Rajeev's Blog

Export All Azure Resources Tags

Rajeev Buggaveeti — Thu, 01 Mar 2018 01:11:15 GMT

While playing the our customers Azure, I figured out that there is no way to identify the resource types apart from the naming convention. When you need generate a report to understand your resources, tags comes handy. We always end up creating VMs in Azure using a script or through UI and forget to add Tags. Azure Tags are very helpful to define the resources. You apply tags to your Azure resources to logically organize them by categories. Each tag consists of a name and a value. For example, you can apply the name "Environment" and the value "Production" to all the resources in production. Without this tag, you might have difficulty identifying whether a resource is intended for development, test, or production. However, "Environment" and "Production" are just examples. You define the names and values that make the most sense for organizing your subscription. After you apply tags, you can retrieve all the resources in your subscription with that tag name and value. Tags enable you to retrieve related resources that reside in different resource groups. This approach is helpful when you need to organize resources for billing or management. ref: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags Now, here is a PowerShell script I developed to dump all the resounces with their tags and value into an excel. I was able to populate this data in PowerBI to create a report which I will explain in the next article. # This script loops through all azure subscriptions, resource groups and resources to print tags in an excel.

# Please create an empty excel file at C:\temp\tags.xlsx

Set-ExecutionPolicy -ExecutionPolicy unrestricted -Force

$excel = New-Object -ComObject excel.application

$excel.visible = $True

$workbook = $excel.Workbooks.Add()

$workbook.Worksheets.Add()

$Data= $workbook.Worksheets.Item(1)

$Data.Name = 'MySpreadsheet'

#$file="C:\temp\Tags.csv"

$data.Cells.Item(1,1) = "Name"

$data.Cells.Item(1,2) = "ResourceId"

$data.Cells.Item(1,3) = "ResourceName"

$data.Cells.Item(1,4) = "ResourceType"

$data.Cells.Item(1,5) = "kind"

$data.Cells.Item(1,6) = "ResourceGroupName"

$data.Cells.Item(1,7) = "Location"

$data.Cells.Item(1,8) = "SubscriptionId"

$data.Cells.Item(1,9) = "Tags"

$data.Cells.Item(1,10) = "SKUName"

$data.Cells.Item(1,11) = "SKUTier"

#$d = $data.UsedRange

#$d.Interior.ColorIndex = 19

#$d.Font.ColorIndex = 11

#$d.Font.Bold = $True

$intRow = 2

foreach($sub in Get-AzureRmSubscription)

{

Set-AzureRmContext -Subscription $sub.Id

#$sub.Name

foreach ($res in Get-AzureRmResource)

{

#$t=(Find-AzureRmResource -ResourceGroupNameEquals $res.ResourceGroupName -ResourceNameEquals $res.ResourceName).Tags

#$t.Keys

#$t.Values

$data.Cells.Item($intRow, 1) = $res.Name

$data.Cells.Item($intRow, 2) = $res.ResourceId

$data.Cells.Item($intRow, 3) = $res.ResourceName

$data.Cells.Item($intRow, 4) = $res.ResourceType

$data.Cells.Item($intRow, 5) = $res.kind

$data.Cells.Item($intRow, 6) = $res.ResourceGroupName

$data.Cells.Item($intRow, 7) = $res.Location

$data.Cells.Item($intRow, 8) = $res.SubscriptionId

$data.Cells.Item($intRow, 11) = $res.sku.name

$data.Cells.Item($intRow, 12) = $res.sku.tier

if($res.Tags -ne $null)

{

$tag=@()

$res.Tags.GetEnumerator() | ForEach-Object {

#[string]$key += $_.key+";"

#[string]$value += $_.value+";"

[string]$tag +=$_.key+"="+$_.value+";"

$data.Cells.Item($intRow, 9)=$tag

}

$intRow = $intRow + 1

}

$usedRange = $Data.UsedRange

$usedRange.EntireColumn.AutoFit() | Out-Null

$workbook.SaveAs("C:\temp\tags.xlsx")

$excel.Quit()

$a.Save()

$a.Close()

$Excel.Quit()

[System.Runtime.Interopservices.Marshal]::ReleaseComObject($Excel)

Stop-Process -Name EXCEL -Force

Please comment if you have any questions.

Picture Sync from Office 365 to AD (PowerShell way)

Rajeev Buggaveeti — Tue, 16 May 2017 17:46:37 GMT

Well, this came up when I was dealing with a Photo policy where the customer have Office365 and On Premise applications such as SharePoint. We all know that Pictures stored in Office365 cloud could be of resolution 648x648 (High Resolution pictures). If your organization has all the workloads in cloud, you are good because, Skype Online and SharePoint Online also supports this . The way Office 365 is configured, you would allow end users to upload their own pictures and it could take about 24 hours before its reflected in all the other workloads. However, if you have on premise applications which depend on AD for picture sync, you need to automate the picture sync between AD and Office365 to ensure that you have the same picture across the workloads. Unfortunately, I couldn't see any tools that could be configured readily for this automation at schedules. So, I have decided to come up with a PowerShell script that does this for me. Well, most of you could write this too. But wanted to help those who are in need readily..:) *************PowerShell Start*************** Download this module resize-image and rename the extension from .TXT to .psm1 and store it into the same share(share1)

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Force

Import-Module \\share1\Resize-Image.psm1

rmdir \\Share1\O365Pictures\ -Force -Confirm:$false -Recurse

Start-Sleep -Seconds 30 mkdir \\Share1\O365Pictures\ -Force -Confirm:$false

#MSOnline Connection String#

Import-Module MSOnline

$User = "Office365GA@bugga.onmicrosoft.com" $PWord = ConvertTo-SecureString -String "****" -AsPlainText -Force $Credential = New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $User, $PWord Connect-MsolService -Credential $Credential Remove-PSSession $ExSession $ExSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/?proxymethod=rps -Credential $Credential -Authentication Basic -AllowRedirection Import-PSSession $ExSession

#Pictures are Downloaded to#

$folderpath="\\Share1\O365Pictures\"

#Download all user profile pictures from Office 365: New-Item -ItemType directory -Path $folderpath –force $allUsers=Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited|select UserPrincipalName,Alias Foreach($user in $allUsers) { $path=$folderpath+$user.Alias+".Jpg" $photo=Get-Userphoto -identity $user.UserPrincipalName -ErrorAction SilentlyContinue If($photo.PictureData -ne $null) { [io.file]::WriteAllBytes($path,$photo.PictureData) Write-Host $user.Alias “profile picture downloaded” } }

Remove-PSSession $ExSession

rmdir \\Share1\CroppedPictures\ -Force -Recurse -Confirm:$false Start-Sleep -Seconds 30 mkdir \\Share1\CroppedPictures\ -Force -Confirm:$false

$Input="\\Share1\O365Pictures\"

#Output to store Resized images# $output= "\\Share1\CroppedPictures\"

$users=Get-ChildItem $Input

foreach($user in $users) { $name=$user.Name Resize-Image -InputFile $input$name -Width 96 -Height 96 -OutputFile $output$name #$user.Name

}

$users=Get-ChildItem $output

foreach($user in $users) { $account=$user.Name.Split('.')[0] $dom = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() $root = $dom.GetDirectoryEntry() $search = [System.DirectoryServices.DirectorySearcher]$root $search.Filter = "(&(objectclass=user)(objectcategory=person)(samAccountName=$account))" $result = $search.FindOne()

if ($result -ne $null) { $userRe = $result.GetDirectoryEntry() [byte[]]$jpg = Get-Content $input2$user -encoding byte $userRe.put("thumbnailPhoto", $jpg ) $userRe.setinfo() Write-Host $userRe.displayname " updated" } else {Write-Host $userRe " Does not exist"} }

Hope this helps. And make sure to use an account which has domain admin credentials or at least use an account that could have privileges to set the thumbnailPhoto.

SharePoint - Cross Site Request Forgery (CSRF/XSRF) attacks

Rajeev Buggaveeti — Sun, 15 May 2016 18:03:10 GMT

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.

How does the attack work?

There are numerous ways in which an end user can be tricked into loading information from or submitting information to a web application. In order to execute an attack, we must first understand how to generate a valid malicious request for our victim to execute. Let us consider the following example: Alice wishes to transfer $100 to Bob using the bank.com web application that is vulnerable to CSRF. Maria, an attacker, wants to trick Alice into sending the money to her instead. The attack will comprise the following steps:

building an exploit URL or script
tricking Alice into executing the action with social engineering

GET scenario

If the application was designed to primarily use GET requests to transfer parameters and execute actions, the money transfer operation might be reduced to a request like:

GET https://bank.com/transfer.do?acct=BOB&amount=100 HTTP/1.1

Maria now decides to exploit this web application vulnerability using Alice as her victim. Maria first constructs the following exploit URL which will transfer $100,000 from Alice's account to her account. She takes the original command URL and replaces the beneficiary name with herself, raising the transfer amount significantly at the same time:

https://bank.com/transfer.do?acct=MARIA&amount=100000

The social engineering aspect of the attack tricks Alice into loading this URL when she's logged into the bank application. This is usually done with one of the following techniques:

sending an unsolicited email with HTML content
planting an exploit URL or script on pages that are likely to be visited by the victim while they are also doing online banking

The exploit URL can be disguised as an ordinary link, encouraging the victim to click it:

View my Pictures!

Or as a 0x0 fake image:

If this image tag were included in the email, Alice wouldn't see anything. However, the browser will still submit the request to bank.com without any visual indication that the transfer has taken place. A real life example of CSRF attack on an application using GET was a uTorrent exploit from 2008 that was used on a mass scale to download malware.

POST scenario

The only difference between GET and POST attacks is how the attack is being executed by the victim. Let's assume the bank now uses POST and the vulnerable request looks like this:

POST https://bank.com/transfer.do HTTP/1.1

acct=BOB&amount=100

Such a request cannot be delivered using standard A or IMG tags, but can be delivered using a FORM tag:

This form will require the user to click on the submit button, but this can be also executed automatically using JavaScript:



Other HTTP methods

Modern web application APIs frequently use other HTTP methods, such as PUT or DELETE. Let's assume the vulnerable bank uses PUT that takes a JSON block as an argument:
PUT https://bank.com/transfer.do HTTP/1.1

{ "acct":"BOB", "amount":100 }

Such requests can be executed with JavaScript embedded into an exploit page:



Fortunately, this request will not be executed by modern web browsers thanks to same-origin policy restrictions. This restriction is enabled by default unless the target web site explicitly opens up cross-origin requests from the attacker's (or everyone's) origin by using CORS with the following header:

Access-Control-Allow-Origin: *

COPIED ABOVE EXAMPLE from https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF).

I have few customers who have complained about the app scanner complaining about some of the custom and OOB SharePoint page. So, i decided to test this thoroughly and here is what I have come up with:

When I’d looked at the GET and POST requests,

GET https://sharepoint.com/teams/NA/Shared%20Documents/Forms/AllItems.aspx HTTP/1.1

Accept: */*

Referer: https://sharepoint.com/teams/NA/Lists/Analysis/AllItems.aspx?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSWebPartPage

Response has the below Canary value:

 />

WebForm_InitCallback();var _spFormDigestRefreshInterval = 1440000;

I’d then uploaded a document to the SharePoint library and I could still track the same canary value there too.

POST https://sharepoint.com/teams/NA/_layouts/15/upload.aspx?IsAJAX=1&List={84CB65BE-0E08-4E81-B1BE-65852A651427}&RootFolder=%2Fteams%2FNA%2FShared%20Documents HTTP/1.1

Accept: */*

x-requestdigest: 0x0A54D6ED3EFEF916EB4F223EE3ECAE429FD9A467E32E17EC1904B111462C345CC1BD670569370B7327A7FF4090A81465A5823E9FC2948C351CB1F91499A9832C,12 Mar 2016 18:27:50 -0000

ClientSource: MultiFileUploadDialog

Content-Type: multipart/form-data; boundary=---------------------------7dffe6f15b6

Response:

HTTP/1.1 200 OK

Set-Cookie: FedAuth=77u/PD94bW**************; expires=Tue, 17-Mar-2016 14:42:41 GMT; path=/; secure; HttpOnly

X-AspNet-Version: 4.0.30319

SPRequestGuid: b316f29c-a029-0000-252d-765f0416cabd

X-RequestDigest: 0x471DB2C0D2C3CA58E87CAC38EDFA08F1A63BD03F1A1B454EB5A16886F2BF908AEBDD123F55F0A9C5BE489AF025711D7152A91E00264FB14A77595429F1F4534A,12 Mar 2016 18:28:12 -0000

X-FRAME-OPTIONS: SAMEORIGIN

X-Powered-By: ASP.NET

But the same wasn’t tracked when I loaded adminrecyclebin.aspx
When accessing the home page:
GET https://sharepoint.com/teams/Online/SitePages/Dashboard!.aspx HTTP/1.1

Response has the below canary:



When accessed the adminrecyclebin.aspx page, I see the below traces:

GET https://sharepoint.com/teams/Online/_layouts/15/AdminRecycleBin.aspx HTTP/1.1



We could see that there is no canary value which is sent in the header but the request and response tracked via X-FRAME-OPTIONS: SAMEORIGIN

This explains on why we are seeing the CSRF issues while accessing the SharePoint OOB pages. We don't generate __REQUESTDIGEST values for some SharePoint OOB pages which have no POST actions.

The canary value is already present in a hidden __REQUESTDIGEST form element on every page that uses the SharePoint master page. It is automatically sent with every postback.

If you do not inherit from the SharePoint master page, you must use the Microsoft.SharePoint.WebControls.FormDigest control to write the value into the page. If you are making a web service call, you must get the __REQUESTDIGEST value and include it in the X-RequestDigest HTTP request header, as shown in the following example.

C#

var canaryValue = document.getElementById('__REQUESTDIGEST').value;request.SetRequestHeader("X-RequestDigest", canaryValue);

Ref: https://msdn.microsoft.com/en-us/library/office/gg552614(v=office.14).aspx

SharePoint uses a dynamic canary to ensure that POST requests come from the same domain as the server.

You must do two things on your custom pages and since SharePoint is ASP.NET backed, we've this implemented by default in OOB pages.

	Send the canary with every postback or web service request.
	Validate the canary before acting on the postback or web service request.

So, in your custom application/page which you build in top of SharePoint, ensure that you utilize  control in the master page or the page itself and track the POST requests by utilizing SPUtility.ValidateFormDigest(). This will ensure that the initiator is making the request through the same browser session is making the post back. If the Canary value isn't present or tapered, you would get a 401 Unauthorized error.

Dev Explanation for custom pages is in here:

https://www.codeproject.com/Articles/686881/Hack-Proof-Your-ASP-NET-Applica

https://www.asp.net/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks

If you have any further questions, please comment in here or contact Microsoft Support

SPO/ODB Reference

Rajeev Buggaveeti — Thu, 02 Apr 2015 16:35:49 GMT

OneDrive for Business and OneDrive (NGSC)

SharePoint Online

Website feature Office 365:

Feedback

SharePoint 2013 - Unable to send emails to external email addresses (SharePoint 2013 workflows)

Rajeev Buggaveeti — Tue, 15 Oct 2013 06:06:00 GMT

By default SharePoint Designer workflows creating using SharePoint 2013 Workflows will not sent emails to the external users (email addresses).

When you add a step "Email these users" in workflow and select type an external email address, you will receive a pop-up stating "The selected user(s) may not be valid on the site this workflow is published on. If a recipient is not a valid SharePoint user, he or she will not receive workflow emails."

This is by design behavior with SharePoint 2013 workflows where as the workflows you add from the SharePoint 2013 site (the workflows which are available as soon as you activate the features on the site collection or the site) have no impact as they are SharePoint 2010 workflows. With that said, the designer workflows created using SharePoint 2010 workflows will be working fine (including this functionality).

This is a security enhancement in SharePoint 2013 workflows to enable the users to get approval from the administrators before sending emails to the external users.

How is this implemented?

REST services validation.

For each and every user you add to the "email these users" in the designer creating using SharePoint 2013 workflows, a SOAP request is generated using the webservice (people.asmx) which calls ResolvePrincipals method to find the username. (_vti_bin/people.asmx?op=ResolvePrincipals).

Request:

https://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="https://www.w3.org/2001/XMLSchema" xmlns:soap="https://schemas.xmlsoap.org/soap/envelope/">https://schemas.microsoft.com/sharepoint/soap/">rajbugga@live.com>

All

false

Response:

https://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="https://www.w3.org/2001/XMLSchema">https://schemas.microsoft.com/sharepoint/soap/">rajbugga@live.com-1false />All

MSDN reference: https://msdn.microsoft.com/en-us/library/Microsoft.SharePoint.Utilities.SPUtility.SendEmail.aspx

Here is how you should get this working:

1.Edit the user profile properties in the user profile service application and add this external email address to one of the property. Please plan your user profile properties accordingly so that the next import doesn't override these fields that were updated with the external email address. Finally, run the User Profile to SharePoint full synchronization job which will sync all your site collections user info table with these email addresses.

Please confirm that the users email address is actually resolving the user ID by creating the SharePoint 2013 workflows:). The logic here is to make sure that the site to which you are publishing the workflows recognizes this email address (external). Forthat matter a new user who is in your AD but hasn't been added to the SharePoint site also faces the same problem. That's the reason we are so specific in using "VALID SHAREPOINT USER"

2.We strongly recommend you to use/experience the new Workflow Manager (Workflow Foundation 4.0 for SharePoint 2013) as its more robust and delivers best performance over 2010. (A new feature always has advantages:))

However, if you wanted to use 2010 workflows as well, here is the work around:

a.Create a workflow called Email using SharePoint 2010 workflows on the same list so that you could utilize the fields and then add Email these users step. Select the external email addresses here (SharePoint 2010 workflows doesn't validate user againstREST upon adding).

b.Design your 2013 workflows per your requirement but whenever you have to add a step "Email these users", call the 2010 workflow you just created before.

This way, your 2013 workflow does the job for you and where ever you are calling the 2010 workflow within 2013 that does deliver the emails to the external users also. I have tested this and it works greatly.

Reference: https://blogs.msdn.com/b/sharepointdesigner/archive/2012/08/18/how-to-trigger-a-sharepoint-2010-workflow-from-a-sharepoint-2013-workflow.aspx

This article applies to SharePoint 2013 workflows. (Products: SharePoint 2013 & SharePoint online)

InfoPath -SharePoint 2007/2010/2013/SPO Configuration and troubleshooting

Rajeev Buggaveeti — Wed, 07 Aug 2013 18:12:00 GMT

Update on SharePoint Online - InfoPath forms would work perfectly fine for the following web services without going through any of the following steps: (We are experiencing some issues withe FEW SharePoint Online Tenants. If you are one of them, please hold, we are working on this and expected to have a fix soon). Support kb (https://support.microsoft.com/en-in/kb/2674193) still holds good when you are dealing with other web services. The following web service calls are converted into OM calls and that’s how we are bypassing the DOUBLE HOP issue. I tried using UserProfileService.asmx without having UDCX setup and it works fine. Only requirement is to have the users imported to UserProfiles.

lists.asmx

CheckOutFile
CheckInFile

usergroup.asmx

GetUserCollectionFromGroup
GetUserCollectionFromSite
GetGroupCollectionFromWeb

UserProfileService.asmx

GetUserProfileByName
GetUserPropertyByAccountName
GetCommonManager
GetUserMemberships
GetCommonMemberships

==============================================BELOW CONTENT STILL HOLDS GOOD FOR SHAREPOINT 2010/2013=================================================== SharePoint 2010 has both CLASSIC and CLAIMS based authentication and SharePoint 2013 has CLAIMS mode only (from UI) Reference: https://technet.microsoft.com/en-s/library/cc262350(v=office.14).aspx#section2 As InfoPath forms won’t work on a CLAIMS based web application, we have to follow the below steps to get it working: This holds good for SharePoint Server 2010 and SharePoint Server 2013 Note: Screenshots are based on SharePoint Server 2013 but the same applies to SharePoint Server 2010 too. We need User Profile Service Application to be configured and Secure Store Service Application to be created before following the below steps: Reference: https://technet.microsoft.com/en-us/library/jj219646(v=office.15).aspx Step 1: * Create a new Secure Store Service application "APPID" (Say UPASSS). * Update the fields as per the below picture: (Ticket Timeout depends on org. requirements) * If you don’t choose Target Application Type as Group Ticket, none of the users apart from the user whose credential have been updated in the SSS APPID will be able to access the InfoPath form. This option "Group Ticket" enable us to specify ticket redeemers who usually be domain users. If you don’t select this option "IP will give you a descriptive error" Reference: https://msdn.microsoft.com/en-us/library/ee554863(v=office.14).aspx

* Update the secure store administrator/membership details as per the below screen shot: (again as per your org. requirement)

* Now, you have setup credential for the APPID (UPASSS) which you created above. This will be used to impersonate the user credentials as shown below: (Windows username (Domain\User) and the password should be able to access the https://Site/_vti_bin/userprofileservice.asmx of the respective site).

We have completed setting up the Secure Store Service "APPID" * Make sure that the accounts provided for the Secure Store Service have privileges to retrieve data through User Profile Service Application Step 2: * Create a blank new InfoPath form; add a data connection (https://site/_vti_bin/userprofileservice.asmx) using GetUserProfilebyName by UNCHECKING “Automatically retrieve data when form is opened” * Decide where you want to store your universal data connection (UDC) file. More about UDC: https://msdn.microsoft.com/en-us/library/office/ms772017(v=office.14).aspx * Convert the above created Data Connection (GetUserProfilebyName) as an UDCX file by selecting Relative to site collection or centrally managed and save it. If you chose Relative to Site collection, you have to create a Data Connection library and chose this library while converting the UDCX file above. If you select Centrally Managed, you need to save the UDCX file and upload to the SharePoint Central Admin. Data Connection Library: https://msdn.microsoft.com/en-us/library/office/ms772101(v=office.14).aspx Chose the correct location to save the UDCX files: https://technet.microsoft.com/en-us/library/ff621104(v=office.14).aspx * Download the copy of the UDCX file and edit it as shown below: Working with Data Connections: https://msdn.microsoft.com/en-us/library/office/ms772364(v=office.14).aspx UPASSA’ CredentialType=’NTLM’ /> AppID is the Secure Store Service AppId which was created on Step 1. Credential types explained here: https://msdn.microsoft.com/en-us/library/office/ms772017(v=office.14).aspx#sectionSection1 * Make sure to upload the UDCX file back to the CA or Data connection library and approve it. * Now go to InfoPath form which you have started designing>Data>Form Load rule, add the following 2 rules:

Username() function is available in SPS 2010 only post https://support.microsoft.com/kb/2516485 We are all set to use the form now on claims authentication: * Design your InfoPath form to pull the user profile information as you wish and publish it to the same site (site collection as we are using relative data connection). Troubleshooting: You are likely to face the below issues if you look at the ULS trace with the correlation ID: * A certificate validation operation took ******.**** milliseconds and has exceeded the execution time threshold. Add all Sharepoint Root Authority certificates and the web application SSL certificates (complete Chain) into the Trusted Certification Authorities store on all SharePoint servers and the SharePoint CA. $SPCert = (Get-SPCertificateAuthority).RootCertificate $SPCert.Export(“Cert”) | Set-Content C:\SPCert.cer –Encoding Byte If internet access is disabled, add "127.0.0.1 crl.microsoft.com" to the HOSTS file on each server Setup DisableLoopbackCheck value to 1 on all the WFEs https://support.microsoft.com/kb/896861); Add HOST file entry on each WFE in the farm pointing to itself to avoid the double hop issue. This applies to all the web applications that host the InfoPath form services and are making use of the web services. Ex: Site: https://site.contoso.com Host entry: 127.0.0.1 site.contoso.com * Data adapter failed during OnLoad: The remote server returned an error: (500) Internal Server Error. A user with the account name system could not be found. ---> An error was encountered while retrieving the user profile. UserCannotBeFoundAn error was encountered while retrieving the user profile. This happens when the account that you are trying to use is a SYSTEM ACCOUNT (due to name space query) / an account that cannot be found. * The following data connection (GetUserProfileByName) has exceeded the maximum configured time limit. This threshold can be configured by using the SPIPFormsService -MaxDataConnectionRoundTrip PowerShell commandlet. This error is misleading sometimes as it can occur if we have proxy in IE or web.config The following query failed: GetUserProfileByName (User: 0#.w|rajeev\administrator, Form Name: Repro-sp2013, IP: , Connection Target: https://sp2013-1r/DCL/GetUserProfileByName.udcx, Request: https://sp2013-1r/_layouts/15/FormServer.aspx?XsnLocation=https://sp2013-1r/Reprosp2013/Forms/template.xsn&SaveLocation=https://sp2013-1r/Reprosp2013&ClientInstalled=false&DefaultItemOpen=1&Source=https://sp2013-1r/Reprosp2013/Forms/AllItems.aspx, Form ID: urn:schemas-microsoft-com:office:infopath:Repro-sp2013:-myXSD-2013-07-09T06-28-47 Type: DataAdapterException, Exception Message: Authentication information in the UDC file could not be used for this connection because user forms are not allowed to use UDC authentication. To change this settings, use the InfoPath Forms Services configuration page in SharePoint Central Admin.) Both the above settings have to be changed on the CA site. Go to the Configure InfoPath Forms Services section and enable Allow user form templates to use authentication information contained in data connection files and tweak the Data Connection Timeouts * InfoPath also depends on the State Service and you may see the below error while opening the form: Form render failed because the user's session was closed StackTrace:at Microsoft.Office.InfoPath.Server.Controls.XmlFormView.RenderForm(HtmlTextWriter writer)at Microsoft.Office.InfoPath.Server.Controls.XmlFormView.RenderContents(HtmlTextWriter writer Please check the state service database and make sure that the InfoPath is able to use it. You can get the specific error details by getting verbose ULS logs. Explained: https://technet.microsoft.com/en-us/library/ee704548(v=office.14).aspx * Form load issues (performance) is mostly due to the amount of data retrieved by the data connection from SharePoint while the form is opened (in Browser or client). We’ve made enough enhancements in SharePoint 2013 and are still making changes to enhance performance. So, speaking from SharePoint stand point, we need to be within the software guidelines: https://technet.microsoft.com/en-us/library/cc262787(v=office.15).aspx * InfoPath Forms Services do not work when you switch to a claims-based Web application that uses forms-based authentication or Security Assertion Markup Language (SAML) security tokens. These features do not work because claims-based authentication does not generate a Windows security token, which is necessary for these features. reference: https://technet.microsoft.com/en-us/library/hh706161.aspx SAML include - ADFS, Site Minder, Oracle, AD LDS, Okta etc.,. * We could get UserProfileService.asmx working with SAML ONLY when you are using the InfoPath Rich Client (Filler) but doesn't work when you are using BROWSER based forms. To get this working in a web app which is using SAML authentication, you have to import users in the UserProfile Service Application with the same format. Ex: If you search for a user in your userprofile service application, you usually see users account name as domain\user but to get this working, make sure to create a new sync connection with you SAML Authentication and set the CLAIM USER IDENTIFIER to your SAML in user properties.

Ps: Always try with a user account to test the behavior.

Creating Connected Web parts in SharePoint

Rajeev Buggaveeti — Thu, 25 Apr 2013 13:52:00 GMT

Recently I have come across a situation where we need a page which should be divided into 2 parts where one half should have items and based on the item selection, you should get the details (Just like a HTML frame). Most of us will come across this situation and this will be handy and simple too in SharePoint without any coding or customization using SPD or VS

Example: when you select the Item1 you should see the Details of the item1. This should be dynamic that the items and the details should be rendered from a different location (say SharePoint lists)

We can achieve this scenario by using the connected webparts.

For this, you need 2 lists with at least one identical filed. In this scenario, I have created 2 lists (Items and Details)

Items list has the following items in it:

Details list has the following items in it:

Now, if you look at the lists, I have Title filed in common. Based on this I am going to create a connection between these 2 lists.

First, to have a great view, lets create 2 list web parts on a page and add these 2 lists (Items and Details) as shown below.

Now on the items web part you see the below menu:

Actions available in connected webparts are explained here:https://office.microsoft.com/en-us/sharepoint-server-help/connect-data-in-web-parts-HA101785157.aspx

In this case I am using Send Row of Data To (I am using this option on Items list so, selecting an item in the items list should return the corresponding information from details).

You can also use Get Filter Values From but this has to be used on Details web part as we will get the details based on the items selected.

After selecting the Details

I have configured Connection as per the below screen shot:

We have completed creating the connected web parts. Now, if you keep updating Items and Details lists provided that the list items created have a corresponding unique identifier (in this case Title), the web parts would render the information as expected.

You could see below that I selected Test which returned Rajeev1 from details as Rajeev1 item has Title value as Test in the details list.

You could create and customize the exiting web parts using Visual Studio or SharePoint Designer to change the look and feel according to your requirement.

Configuring User Profile Service and BCS

Rajeev Buggaveeti — Fri, 12 Apr 2013 18:12:00 GMT

Recently I have come across a situation where we need to configure SharePoint user profile synchronization to pull the Information from the BCS (Business Continuity Service) (External Data).

The challenge was to pull the Information based on a custom attribute that was created in UPA service application which pulls the information from AD.

We've a wonderful video available on TechNet which will make your life easier when you have to play around UPA-BCS connection strings.

Video: https://www.microsoft.com/resources/technet/en-us/office/media/video/video.html?cid=stc&from=mscomSTC&videoid=ede7d855-035c-47a9-9492-1c2a23614a4a

This video explains you to create a BCS connection in User Profile Service application using the out of box AccountName which is what everyone use. But there are cases where the need be to use Custom attribute which is what we will discuss here.

Create a new user property in the User Profile Service Application called Custom and map it with the Active Directory attribute (which may be any attribute that has the required value, using this value you will pull all the users/data from external system)

I have mapped my Custom attribute in User Profile Properties page to a AD attribute called language

All the users in my AD have an attribute called language whose values are unique and should be unique to be able to pull the right information pertaining to the user.

Make sure you do an incremental import for the custom attribute to be appeared in your user profiles.

I have a SQL database which has the below information:

Now while creating a new BCS sync connection (follow the video to create new sync connection and mappings) Choose the CUSTOM attribute we've created by selecting the 1:1 mapping. We are almost done now. Just to confirm that we are able to pull the Information from the external data source, create a new user profile property in SharePoint which will retrieve the BCS data (Say property name as BCS-col2data, map it with the BCS connection and pull Col2 field from the database).

Now start another incremental import. AD import should be quick but the BCS import may take time depending upon the number of profiles to be imported and mapped to SharePoint from external data source.

Finally you should be able to see all the Information in the User Profiles (including the value that you've pulled from the BCS).

Note: Since the video has all the steps (including creating BCS profile using SharePoint Designer and mappings, I have only explained the CUSTOM property mapping).

Unable to load workflow actions from the server. Please contact your server administrator

Rajeev Buggaveeti — Fri, 12 Apr 2013 17:09:50 GMT

When you try to open the workflows in the SharePoint Designer, you receive the below error:

Symptoms: You can access the workflow from the SharePoint UI. Other workflows in different web applications are editable.

Cause: Cannot be same in all the scenarios but should be specific to the features

Capture a fiddler trace while opening the SharePoint designer and you should see a 505 error with the below error tag:

Failed to find the XML file at location
'14\Template\Features\custom solution\feature.xml' xmlns="https://schemas.microsoft.com/sharepoint/soap/">0x80131600

This is due to the feature which is not available at '14\Template\Features'. If you have a custom solution whose web parts are placed in a web site and the solution files are missing or the solution is retracted, you see this error.

Solution: Remove the web parts that the solution adds to a site collection using PowerShell/code or deploy the solution back to the farm to get the feature.xml.