review: https://docs.microsoft.com/en-us/sharepoint/dev/general-development/how-to-retrieve-user-profile-properties-by-using-the-javascript-object-model-in There is an unknown requirement not detailed here or elsewhere. You must have the "My Site Host" setup and you must have the URL to the "My Site Host" setup in UPS (User Profile Service). Else these functions will not work. Hope this helps someone not waste time.

Exchange Web Service learnings

JoeMVP — Thu, 12 Jul 2018 09:35:20 GMT

Just the other day I worked on a requirement to get emails from exchange. This sounds simple right? Back in the day I would use IMAP to do this, but starting in 2016 that is disabled by default, review; https://docs.microsoft.com/en-us/Exchange/plan-and-deploy/deployment-ref/network-ports. Where I work there is a development environment, fun side story is I was told it was running Exchange 2016, turns out not to be true. Exchange comes with a web service, you can add a reference to that web service to your project, but it can be difficult to work with. An API was built, mostly this API abstracts the different versions of Exchange web services, as there are small differences. This allow your program to not have to be changed (service reference) for each version of exchange. You can download the source code here: https://github.com/OfficeDev/ews-managed-api NOTE: the nugget package is 3 years old!! So it doesn't contain any of the recent fixes or add-ins, including enum support of Exchange 2016, best to download the code and reference the compiled assembly. Lets review getting the object: string username, password, emailaddress, domainname emailaddress = "myname@mydomain.com" username = "myUserName" domainname = "MyDomain" password = "1234567" NOTE: you do not need to have the user information above, the code will use the signed account that the code runs under. ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2013); //Depending on how AD is setup one of the two options will work. //service.Credentials = new WebCredentials(emailaddress,password); For my tests, this version worked: service.Credentials = new WebCredentials(emailaddress,password,domainname); //Now it's time to auto discover the URL, note if you have the URL you can cut some mill-seconds from the processing. //Auto discover the URL via email service.AutodiscoverUrl(emailaddress); //this attempts to find the web service by using the email address to search the domain of the user. //OR service.Url = new Uri("https://urltoexchange/ews/exchange.asmx"); If no errors or exceptions you can now go onto the next phase, getting the items, note, there are three ways shown: //1: Use a filter to search for items that contain a string

var items = service.FindItems(
	//Find Mails from Inbox of the given Mailbox
	new FolderId(WellKnownFolderName.Inbox, new Mailbox(emailaddress)),
	//Filter criterion
	new SearchFilter.SearchFilterCollection(LogicalOperator.And, new SearchFilter[] {
	new SearchFilter.ContainsSubstring(ItemSchema.Subject, "string to search for"),
	new SearchFilter.IsEqualTo(EmailMessageSchema.IsRead, false)
	}),
	//View Size as 15
	new ItemView(15));

NOTE: the above will show only 15 items, as well as only show unread emails. //2: Just show items that have been unread.

var items = service.FindItems(
	//Find Mails from Inbox of the given Mailbox
	new FolderId(WellKnownFolderName.Inbox, new Mailbox(emailaddress)),
	//Filter criterion
	new SearchFilter.SearchFilterCollection(LogicalOperator.And, new SearchFilter[] {

	new SearchFilter.IsEqualTo(EmailMessageSchema.IsRead, false)
	}),
	//View Size as 15
	new ItemView(15));

Note: just like the previous this only shows unread emails and only 15. //3: Show all emails (up to view size) var items = service.FindItems(new FolderId(WellKnownFolderName.Inbox, new Mailbox(emailaddress)),new ItemView(15)); This simply gets all the emails up to 15 limit. Now to process the emails, the above simply got ID's.

foreach (EmailMessage msg in items)
	{
	//Retrieve Additional data for Email
	EmailMessage message = EmailMessage.Bind(service,
	(EmailMessage.Bind(service, msg.Id)).Id,
	new PropertySet(BasePropertySet.FirstClassProperties,
	new ExtendedPropertyDefinition(0x1013, MapiPropertyType.Binary)));
	Console.Write(message.Subject); }

This gets the message for each of the Id's retrieved. The message object includes many properties such as body and to/from as well as subject. The above helps for you to understand the basics, there are many more examples of using this API via: https://code.msdn.microsoft.com/exchange/Exchange-2013-101-Code-3c38582c

PowerShell Settings file (import/export)

JoeMVP — Wed, 27 Jun 2018 13:25:59 GMT

There are hash tables in PowerShell. The following is a string representation of a hash table, this can be set in a text file to be loaded. @{ Setting1="test1" Setting2="test2" } When loading the file the following is used: $settings = Get-Content -path "c:\mypath.settings.txt" -Raw | ConvertFrom-Json This will load the object with all the properties of the hash table, then you can use it as follows: $settings.Setting1 Once you set/update the properties you can then save the $settings hash table back to a file. $settings | ConvertTo-Json | Set-Content "c:\mypath.settings.txt" -Encoding Unicode NOTE: the encoding is very important, else you will never be able to manually edit the settings file. If you need to add more properties after the fact (the file that is loaded doesn't have all the properties needed) you can add them either manually before adding, or via PowerShell. Review the following two examples: $settings| Add-Member -Name 'New Property' -Type NoteProperty -Value 23 $settings| Add-Member -Name 'something' -Type NoteProperty -Value $false To remove a property, it's even simpler, review the following example: $settings.Remove("Name of property") Setting a property is as simple as: $settings.Setting1 = "Love Live and prosper" The purpose of all of this is simply so that settings can be placed in a single location, a single file and multiple scripts can use it to do the task the script is designed to do. There are many instances where you have the same settings (URL's, accounts, etc) that are used throughout various components, and it is not feasible to just put everything in one large script.

SQL Dialog Box for PowerShell

JoeMVP — Thu, 24 May 2018 09:53:38 GMT

I had a need the other day to build a PowerShell script to automate some tasks for installing a solution I built. I've always believed that its best to limit how much untested data entry a user has to do. Hence I wanted a dialog box for SQL connections and be able to test the connection. The following is what I came up with:

function Show-ConnectionDialog()

{

$arry = "SQL Server database login", "SQL Server", "Username", "Password*", "Database"

#create input form

$inputForm = New-Object System.Windows.Forms.Form

$inputForm.Text = $arry[0]

$inputForm.Size = New-Object System.Drawing.Size(330, 100)

$inputForm.StartPosition = "CenterScreen"

[System.Windows.Forms.Application]::EnableVisualStyles()

#handle button click events

$inputForm.KeyPreview = $true

$inputForm.Add_KeyDown(

{

if ($_.KeyCode -eq "Enter")

{

$inputForm.Close()

}

})

$inputForm.Add_KeyDown(

{

if ($_.KeyCode -eq "Escape")

{

$inputForm.Close()

}

})

#create OK button

$okButton = New-Object System.Windows.Forms.Button

$okButton.Size = New-Object System.Drawing.Size(75, 23)

$okButton.Text = "OK"

$okButton.Add_Click(

{

$inputForm.DialogResult = [System.Windows.Forms.DialogResult]::OK

})

$inputForm.Controls.Add($okButton)

$inputForm.AcceptButton = $okButton

#create Cancel button

$cancelButton = New-Object System.Windows.Forms.Button

$cancelButton.Size = New-Object System.Drawing.Size(75,23)

$cancelButton.Text = "Cancel"

$inputForm.Controls.Add($cancelButton)

$inputForm.CancelButton = $cancelButton

#create Test button

$TestButton = New-Object System.Windows.Forms.Button

$TestButton.Size = New-Object System.Drawing.Size(75, 23)

$TestButton.Text = "Test"

$TestButton.Add_Click(

{ $server = $txtBoxes[0].Text

$user = $txtBoxes[1].Text

$password = $txtBoxes[2].Text

$database = $txtBoxes[3].Text

$SqlConnection = New-Object System.Data.SqlClient.SqlConnection If ($user -ne "") { $SqlConnection.ConnectionString = "Server = $server; Database = $database; Integrated Security = false; User ID = $user; Password = $password;" }else{ $SqlConnection.ConnectionString = "Server = $server; Database = $database; Integrated Security = true;" }

#write-host $SqlConnection.ConnectionString

try{ $SqlConnection.Open() [System.Windows.MessageBox]::Show('Connection Successful')

}catch{ [System.Windows.MessageBox]::Show('Connection Failed') } })

$inputForm.Controls.Add($TestButton)

[System.Collections.Generic.List[System.Windows.Forms.TextBox]] $txtBoxes = New-Object System.Collections.Generic.List[System.Windows.Forms.TextBox]

$y = -15;

for($i=1;$i -lt $arry.Count;$i++)

{

$y+=30

$inputForm.Height += 30

#create label

$objLabel = New-Object System.Windows.Forms.Label

$objLabel.Location = New-Object System.Drawing.Size(10, $y)

$objLabel.Size = New-Object System.Drawing.Size(280, 20)

$objLabel.Text = $arry[$i] +":"

$inputForm.Controls.Add($objLabel)

$y+=20

$inputForm.Height+=20

#create TextBox

$objTextBox = New-Object System.Windows.Forms.TextBox

$objTextBox.Location = New-Object System.Drawing.Size(10, $y)

$objTextBox.Size = New-Object System.Drawing.Size(290, 20)

$inputForm.Controls.Add($objTextBox)

$txtBoxes.Add($objTextBox)

$cancelButton.Location = New-Object System.Drawing.Size(110, (35+$y))

$okButton.Location = New-Object System.Drawing.Size(35, (35+$y))

$TestButton.Location = New-Object System.Drawing.Size(185, (35+$y))

if ($arry[$i].Contains("*"))

{

$objLabel.Text = ($objLabel.Text -replace '\*','')

$objTextBox.UseSystemPasswordChar = $true

}

$inputForm.Topmost = $true

$inputForm.MinimizeBox = $false

$inputForm.MaximizeBox = $false

$inputForm.AutoSizeMode = [System.Windows.Forms.AutoSizeMode]::GrowAndShrink

$inputForm.SizeGripStyle = [System.Windows.Forms.SizeGripStyle]::Hide

$inputForm.Add_Shown({$inputForm.Activate(); $txtBoxes[0].Focus()})

if ($inputForm.ShowDialog() -ne [System.Windows.Forms.DialogResult]::OK)

{

exit

}

return ($txtBoxes | Select-Object {$_.Text} -ExpandProperty Text)

}

Add-Type -AssemblyName "system.windows.forms"

#variables for our SQL Server login form

$login = Show-ConnectionDialog

$server = $login[0]

$user = $login[1]

$password = $login[2]

$database = $login[3]

$ConnectionString = "Server = $server; Database = $database; Integrated Security = False; User ID = $user; Password = $password;"

$ConnectionString = "Server = $server; Database = $database; Integrated Security = True;"

$SqlConnection = New-Object System.Data.SqlClient.SqlConnection

$SqlConnection.ConnectionString = $ConnectionString

$SqlConnection.Open()

Write-Output $ConnectionString

AuthenticationManager.GetExternalLoginInfoAsync() returns NULL

JoeMVP — Thu, 19 Apr 2018 11:30:39 GMT

There is a problem when trying to use "GetExternalLoginInfoAsync()". This is a problem when using wsFederation so if you setup federation following these instructions. Then when trying the following: [AllowAnonymous] public async Task<ActionResult> ExternalLoginCallback(string returnUrl) { var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync(); } The only way you will get the loginInfo is using the following: var loginInfo = await AuthenticationManager.AuthenticateAsync(AuthenticationTypes.Federation) There are other examples using externalCookie out in the wilds. If you debug and look at the AuthenticationManager you will find what authentication type is being used. I have found that if using "wsFederation" then "AuthenticationTypes.Federation" is the key to use to not get NULL above.

CRM with CUSTOM STS and ADFS

JoeMVP — Mon, 26 Mar 2018 15:29:21 GMT

SO the other day I needed to make the STS (security token service) solution I built work with CRM (customer relations management). CRM is interesting in that unlike SPS (SharePoint) it does not include an STS its self. The current documentation indicates that CRM relies on ADFS to be the IdP (identity provider). There are plenty of articles and blog entries for how to setup Claims with CRM. This is just to talk about some of the gotchas. One, if you want to setup CRM to access a custom STS then that STS must provide claims that are required.

UPN (used email address or if possible a constructed UPN)
Name (display name, whatever you want to be visible as the user in CRM)
Primary SID (I've used the Serial of the PKI token, but anything works)

The following is most important. When you setup Claims Based Authentication, CRM will want actual users that are in the local AD (local or trusted domain). That's right, the first part of the setup ONLY works with AD. So if you are using a custom STS, then pull the above claims from AD directly. For Internet Facing Claims Based Authentication, the users are not required to be local. Keep in mind the way CRM is constructed, you can only setup one IdP. This is why when using ADFS you can setup multiple points, with SharePoint you can add trusted providers and have as many as you want. It still all went though the SPS STS and hence SharePoint can OOB provide a login screen (drop down) for users to pick which provider to use. So that means the Custom STS needs to be able to tell the difference between a local request, or a internet request. Yes you could do that by reply, as to where the URL that is making the request. Although that means you would have to have each CRM URL in a list. The other way is to look for the REALM parameter, which looks like "urn:federation:authentication:windows". Looking for this will indicate the request is for a local AD set of claims. Keeping the above in mind, will allow CRM to use your custom STS. Next problem is if you use ADFS with a custom STS. This is needed (unless you add end points, which is only needed if you plan to do plugin development using the SDK). The primary thing you need to have in order for the STS work with ADFS for CRM is as follows: The CRM Relaying party in ADFS will error out with the following: System.IdentityModel.Tokens.SecurityTokenException: The incoming identity did not contain any authentication method claims. It goes on to complain about the authentication type was not included "Password". This seems to be only an issue for Relaying Parties setup for CRM, not a requirement when setup with regular Claims enabled applications. To solve this problem, the following claims must be added to the token in the STS. outputIdentity.AddClaim(new Claim(ClaimTypes.AuthenticationInstant, System.DateTime.Now.ToString("yyyy-MM-ddTHH:mm:ss.fffZ"))); outputIdentity.AddClaim(new Claim(ClaimTypes.AuthenticationMethod, "https://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password")); You can view all the possible authentication methods here: https://msdn.microsoft.com/en-us/library/system.identitymodel.tokens.authenticationmethods(v=vs.110).aspx Seems Password is the only one that works, though maybe more investigation is needed. This will get you past the issue and allow for the custom STS to authenticate and ADFS to pass back to CRM. Next issue is how do you not show the login page in ADFS asking which IdP to use??? Run the following in PowerShell on the ADFS server: Set-ADFSRelyingPartyTrust -targetName "display name of relaying party" -claimsprovidername "display name of claims provider trust" The above will reduce the list and cause (if you only set one) to go directly to the IdP and hence no login screen. Next time we can talk about making a custom end point that the CRM SDK actually likes. This has been a real PITA so far.

PKI Authentication as a Azure Web App

JoeMVP — Tue, 06 Feb 2018 16:30:57 GMT

Hi everyone,

So recently I had to port a solution for authenticating users which use a PKI token. The solution was onsite and relied heavily on IIS for chain trusts, CRL checks, and more. In Azure when porting the STS (Security Token Service) there are several elements missing. Review: https://azure.microsoft.com/en-us/blog/enabling-client-certificate-authentication-for-an-azure-web-app/ This allows any Azure web app service to be client certificate enabled. What you don't get:

No chain trust verification, this means that it will not verify the trust chain, you cannot upload CA's into Azure in SaaS.
No CRL check, there is no mechanism in place to verify if the client certificate is revoked.
No check on expire/valid state.

What this means that any certificate can be used that was issued by a CA that is in the Azure Root CA store from a public CA.

How to solve the Problems

Validate the Certificate dates: if (DateTime.Compare(DateTime.Now, cert.NotBefore) < 0 || DateTime.Compare(DateTime.Now, cert.NotAfter) > 0) return false; Validate the policy chain: X509Chain ch = new X509Chain(); ch.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck; ch.ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot; ch.ChainPolicy.UrlRetrievalTimeout = new TimeSpan(1000); ch.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag; ch.ChainPolicy.VerificationTime = DateTime.Now; //build chain ch.Build(cert); //validate issuer, check the chain trusts var certArray = ch.ChainElements.Cast().ToArray(); if (!Array.TrueForAll(certArray, validatechainelements)) return false; The function (validatechainelements) is where each CA in the policy chain is verified against a list. The "Build" method is just used to build the policy but no validation is used, as it will always fail. What it does is builds the chain elements which allow us to validate what's in the chain. Notice the usage of Array.TrueForAll, this is a very interesting solution, basically this allows each item to be used against a function, like a foreach loop. private static bool validatechainelements(X509ChainElement el) { //Part of the chain is the client cert it's self so we just return true if the client cert matches the cert being passed if (el.Certificate.Thumbprint.ToLower().Contains(clientCert.Thumbprint.ToLower())) return true; //The getCAThumbprints below pulls a CSV file of trusted thumbprints System.Collections.Generic.List thumbprints = GetCAThumbprints(); if (thumbprints.Contains(el.Certificate.Thumbprint.ToLower())) return true; return false; } As you can see, the thumbprints are pulled from another function (not shown) which is just a list of strings of thumbprints of CA's we trust. If the chain element thumbprint matches a trusted CA thumbprint then return true, else false. Validate CRL: //check CRL list X509CertificateParser pr = new X509CertificateParser(); string crlurl = GetCrlDistributionPoints(certArray[1].Certificate)[0]; if (IsCertRevoked(pr.ReadCertificate(cert.RawData),crlurl)) return false; The above calls two different functions, the first gets the distribution URL, here I am using the API BouncyCastle.Crypto to parse the certificate. We use the second item in the array (1, as is zero based) which is the CA up the chain from the client certificate. ///

/// Returns an array of CRL distribution points for X509Certificate2 object. ///

/// X509Certificate2 object. /// Array of CRL distribution points. public static string[] GetCrlDistributionPoints(this X509Certificate2 certificate) { X509Extension ext = certificate.Extensions.Cast().FirstOrDefault( e => e.Oid.Value == "2.5.29.31"); if (ext == null || ext.RawData == null || ext.RawData.Length < 11) return null; int prev = -2; List items = new List(); while (prev != -1 && ext.RawData.Length > prev + 1) { int next = IndexOf(ext.RawData, 0x86, prev == -2 ? 8 : prev + 1); if (next == -1) { if (prev >= 0) { string item = Encoding.UTF8.GetString(ext.RawData, prev + 2, ext.RawData.Length - (prev + 2)); items.Add(item); } break; } if (prev >= 0 && next > prev) { string item = Encoding.UTF8.GetString(ext.RawData, prev + 2, next - (prev + 2)); items.Add(item); } prev = next; } return items.ToArray(); } private static int IndexOf(byte[] instance, byte item, int start) { for (int i = start, l = instance.Length; i < l; i++) if (instance[i] == item) return i; return -1; } Now that we have the distribution point we can validate the client certificate. //reference library BouncyCastle.Crypto //https://www.bouncycastle.org/csharp/ //Load CRL file and access its properties private static bool IsCertRevoked(Org.BouncyCastle.X509.X509Certificate cert,string url) { byte[] buf = GetCacheCRL(url); X509CrlParser xx = new X509CrlParser(); X509Crl ss = xx.ReadCrl(buf); var nextupdate = DateTime.Parse(ss.NextUpdate.ToString()); return ss.IsRevoked(cert); } Above the CLR is held in cache, and updated based on the nextupdate property. Although it would not be needed this section is the important part of the "GetCacheCRL". byte[] data; System.Net.WebRequest httpRequest = System.Net.WebRequest.Create(CRLFileURL); httpRequest.Timeout = 10000; System.Net.WebResponse webResponse = httpRequest.GetResponse(); System.IO.Stream strm = webResponse.GetResponseStream(); byte[] buffer = new byte[16 * 1024]; using (System.IO.MemoryStream ms = new System.IO.MemoryStream()) { int read; while ((read = strm.Read(buffer, 0, buffer.Length)) > 0) { ms.Write(buffer, 0, read); } data= ms.ToArray(); } strm.Close(); webResponse.Close(); The last element to get the solution working when dealing with client certificates: Application Settings as follows:

WEBSITE_LOAD_USER_PROFILE and set it to 1
WEBSITE_LOAD_CERTIFICATES with its value set to the thumbprint of the certificate will make it accessible to your web application.

Now that the above is met, then you now have the following validating:

What you have (the PKI token)
What you know (PIN)
Is it valid (by date expire)
Is it issued by a trusted CA(s)
Has it been revoked?

Hope this helps others, as working though everything above was a lot of fun.

Offline NuGet Packages with VS.NET 2017

JoeMVP — Mon, 14 Aug 2017 14:22:28 GMT

So, I work with a customer that has thier development network offline of the general internet. One of the development leads built a template for VS.NET (2015) which has all the NuGet packages. Well, I am running VS.NET 2017, yes I like to run the latest and greatest! First off, I created a new solution with the template. I then built the solution and had a large number of references to dll's missing. After a review of the NuGet manager I found that many of the packages said hey were not avaiable in the source. Yet they were listed in the installed section of the manager. I went about changing things but I did it out of order so here we will do it in order: First you msut add the location of the new packages (note, the template should probably have installed them correctly but for vairous reasons it didn't): The following is generic:

To manage package sources:

Select the Settings icon in the Package Manager UI outlined below or use the Tools > Options command and scroll to NuGet Package Manager:
Select the Package Sources node:

To add a source, select +, edit the name, enter the URL or path in the Source control, and select Update. The source now appears in the selector drop-down.
To change a package source, select it, make edits in the Name and Source boxes, and select Update.
To disable a package source, clear the box to the left of the name in the list.
To remove a package source, select it and then select the X button.
Use the up and down arrow buttons to change the priority order of the package sources. Visual Studio searches these sources in the priority order when restoring packages for a project.

What needs to be done is as follows:

Uncheck the "nuget.org" as all you get is erors because you can't reach it.
Add a new source as the instructions state above. The source would be where the packages are located. In my case I did a search for the template name, then I went one folder back, then clicked on "packages" and all the packages where there. This is the path of the packages that were embeded in the template.

Once you have the source then you are ready for the next step (while the solution with the missing assemblies is open): Go to: Tools->NuGet Package Manager->Package Manager Console This opens a console window to run powershell. Run the following: Update-Package -reinstall Now do a rebuild of the solution and all of the references will be resolved. Note: Once this is done one time on the machine in question, anytime you use the same template again you will not run into this issue.

DO NOT DELETE "Style Resource Readers" Group

JoeMVP — Wed, 28 Jun 2017 20:16:00 GMT

So the other day at my customer, the site collection used for training just stopped working, that's what is said. What stopped working is creating any sub sites, list, libraries. The error was very vague and unhelpful. The SPS Logs simply showed IO File not found shortly after trying to activate the "WikipageHomePage" feature. While users with permissions could not create a site, site collection administrators could. So this is simply a permissions issue. In researching this issue there were lots of similar cases. Most had to do with lack of permissions to the style/images/master page libraries. This is when I found that the "Style Resource Readers" which by the way has a description that says "DO NOT DELETE" was missing. This group normally has the following two accounts:

Everyone
NT AUTHORITY\authenticated users

The Group has the following permissions:

Read
Limited access

And has the following lists that is used in:

Site Collection Images
Style Library
Publishedlinks
Quick Deploy Items
Master Page Library

So even if you re-create the group you may still find that users still can't create sites/lists/libraries. That is because the hiddentaxonomylist probably has no permissions. go to site/lists/hiddentaxonomylist Add "Everyone" to the lists permissions. This may not fix your problem, but it may help answer some of your problems. Another possible way to fix the problems of deleting the group is to flip the Publishing feature off then on, both at the site level and site collection level. This should reset/re-create all the required items. Beware, it might cause additional pain in some cases. References: https://support.office.com/en-us/article/default-sharepoint-groups-in-sharepoint-server-50855943-c151-42bf-b6ea-07f2bb366ecc https://sharepoint.stackexchange.com/questions/92862/style-resource-readers-allow-access-to-list-views https://www.brightwork.com/product-blog/user-with-full-control-cannot-create-sub-sites-or-projects

SharePoint 2013 Multiple App Domain with Host Named Site Collections Issue

JoeMVP — Fri, 23 Jun 2017 18:53:37 GMT

SO, the other day I ran into a problem at a customer:

Summary

My client has setup an environment where they can only utilize sub domains of their primary domain. For example: command.com Hence different sites would be sub domains such as:

release.command.com
forward.command.com

To save time, maintenance and resources these two web applications are in one central farm. Previously they were in separate farms to secure content from each other. The client has also utilized HNSC (host named site collections) in order to be cloud ready. During the configuration of app domains for the organization to start building and deploying SharePoint hosted add-ins, the client ran into an issue. The issue is as follows: When utilizing HNSC and configuring SharePoint for multiple app domains. The settings for the following app domains are ignored.

release.command.com
forward.command.com

A global (via the UI) was setup such as: apps.command.com, and all redirects when utilizing a SharePoint hosted add-in goes to this location. Problem with this are twofold:

URL changes to guid.apps.command.com
No web site exists at that URL, hence 404.

The problem does not exist when not utilizing HNSC, though this would remove the organization from being cloud ready. This is a discovered issue unique to the configuration the client has, as there are required security boundaries that need to be in place between SharePoint Web Applications. Even if the above configuration is made to work, it means the site hosting the app domain has to have security rights to both web applications. This is a breach in the security design the client needs to maintain between web applications and content.

Solution Design

Summary

This solution to the issue at hand is to utilize an often used module provided by Microsoft called URL Rewrite. It also involves a careful use of extended sites and IP addresses. This solution will outline the elements required and the configuration of the solution. Note: there is no code for this solution, this is all configurations.

DNS Settings

First step is configuring the DNS, this is a bit different than most documentation. The standard configuration calls for a totally separate domain which isn't possible for the command or desired. Note: these would be load balanced IP's by a load balancer. Each web front end in the farm would require this configuration be applied. The following Table illustrates the configuration of the DNS for this solution:

Parent Domain	Main Sub Domain	Apps Domain	IP
Command.com			10.0.04
	Release		10.0.0.5
		Apps	10.0.05
		*.apps	10.0.0.6
	Forward		10.0.0.5
		Apps	10.0.0.5
		*.apps	10.0.0.7
	Apps		10.0.0.5
		*.apps	10.0.0.8

The separate apps domain off the root domain is strictly for redirects and will be discussed later. As illustrated in the above table, there are four addresses; this is because of the need for SSL certificates that are blank. Note: in Windows Server 2016, the issue of not being able to have "Require Server name Indication" checked for blank host name bindings is resolved. Hence the requirement of multiple IP addresses is null.

Certificates

The following is a list of certificates required for the solution:

Used by	Subject Name
apps.command.com	*.command.com
*.apps.command.com	*.apps.command.com
(apps/portal/root/whatever).release.command.com	*.release.command.com
*.apps.release.command.com	*.apps.release.command.com
(apps/portal/root/whatever).forward.command.com	*.forward.command.com
*.apps.forward.command.com	*.apps.forward.command.com

The solution requires the use of wild card certificates; this is not a requirement of this solution but of SharePoint Hosted Add-ins by Microsoft.

Web Applications

This solution has the following configuration: Web Applications:

Release Home
Forward Home

Each of the above is extended via Central admin

Release Apps
Forward Apps

Note: the reason to extend the sites is because of the blank bindings for the *.apps.[site].command.com calls. Hence all such calls will go to the extended site and be covered under that certificate. If extended sites are not used then invalid certificates will be indicated for most sites. Each site has the following site collection, though what is described is not a limit, just a short list.

[site].command.com
[site].command.com
[site].command.com(location of app catalog)

Note: set the app catalog for each web app pointing to the respective HNSC. Note: also set the app domain URL to: apps.command.com

IIS Bindings

The following are bindings for each website: Note: all are 443, blanks do not have "Require Server name Indication" checked.

Site	Binding	IP	Certificate
Release Home	Portal.release.command.com	10.0.0.5	*.release.command.com
Release Home	Dept1.release.command.com	10.0.0.5	*.release.command.com
Release Home	apps.release.command.com	10.0.0.5	*.release.command.com
Release Apps	[blank]	10.0.0.6	*.apps.release.command.com
Forward Home	Portal.forward.command.com	10.0.0.5	*. forward.command.com
Forward Home	Dept1. forward.command.com	10.0.0.5	*. forward.command.com
Forward Home	apps. forward.command.com	10.0.0.5	*. forward.command.com
Forward Apps	[blank]	10.0.0.7	*.apps. forward.command.com
Redirect Site	Apps.command.com	10.0.0.5	*.command.com
Redirect Site	[blank]	10.0.0.8	*.apps.command.com

Note: due to another issue within the redirect.aspx that builds the URL, all ports have to be 443, this is a SharePoint issue and cannot be changed until a fix is implemented.

Redirect Site

A site needs to be created in IIS, it can point to an empty folder, and nothing needs to be set. Make sure the URL rewrite module is installed, download it if needed: https://www.iis.net/downloads/microsoft/url-rewrite The model would show up when you click on the web site in IIS: Two rules need to be created to support the solution discussed. NOTE: this solution could be applied to more than one SharePoint web application, although only 2 are discussed here. Double click URL Rewrite: Click Add Rule(s) Select Blank Rule from the inbound rules section. Now you must define the actual rewrite rule. In the URL Rewrite Module, a rewrite rule is defined by specifying four required pieces of information:

Name of the rule.
Pattern to use for matching the URL string.
Set of conditions.
Action to perform if a pattern is matched and whether all conditions checks succeed.

Rule 1:

Name: Release Apps Redirect

Match URL section

Requested URL: Matches the Pattern Using Regular Expressions Pattern: ^(.*)$ Note: the string that comes in as an input is normally "sites/siteofinterest/pages/page1.aspx". Hence nothing to identify it as the URL you want, so here we simply say give us anything that is a string. Conditions Section: Logical Grouping: Match All

Input	Type	Pattern
{HTTP_REFERER}	Matches the Pattern	\brelease\b
{HTTP_POST}	Matches the Pattern	(^app-[0-9a-z]+)

Action Section

Action Type: Redirect Action Properties:Â https://{C:1}.apps.release.command.com{PATH_INFO}?{QUERY_STRING} Uncheck Include query

Rule 2:

Name: Froward Apps Redirect

Match URL section

Requested URL: Matches the Pattern Using Regular Expressions Pattern: ^(.*)$ Note: the string that comes in as an input is normally "sites/siteofinterest/pages/page1.aspx". Hence nothing to identify it as the URL you want, so here we simply say give us anything that is a string. Conditions Section: Logical Grouping: Match All

Input	Type	Pattern
{HTTP_REFERER}	Matches the Pattern	\bforward\b
{HTTP_POST}	Matches the Pattern	(^app-[0-9a-z]+)

Action Section

Action Type: Redirect Action Properties:Â https://{C:1}.apps.forward.command.com{PATH_INFO}?{QUERY_STRING} Uncheck Include query

Review

At this point, all the rest of the development process for building SharePoint Hosted Add-ins is the same. Deploying SharePoint Hosted Add-ins is the same, this is strictly an infrastructure solution and changes nothing of how users implement or use applications. One aspect that is not mentioned in this document thus far is authentication; this assumes both the main and extended sites utilize the same authentication methods. If federation is used then the extended sites will also need to utilize the same provider.

References

The following are references for this solution:

Name	URL
URL Rewrite tips and tricks	https://ruslany.net/2009/04/10-url-rewriting-tips-and-tricks/
Download URL Rewrite	https://www.iis.net/downloads/microsoft/url-rewrite
Creating Outbound rules	https://docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/creating-outbound-rules-for-url-rewrite-module
Using Failed request Tracing to trace Rewrite rules	https://docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-failed-request-tracing-to-trace-rewrite-rules
URL Parts Available to URL Rewrite Rules	https://weblogs.asp.net/owscott/url-parts-available-to-url-rewrite-rules
URL Rewrite Configuration Reference	https://docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/url-rewrite-module-configuration-reference
Getting parts of a URL with Regex	https://stackoverflow.com/questions/27745/getting-parts-of-a-url-regex
Regular Expressions Examples	https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions
Developing a Custom Rewrite provider	https://docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/developing-a-custom-rewrite-provider-for-url-rewrite-module
Creating Rewrite Rules	https://docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/developing-a-custom-rewrite-provider-for-url-rewrite-module