Method 1:

WindowsIdentity wi = System.Security.Principal.WindowsIdentity.GetCurrent();

foreach (var u in wi.Groups)
{
     Console.WriteLine("{0} ", u.Value);
}

Method 2:

AppDomain.CurrentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal);
WindowsIdentity wi = System.Threading.Thread.CurrentPrincipal.Identity as WindowsIdentity;
 
foreach (var u in wi.Groups)
{
    Console.WriteLine("{0} ", u.Value);
}

Method 3:

using (var adContext = new PrincipalContext(ContextType.Domain, domainName))
{
      UserPrincipal user = UserPrincipal.Current;
      PrincipalSearchResult<Principal> results = user.GetAuthorizationGroups();
      foreach (var u in results)
      {
          Console.WriteLine("{0}", u.Sid);
      }
}

Method 4:

DirectoryEntry rootDSE = new DirectoryEntry("LDAP://RootDSE");
string domainContext = rootDSE.Properties["defaultNamingContext"].Value as string;
string username = Environment.UserName;

List<string> userNestedMembership = new List<string>();

DirectoryEntry domainConnection = new DirectoryEntry();
domainConnection.Path = string.Format("LDAP://{0}", domainContext);
domainConnection.AuthenticationType = AuthenticationTypes.Secure;

DirectorySearcher samSearcher = new DirectorySearcher();

samSearcher.SearchRoot = domainConnection;
samSearcher.Filter = "(samAccountName=" + username + ")";

SearchResult samResult = samSearcher.FindOne();

if (samResult != null)
{
    DirectoryEntry theUser = samResult.GetDirectoryEntry();
    theUser.RefreshCache(new string[] { "tokenGroups" });

    foreach (byte[] resultBytes in theUser.Properties["tokenGroups"])
    {
        System.Security.Principal.SecurityIdentifier mySID = new System.Security.Principal.SecurityIdentifier(resultBytes, 0);
        Console.WriteLine(mySID);
    }
}

Environment:

Prepare the environment:

• DNS A record: drtestweb.contoso.com – 10.0.0.200
• Kerberos settings (I will omit the FQDN part of the settings in the blog)
  • setspn –a MSSQLSvc/LAB-SQL2008R2 contoso\sp_sql
  • setspn –a HTTP/drtestweb contoso\sp_app
  • KCD: allow contoso\sp_c2wts to delegate SPNs on contoso\sp_sql for any protocol  (SSRS 2012 SA is claim aware and is similar to PPS and Excel Service – please refer to TechNet document how to configure Kerberos for PPS and Excel Service)
• create production farm on SP2010DRTEST1
  1. configure C2WTS service to run under contoso\sp_c2wts account and also assign “act as part of OS” permission and make it local admin
  2. install SQL Server 2012 Reporting Service Application for SharePoint 2010 and create SSRS SA and also configure the unattended execution account
  3. create web application https://drtestweb.contoso.com using Team site for root web
  4. create a document library SSRS2012 and add 3 SSRS content types to this library
  5. create two data sources:
     1. dsUserCredential – this will access LAB-SQL2008R2 using end user’s credential (Kerberos)
     2. dsUnattendedAccount – this will access LAB-SQL2008R2 using unattended account
  6. create one report for each of the above data source (note – it seems like a bug that you could not use the data source that is configured using unattended account to create report but you can temporarily switch to use user credential to create the report and then switch back to unattended account after report created)
• create DR farm on SP2010DRTEST2
  • make sure to use same service accounts as production farm (Kerberos will just work after switch)
  • configure C2WTS service to run under contoso\sp_c2wts account and also assign “act as part of OS” permission and make it local admin
  • install SQL Server 2012 Reporting Service Application for SharePoint 2010 – DO NOT create SSRS SA
  • create web application https://drtestweb.contoso.com and then delete the content database
• TEST production farm
  • go to Win7client, make sure the two reports are working as expected

BCM steps:

• from SSRS SA, backup the encryption key and copy this key to a safe place and note the password in a secret place
• for SharePoint content database, you can either choose log shipping or async database mirroring to sync production database SQL to DR SQL server
• for 3 SSRS databases, TechNet says log shipping and database mirroring is not supported so what you need to do for those 3 databases is to have a schedule for full backup and log backup and copy the backup files offsite for DR purpose. [UPDATE] we might change the word not support soon because when we say not supported we really meant in some cases the SQL agent job cannot automatically failover. so for DR purpose, we can use log shipping or async database mirroring to make the production database in sync with DR site.
• In this test, I will use simple backup and restore for all 4 databases

In case of Disaster, here are the steps for Recovery (the following steps are in DR farm):

1. assume we have the encryption key and all database backups
2. restore content database and 3 SSRS database
3. create SSRS SA and specify the name of the database to the database name you restored from the backup
4. in the SSRS key management, restore the encryption key
5. configure the unattended account – make sure using the same unattended account you used in production
6. attach the content database to web application https://drtestweb.contoso.com

TEST DR

1. shutdown SP2010DRTEST1 server (mimic Disaster)
2. go to Win7Client you will not be able to access the site
3. go to DC, change the DNS A record drtestwebapp to point to 10.0.201 (DR farm box)
4. go back to Win7Client machine, issue ipconfig /flushdns, verify you can ping drtestwebapp to resolve 10.0.0.201 and then test both reports and it worked for me

Hope this will benefit someone else who are interested in how to handle SSRS 2010 SA DR. Happy DR!!!

https://cks.codeplex.com/releases/view/7450

Federated Search

https://manish-sharepoint.blogspot.com/2009/12/federated-search-in-sharepoint-2010.html

https://manish-sharepoint.blogspot.com/2009/12/federated-search-in-sharepoint-2010_21.html

https://blogs.technet.com/b/vedant/archive/2010/10/27/federated-search-connectors-for-enterprise-search.aspx

Consuming farm one web application https://hosting.litware.local hosting several host header site collections for tenant

• Steps to create partitioned service applications
• PowerShell with either PartitionMode or Partitioned switch
• Publish service applications
• trust Root authority and STS cert from consuming farm
• grant consuming farm ID full trust to Application Discovery and Load Balancer Service App and related service apps to be published
• publish service applications from UI and get all Uri from the publishing screen
• Permissions
• UPA
• setup account full control and administrators full control, consuming farm account and webapp account full control
• Search
• BCS
• SSS
• MMS
• Consuming service applications
• trust publishing farm Root authority cert
• use powershell New-SPXXXProxy cmdlet with Partitioned or PartitionMode to create proxy, the –Uri is the Uri you got from the publishing screen
• note: when connects to remote BCS and SSS you cannot specify partitionmode so you need to fix the proxy afterward using following scripts:

-- SSS
$proxy = Get-SPServiceApplicationProxy fb99edae-1b27-49c2-82bf-60bf6b9e91a
$prop = $proxy.Properties
$type = $prop["Microsoft.Office.Server.Utilities.SPPartitionOptions"].GetType()
$partition = [enum]::Parse( $type, 1 )
$prop["Microsoft.Office.Server.Utilities.SPPartitionOptions"] = $partition
$proxy.Update()

-- BCS
$proxy = Get-SPServiceApplicationProxy db0f1f9f-aec4-45c1-a149-47f105278304
$prop = $proxy.Properties
$type = $prop["Microsoft.SharePoint.Utilities.SPPartitionOptions"].GetType()
$partition = [enum]::Parse( $type, 1 )
$prop["Microsoft.SharePoint.Utilities.SPPartitionOptions"] = $partition
$proxy.Update()

• Create a named proxy group to group all partitioned service proxy, then use UI to add those proxies into this named group
• New-SPServiceProxyGroup “Partioned Service Applications”
• associate the named proxy group to web application https://hosting.litware.local
• Turn on multi-tenancy
• create Settings Service Application and start the service instance

Get-spserviceinstance | ? {$_.GetType().Name -eq "SPSubscriptionSettingsServiceInstance"} | Start-SPServiceInstance

$acc = Get-SPManagedAccount  "LITWARE\sp_service"
$appPool = New-SPServiceApplicationPool -Name "Settings Service App Pool" -Account $acc
$app = New-SPSubscriptionSettingsServiceApplication –ApplicationPool $appPool –Name "Settings Service App" -DatabaseServer LITSQL1 –DatabaseName Internet_SettingsServiceDB
$proxy = New-SPSubscriptionSettingsServiceApplicationProxy –ServiceApplication $app


• create a host header site collection and test if the site collection is working before adding to subscription
• New-SPSite -Url https://aw.local -OwnerAlias "litware\aw1" -HostHeaderWebApplication "https://hosting.litware.local" -Template "STS#0"
• Note: To avoid manually creating IIS host header for host header site collections on the web application, you should not use host header when creating the web application that will be used for the host named site collections. What I did not make it work is to stop default website which is using the port 80, created a web application on port 80 (https://litsp1) and then create host header site collections using https://litsp1 and this works without manually adding host header to the IIS website; I further extended https://litsp1 to https://host2.litware.local to different zone, then I used the https://host2.litware.local to create host header site collection (https://pursca.local) and this works too – I checked the SPSite.WebApplication for https://pursca.local is still pointed to https://litsp1 even I used the https://host2.litware.local in the New-SPSite command to create the second site collection.  So the question is how do we make host header site collections load balanced on multiple servers if the SPSite.WebApplication always pointed to the physical box name? (to be researched on this)
• good reading from Kirkk Evans on Host Named Site Collections
  
• create subscription and add the site collection into subscription
• $sub = Get-SPSiteSubscription <Guid>
• $site = Get-SPSite https://aw.local
• $sub.Add($site)
• create tenant management site
• New-SPSite -Url https://aw.local/sites/admin -OwnerAlias "litware\aw1" -AdministrationSiteType tenantAdministration -HostHeaderWebApplication "https://hosting.litware.local" -SiteSubscription $sub -Template "tenantadmin#0"
• create hostheader managed path for mysite (https://aw.local/my) and a mysite host
• New-SPManagedPath “my” –hostheader –Explicit
• New-SPSite -Url https://aw.local/my -OwnerAlias "litware\aw1" -HostHeaderWebApplication "https://hosting.litware.local" -SiteSubscription $sub -Template "SPSMSITEHOST#0"
• new-spmanagedpath "/my/personal" -hostheader
• create search center (if your aw.local is using publishing portal, you will have a subsite named as search so to avoid confusion you might want use /sites/searchcenter for cross site collections search)
• New-SPSite -Url https://aw.local/sites/search -OwnerAlias "litware\aw1" -HostHeaderWebApplication "https://hosting.litware.local" -SiteSubscription $sub -Template "SRCHCEN#0"
• Import user profile after adding first tenant
• $sub = Get-SPSiteSubscription <Guid>
• $upaProxy = Get-SPServiceApplicationProxy <Guid>
• Add-SPSiteSubscriptionProfileConfig -id $sub –SynchronizationOU “AdventureWorks” –MySiteHostLocation "https://aw.local/my" -MySiteManagedPath "/my/personal" -SiteNamingConflictResolution "None" -ProfileServiceApplicationProxy $upaProxy
• note: by some reason the sp_farm are imported for each tenant as an user – need to do some investigation 
• MySite settings (https://aw.local/my/username)
• enable self-site creation on https://hosting.litware.local – root site collection must be created before you can enable self-site creation
• Search
• Content Search
• https://hosting.litware.local
• People Search
• sps3://aw.local
• sps3://con.local

How do we get rid of the orphan PWA?

$sa = Get-SPServiceApplication | ? {$_.TypeName –eq “Project Server PSI Service Application”}

$sa.SiteCollection  … this will display all PWA including those orphaned ones – you need to locate those orphaned one and get the ID of that Site Collection then you remove them from the collection as follows:

$sa.SiteCollection.Remove(“Orphan PWA Site Collection GUID”)

$sa.Update()

I have a full trusted InfoPath form that was OK in MOSS 2007 and it was also OK to import from the exported cab files with SharePoint 2010 RTM. But it throws the following error after SP2010 SP1  when I tried to upload the same InfoPath form:

System.NullReferenceException: Object reference not set to an instance of an object.  
at Microsoft.Office.InfoPath.Server.Converter.DetectUnsupportedNamespaces.VerifyNamespace(String ns, String nodeName, ICollection`1 problems)   
at Microsoft.Office.InfoPath.Server.Converter.BusinessLogicScanner.<>c__DisplayClass2.<Analyze>b__1(MethodBase method)   
at Microsoft.Office.InfoPath.Server.Converter.BusinessLogicScanner.VisitMethod(MethodBase method, MethodInfoVisitor methodVisitor)   
at Microsoft.Office.InfoPath.Server.Converter.BusinessLogicScanner.VisitBody(MethodBase method, MethodInfoVisitor methodVisitor)   
at Microsoft.Office.InfoPath.Server.Converter.BusinessLogicScanner.VisitBody(MethodBase method, MethodInfoVisitor methodVisitor)   
at Microsoft.Office.InfoPath.Server.Converter.BusinessLogicScanner.VisitBody(MethodBase method, MethodInfoVisitor methodVisitor)   
at Microsoft.Office.InfoPath.Server.Converter.BusinessLogicScanner.VisitMethods(Type mainType, MethodInfoVisitor methodVisitor)   
at Microsoft.Office.InfoPath.Server.Converter.BusinessLogicScanner.Analyze(Type mainType, List`1 rules)   
at Microsoft.Office.InfoPath.Server.SolutionLifetime.BusinessLogicLoader.VerifyUsingFxCop(Assembly rootAssembly)   
at Microsoft.Office.InfoPath.Server.SolutionLifetime.BusinessLogicLoader.Microsoft.Office.InfoPath.Server.SolutionLifetime.ISolutionComponent.Parse(XPathNavigator documentClassNode, XmlNamespaceManager solutionNamespaceManager, ConversionContext context)   
at Microsoft.Office.InfoPath.Server.SolutionLifetime.Solution.ParseManifest(ConversionContext context, XPathNavigator node)   
at Microsoft.Office.InfoPath.Server.SolutionLifetime.Solution.LoadFromXsn(ConversionContext context, SolutionCabinet solutionCabinet, SolutionIdentity solutionId)   
at Microsoft.Office.InfoPath.Server.SolutionLifetime.Solution.<>c__DisplayClass2.<ConstructFromXsnFile>b__0()   
at Microsoft.Office.Server.Diagnostics.FirstChanceHandler.ExceptionFilter(Boolean fRethrowException, TryBlock tryBlock, FilterBlock filter, CatchBlock catchBlock, FinallyBlock finallyBlock)   
at Microsoft.Office.Server.Diagnostics.ULS.SendWatsonOnExceptionTag(UInt32 tagID, ULSCatBase categoryID, String output, Boolean fRethrowException, TryBlock tryBlock, CatchBlock catchBlock, FinallyBlock finallyBlock)   
at Microsoft.Office.InfoPath.Server.SolutionLifetime.Solution.ConstructFromXsnFile(ConversionContext context, SolutionCabinet solutionCabinet, SolutionIdentity solutionId)   
at Microsoft.Office.InfoPath.Server.Converter.ConversionAppDomain.OperationRunner.ExecuteConversion(ConversionContext& context, SolutionCabinet solutionCabinet, SolutionIdentity solutionId, Boolean executeVerification)   
at Microsoft.Office.InfoPath.Server.Converter.ConversionAppDomain.OperationRunner.ExecuteConversion(ConversionContext& context, SolutionCabinet solutionCabinet, SolutionIdentity solutionId, Boolean executeVerification)   
at Microsoft.Office.InfoPath.Server.Converter.ConversionAppDomain.ExecuteInRemote(ConversionContext context, AppDomain domain, SolutionCabinet solutionCabinet, SolutionIdentity solutionId)   
at Microsoft.Office.InfoPath.Server.Converter.ConversionAppDomain.<>c__DisplayClass4.<TryRunConversion>b__0()   
at Microsoft.Office.Server.Diagnostics.FirstChanceHandler.ExceptionFilter(Boolean fRethrowException, TryBlock tryBlock, FilterBlock filter, CatchBlock catchBlock, FinallyBlock finallyBlock)   
at Microsoft.Office.Server.Diagnostics.ULS.SendWatsonOnExceptionTag(UInt32 tagID, ULSCatBase categoryID, String output, Boolean fRethrowException, TryBlock tryBlock, CatchBlock catchBlock, FinallyBlock finallyBlock)   
at Microsoft.Office.InfoPath.Server.Converter.ConversionAppDomain.TryRunConversion(ConversionContext context, SolutionCabinet solutionCabinet, SolutionIdentity solutionId, Byte[] solutionData, WspSolutionInfo wspSolution)   
at Microsoft.Office.InfoPath.Server.Converter.ConversionAppDomain.RunConversion(ConversionContext context, SolutionCabinet solutionCabinet, SolutionIdentity solutionId)   
at Microsoft.Office.InfoPath.Server.Util.InstalledSolutions.<>c__DisplayClass7.<VerifyUnpackedSolution>b__6()   
at Microsoft.Office.Server.Diagnostics.FirstChanceHandler.ExceptionFilter(Boolean fRethrowException, TryBlock tryBlock, FilterBlock filter, CatchBlock catchBlock, FinallyBlock finallyBlock)   
at Microsoft.Office.Server.Diagnostics.ULS.SendWatsonOnExceptionTag(UInt32 tagID, ULSCatBase categoryID, String output, Boolean fRethrowException, TryBlock tryBlock, CatchBlock catchBlock, FinallyBlock finallyBlock)   
at Microsoft.Office.InfoPath.Server.Util.InstalledSolutions.VerifyUnpackedSolution(SolutionCabinet solutionCabinet, String originalFileName, ConversionContext context, ConverterLog& outputConverterLog, Byte[]& outputConvertedData)   
at Microsoft.Office.InfoPath.Server.Util.InstalledSolutions.VerifySolution(String absoluteLocalPath, ConversionContext context, ConverterLog& converterLog, Byte[]& convertedData)   
at Microsoft.Office.InfoPath.Server.Administration.FormTemplateCollection.VerifyFormTemplateInternal(String solutionPath, ConverterLog& converterLog)   
at Microsoft.Office.InfoPath.Server.Administration.FormTemplateCollection.TryAdd(String solutionPath, ConverterLog& converterLog)   
at Microsoft.Office.InfoPath.Server.ApplicationPages.UploadFormTemplatePage.<>c__DisplayClass1.<ButtonOkClick>b__0(String sourceName)   
at Microsoft.Office.InfoPath.Server.ApplicationPages.UploadFormTemplatePage.HandleFiles(HandleFile fileHandler)   
at Microsoft.Office.InfoPath.Server.ApplicationPages.UploadFormTemplatePage.ButtonOkClick(Object sender, EventArgs e)   
at System.Web.UI.WebControls.Button.OnClick(EventArgs e)   
at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)   
at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument)   
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

In the troubleshooting process, I copied this InfoPath to a fresh SharePoint farm and tried to upload it and it verified OK but give me a list of referenced assemblies that were missing. I added the missing assembly to GAC and the above error showed up again. So there is must be something special about the assembly – looked at the source code and found out that the public class used by InfoPath form code does not have namespace. Added the namespace and everything works fine now.

Some documents indicated that SSRS 2012 will be claim aware and work with C2WTS to convert Windows claims to Windows token. I deployed it in my lab environment and it did work with kerberos authentication in both classic and claims based authentication web application. Here are the of steps of installing and configure SSRS 2012 service application.

• Install SSRS 2012 (Reporting Services – SharePoint and Reporting Services Add-in for SharePoint Products) from SQL 2012 CD on SharePoint App server
• Create a SQL server
• Optionally you can configure the Kerberos authentication as you would for Excel services
  • make sure C2WTS works (if your Excel service works with Kerberos then C2WTS is configured correctly)
  • make sure SSRS service account KCD is configured correctly
  • make sure SSRS service account has access to SharePoint web application content database(s) 
• make sure the execution account has “allow logon locally” in local security policy

• Test SSRS 2012
  • Add 3 Content types to a document library
  • Create a reporting data source
  • Create a report using report builder

You might encounter the same issue if you test it on a claim based authentication web application as I went through the process and here is the scenario:

• Logon as LITWARE\Administrator
  • Created the claim based authentication web application
  • Create a team site collection, make LITWARE\administrator as site collection administrator
  • Added 3 SSRS content types to Shared Document library
  • Created a report data source and tested successful
  • Saved this report data source to document library
  • Open the just saved data source – I got the following error

Since Litware\administrator is a domain admin, farm admin, site collection admin, how could it possible it cannot open a file just created and saved?

When my peer Jim (support engineer) asked me: If you create a data source with a regular user instead of the Administrator do you see the same error?

At first I did not want to do it because my brain was occupied by who else has more power than my litware\administrator?! But as a courtesy and be able to reply his email, I went ahead to try the following steps:

1. Added litware\lit10 as site collection admin

2. Logon as lit10

3. Clicked on the data source created by administrator – I cannot believe myself, it opened without any problem !!!

4. Then I created a report builder report, and it worked beautifully

5. Then since I have Contoso and Litware forest trusted so I went ahead to give Contoso\administrator the site collection administrator access

6. Logon as Contoso\administrator, everything works fine

7. BUT logon as litware\administrator, it does not work!!!

OK, why then? What could trigger the code permission validation think Litware\administrator does not have permission?

By looking into the UserInfo database, you can see that we have two entry for litware\administrator, one is normal claim based and another is classic based, but for Contoso\administrator and lit10, we have only one entry which is claim based. To test my theory, I’d like to remove the non claim based litware\administrator from the database to try it again, but I do not want to do it in a unsupported way – remove it from db directly J

Here is how I clean that out:

1. Logon as lit10

2. Remove litware\administrator from home owners group

3. Remove litware\administraror from site collection admin

4. Remove it from All People list but SharePoint 2010 removed the link to allow us to see all people, so we just need to get the url pattern from 2007 and pasted to 2010

https://team9.litware.local/_layouts/people.aspx?MembershipGroupId=0&FilterField1=ContentType&FilterValue1=Person

we see 3 administrators … the 2^nd one is classic one and I removed it. Go to the database UserInfo table to verify it is marked as deleted.

Re-add litware\administrator to site collection admin group, logon as litware\administrator, woohoooo, worked!!!!!

• Prepare the servers as SharePoint application servers and joined into the farm
• Install SSRS 2008 R2 bits on the servers
• Configure SSRS using configuration wizard
  • Create a database in integrated mode
  • Web Service URL – if Advanced button is not enabled, you need to apply the settings first and then you can change or add another DNS url later
  • Configure execution account
• If you use more than one server to run SSRS, you need to make the machine key be the same for all SSRS servers in web.config
• If you use DNS name instead of machine name for reportserver url then you need to change <UrlRoot /> to the DNS name
• If you use kerberos, then configure the following:
  • SETSPN for SSRS url such as https://ssrs.contoso.local on the SSRS service account, trust the service account for basic delegation
  • Change <RSWindowsNTLM /> to <RSWindowsNegotiate /> in rsReportServer.config
• Configure SSRS in SharePoint CA
  • Report Server Web Service URL
  • Add Report Server Instance – SSRS web and windows service accounts will be granted permission to SharePoint databases in this process

Create Reports using Report Builder

• Create a document library
• Add following content types to this document library
  • Report Data Source
  • Report Builder Model
  • Report Builder Report
• Use report builder to create reports
  • Create a Data Source
  • Create Builder Model
  • Create the Report

Create Reports using Visual Studio

• Create a report using Visual Studio
• Publish urls are different from native mode – check the reference below

References:

• https://msdn.microsoft.com/en-us/library/bb326213.aspx
• https://msdn.microsoft.com/en-us/library/bb326356.aspx
• https://fendy-huang.blogspot.com/2011/02/create-ssrs-report-with-sharepoint-2010.html
• https://blogs.msdn.com/b/psssql/archive/2011/02/24/sharepoint-adventures-why-isn-t-claims-working-with-ssrs.aspx
•  

1. At SiteMinder side, CA people configured a RP to send out two claims: email address and CommonName, it seems that the namespace from SiteMinder is defaulted to https://schemas.xmlsoap.org/claims so our two claim are: https://schemas.xmlsoap.org/claims/CommonName and https://schemas.xmlsoap.org/claims/EmailAddress

2. At SharePoint side, we imported the Site Minder token signing certificates and added the chain of certificates to TrustedRootAuthority then run series of other scripts to setup the Trusted Identity Provider named “SiteMinder STS”. Here is a good link on how to setup SharePoint 2010 with ADFS v2 and the steps are exactly the same on SharePoint side.

We encountered a strange behavior after initial configuration:

• user access the SharePoint site
• user is redirected to SiteMinder login page
• user is redirected back to SharePoint after authenticated by SiteMinder with FedAuth cookie
• user is redirected right back to SiteMinder again

Spent some fair amount of time on it and my co-worker Tyler Durham pointed me the right direction and we found out the the Token lifetime of SiteMinder is 2 minutes so we adjusted the SiteMinder’s token lifetime to 1 hour and the problem went away.

3. After this setup, user does not like that in peoplepicker, anything you typed in will be resolved so we went ahead to build a Custom Claim Provider for resolving the names by override the FillSearch and FillResolve. Here is the link how to build and register Custom Claim Provider.

4. Then user request to only allow normal user to search users that are already in the current site collection so we run the following command on the web application: stsadm –o setproperty –url https://mywebapplication –pn “peoplepicker-onlysearchwithinsitecollection” –pv yes

after this, I found out that my FillSearch code is no longer works since SharePoint restrict the search only within the site collection.

5. Then user want to have site collection admins to be able to resolve names against LDAP store and normal user only allow to resolve names from within the current site collection so I modified the FillResolve code to check if current user is Site admin or not then search the user from different store.

6. Then user want to hide the SiteMinder STS hierarchy at left panel of peoplepicker search window so I run the following powershell command to make my custom claim provider the default claim provider of SiteMinder STS according to Steve’s blog:

$trusted = Get-SPTrustedIdentityTokenIssuer -Identity "SiteMinder STS"
$trusted.ClaimProviderName = “internal name of your custom claim provider”
$trusted.Update()

7.  Right after we made our custom claim provider the defaullt provider  of the SiteMinder STS we found out that the resolved claim is not the claim what SiteMinder STS sends in so we followed another Steve’s blog to made the following changes of the custom claim provider to get it work correctly:

• Created a internal static string TrustedIdentityTokenIssuerName = “SiteMinder STS” – this must be the same name as the Trusted Identity Provider
• Instead of using the CreateClaim helper method and use the New SPClaim constructor

Side Notes:

At this moment, user cannot participate workflow or subscribe the alert because the SPUser’s email address is empty. How do we populate the email for the user?

One way of doing this is to develop a custom control to first check if current user’s email address (SPContext.Current.Web.CurrentUser.Email) is empty, if it is then get the email claim and then update the SPUser object and register it as delegate control available in the master page.

Did some research and found out the there is piece of code used by this web part has the following construct:

using (SPWeb web = SPContext.Current.Site.RootWeb)
{
   ...
}

The rule of thumbs is that do not dispose object you did not create. In the above construct, did we create the new instance of SPWeb? Let’s take a look at the RootWeb property in the SPSite class using Reflector:

so if the m_rootWeb is already there no instance is created.

I fixed the code by changing it to using (SPWeb web = SPContext.Current.Site.OpenWeb()) { … } and the error goes away. BUT what is the explanation of site Admin user would not have the same problem?

… I will update here if I found the answer.