Rodney Viana's (MSFT) Blog

Adapting to the caller namespace soap 1.1 request in classic asmx via Filter

Rodney Viana - MSFT - DSI Team — Wed, 28 Nov 2012 02:57:11 GMT

I had received a somewhat odd request to produce a proof-of-concept application to enable a classic asmx Web Services to accept any namespace in the soap 1.1 request and to return the same namespace to the caller. To understand the problem let us review the soap 1.1 requirement on what it matters. The Soap Action comes as an Http header SoapAction containing the namespace and the operation. In the body the operation is one of the elements in the soap body with the namespace of the service.

This is the sample web services used to test the proof of concept:

           [WebService(Namespace = "http://MyNameSpace.com")]               
 [WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]              
public class NoNameSpace : System.Web.Services.WebService { 
                public NoNameSpace () {  
    } 
                [WebMethod]               
    public string HelloWorld(string Name) {               
        return String.Format("Hello {0}", Name);               
    }

Table 1 – Code for the service using namespace http://MyNameSpace.com

That is a correct soap 1.1 request. Notice that the soap action is the namespace and operation and the HelloWorld element uses the namespace:

01:POST /NoNameSpace.asmx HTTP/1.1           
02:Host: localhost             
03:Content-Type: text/xml;             
04:charset=utf-8             
05:Content-Length: length             
06:SOAPAction: "http://MyNameSpace.com/HelloWorld"             
07:             
08:<?xml version="1.0" encoding="utf-8"?>              
09:<soap:Envelope                
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"               
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"               
    xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">               
10:<soap:Body>               
11:     <HelloWorld xmlns="http://MyNameSpace.com">               
12:          <Name>string</Name>              
13:      </HelloWorld>              
14:  </soap:Body>              
15:</soap:Envelope>

Table 2 – Typical raw soap request with headers and body

The response will include the HellowWorldResponse element with the namespace used by the service.

01:HTTP/1.1 200 OK             
02:Content-Type: text/xml;             
03:charset=utf-8             
04:Content-Length: length             
05:             
06:<?xml version="1.0" encoding="utf-8"?>               
07:               
08:<soap:Envelope                
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    
     xmlns:xsd="http://www.w3.org/2001/XMLSchema"               
     xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">               
09:   <soap:Body>               
10:     <HelloWorldResponse xmlns="http://MyNameSpace.com">               
11:      <HelloWorldResult>string</HelloWorldResult>  
11:    </HelloWorldResponse>               
12:   </soap:Body>               
13:</soap:Envelope>

Table 3 – Raw soap response from request in Table 2

In customer’s scenario they had some clients consuming their web services using some soap tool he could not identify that always sent the target URL as the namespace. Though they could change the namespace to always match their final production environment URL, they do not want to have to change the namespace if they decide to use another URL in production.

I strongly advised them to use the target namespace solution as it will the solution causing less overhead. They requirements were very clear though. I asked them some time to develop a proof-of-concept filter to:

Intercept the original call and verify the SoapAction header to verify if the namespace matches the expected web services namespace (see Table 2 row 6)
If the namespace matches, nothing else to do, just process the request without the overhead of filtering
If the namespace does not match, separate the incoming namespace and operation, save values for later use
Replace the SoapAction header to include the web services expected namespace and operation (see Table 2 row 6)
Add a request stream filter to replace the namespace of the operation element to match the expected namespace (see Table 2 row 11)
Add a response stream filter to replace the response namespace to match the original incoming namespace as it is what the consumer client is expecting
The response element is by default the soap action + Response (see Table 3 row 10)

For example, this is a request in customer’s environment:

01:POST /NoNameSpace.asmx HTTP/1.1           
02:Host: localhost             
03:Content-Type: text/xml;             
04:charset=utf-8             
05:Content-Length: length             
06:SOAPAction: "http://10.10.8.5:9000/HelloWorld"             
07:             
08:<?xml version="1.0" encoding="utf-8"?>              
09:<soap:Envelope                
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"               
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"               
    xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">               
10:<soap:Body>               
11:     <HelloWorld xmlns="http://10.10.8.5:9000">               
12:          <Name>string</Name>              
13:      </HelloWorld>              
14:  </soap:Body>              
15:</soap:Envelope>

Table 4 – Request with invalid namespace in both SoapAction header and element HelloWorld in the soap body

Please notice that both soap action (row 6) and namespace (row 11) come as the URL used to access the service, not the real namespace specified in the service wsdl. The input filter will bring the request in Table 4 to the same state as request in Table 2 before reaching the web service.

The response from the web service will be as Table 3 including the actual namespace not the namespace sent in the request. The output filter will transform the correct namespace into the incoming namespace as shown below:

01:HTTP/1.1 200 OK             
02:Content-Type: text/xml;             
03:charset=utf-8             
04:Content-Length: length             
05:             
06:<?xml version="1.0" encoding="utf-8"?>               
07:               
08:<soap:Envelope                
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    
     xmlns:xsd="http://www.w3.org/2001/XMLSchema"               
     xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">               
09:   <soap:Body>               
10:     <HelloWorldResponse xmlns="http://10.10.8.5:9000">               
11:      <HelloWorldResult>string</HelloWorldResult>  
11:    </HelloWorldResponse>               
12:   </soap:Body>               
13:</soap:Envelope>

Table 5 – Raw soap response after adjusting namespace to match incoming namespace request (see row 10)

The best way to implement the logic, as it is classic asmx is in the Global.asax. I have just added a Global.asax to the project and changed the code inside to the listing below:

<%@ Application Language="C#" %>               
<%@ Import Namespace="System.Text" %>               
<%@ Import Namespace="System.IO" %>               
<%@ Import Namespace="System.Xml" %>             
                       <script runat="server"> 
                //The code samples are provided AS IS without warranty of any kind.                
    // Microsoft disclaims all implied warranties including, without limitation,                 
    // any implied warranties of merchantability or of fitness for a particular purpose. 
                           /*
                           The entire risk arising out of the use or performance of the sample scripts and documentation remains with you.                
    In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts                 
    be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption,                 
    loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts                 
    or documentation, even if Microsoft has been advised of the possibility of such damages.
                           */  
                           // Change this string to the string used in your web services namespace. Do not include "/" at the end.               
    const string NAMESPACE = "http://MyNameSpace.com";               
    void Application_Start(object sender, EventArgs e)               
    {               
        // Code that runs on application startup 
                }              
    void Application_End(object sender, EventArgs e)               
    {               
        //  Code that runs on application shutdown 
                } 
                void Application_BeginRequest(object sender, EventArgs e)               
    {               
        HttpContext ctx = HttpContext.Current;               
        // Soap Action comes in the Http Header SoapAtion                
        // Ex.: SoapAction: "http://MyNameSpace.com/HelloWorld"               
        string tempAction = ctx.Request.Headers["SoapAction"];               
        // Soap action is normally surrounded by quotes so we are removing for this operation temporary string. We are not changing SoapAction yet               
        string soapAction = String .IsNullOrEmpty(tempAction) ? null : tempAction.Replace("\"", ""); 
                    // If there is no Soap Action in the call and the namespace is coming as expected, do not bother to filter anything              
        if (!String .IsNullOrEmpty(soapAction) && !soapAction.StartsWith(NAMESPACE))               
        {               
            // In the end "ns" will contain the namespace as coming from the caller                
            // "operation" will contain only the operation without the namespace                 
            // For example: SoapAction: "http://roguenamespace.local/HelloWorld"                
            //  will be split so that: ns=http://roguenamespace.local and operation=HelloWord                
            // If the namespace is not matching the expected namespace and the operation is not matching the right operation                 
            //    the webservices will not work.                 
            // For the scenario above, the expected Class and Method definition are:                 
            //                 
            //  [WebService(Namespace = "http://roguenamespace.local")]                
            //  [WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]                 
            //  public class NoNameSpace : System.Web.Services.WebService                 
            //  (...)                 
            //       [WebMethod]                 
            //       public string HelloWorld(string Name)        
            //               
            string ns=NAMESPACE;               
            string operation=soapAction; 
                        int i=soapAction.LastIndexOf('/');               
            if(i>=0 && i< soapAction.Length)               
            {               
                try               
                {                
                    operation = soapAction.Substring(i+1);               
                    ns = soapAction.Substring(0,i);               
                    //               
                    // We verified that the incoming namespace is not matching the expected namespace before,                
                    //  now we are going to adapt the SoapAction header to include the expected namespace and the intended operation                 
                    //               
                    ctx.Request.Headers["SoapAction"] = String.Format("\"{0}/{1}\"", NAMESPACE, operation);               
                }               
                catch (Exception ex)               
                {               
                    ctx.Request.Headers["SoapAction"] = String.Format("{0}<br />{1}", ex.Message, ex.StackTrace);               
                }               
            }               
            else               
            // Since we are sure by the inner if that SoapAction is not empty or null you can assign directly.                
            // This code only runs if there is a SoapAction without namespace - SoapAction: "HelloWorld"               
            {               
                operation = ctx.Request.Headers["SoapAction"] = String.Format("\"{0}/{1}\"", NAMESPACE, operation);               
            }               
            //                
            //  Add original soap action to change the response as well                 
            //  This item will be included in the Http Context items and can be tested in your code later                 
            //    if you need to make decisions based on any of them                 
            //               
            ctx.Items.Add(NAMESPACE, new string[]{ operation, ns }); 
                        try               
            {               
                // Now we will create a filter that will change the incoming namespace for the operation with the intended namespace (in NAMESPACE const)                
                //   in the message body                 
                // For example:                 
                // This request contains the invalid namespace http://roguenamespace.local in soap body element HelloWorld                
                //   This filter will change the xmlns attribute to match the expected namespace to the one in NAMESPACE const               
                //                
                //<?xml version="1.0" encoding="utf-8"?>                 
                //<soap:Envelope (...)">                 
                //  <soap:Body>                 
                //    <HelloWorld xmlns="http://roguenamespace.local"> ===> Will become ==> <HelloWorld xmlns="http://MyNameSpace.com">                
                //      <Name>string</Name>                 
                //    </HelloWorld>                 
                //  </soap:Body>                 
                //</soap:Envelope>                 
                //               
                FilterNameSpace stream = new FilterNameSpace(ctx.Request.Filter);               
                stream.SetChange(soapAction, NAMESPACE, operation, false);               
                ctx.Request.Filter = stream;               
                // We are also making sure the response will return the same rogue namespace send by the caller                
                // See details in the method SetResponseFilter               
                SetResponseFilter(); 
                        }              
            catch               
            {               
                ctx.Request.InputStream.Position = 0; // Reset position if error happens               
                return;               
            }               
            if (String.IsNullOrEmpty(ns))               
            { 
                        }              
            else               
            {               
            }               
        } 
                } 
                void SetResponseFilter()               
    {               
        // We will add a filter to change the correct namespace in the response to the caller rogue namespace                
        // The response element, by default, is the operation name + Response.                 
        // In this sample the element is HelloWorldResponse                 
        //                 
        //  The change will look like that (only the changed line):                 
        //                 
        //    <HelloWorldResponse xmlns="http://MyNameSpace.com"> ===> Will become ===> <HelloWorldResponse xmlns="http://roguenamespace.local">               
        HttpContext ctx = HttpContext.Current;               
        if (ctx.Items.Contains(NAMESPACE))               
        {               
            string[] reqinfo = ctx.Items[NAMESPACE] as string[];               
            if (reqinfo == null || reqinfo.Length < 2) return;               
            string opResp = String.Format("{0}Response", reqinfo[0]);               
            string ns = reqinfo[1];               
            FilterNameSpace outfilter = new FilterNameSpace(ctx.Response.Filter);               
            outfilter.SetChange(NAMESPACE, ns, opResp, true); 
                        ctx.Response.Filter = outfilter;                
        } 
                } 
                void Application_PostRequestHandlerExecute(object sender, EventArgs e)               
    {               
        // Code that runs when an unhandled error occurs 
                } 
                void Session_Start(object sender, EventArgs e)               
    {               
        // Code that runs when a new session is started 
                } 
                void Session_End(object sender, EventArgs e)               
    {               
        // Code that runs when a session ends.                
        // Note: The Session_End event is raised only when the sessionstate mode                 
        // is set to InProc in the Web.config file. If session mode is set to StateServer                 
        // or SQLServer, the event is not raised. 
                }
                class FilterNameSpace : Stream               
    { 
                    protected Stream inputStream;               
        protected Stream sinkStream;               
        protected bool changed;               
        protected string newNameSpace;               
        protected string originalNS;               
        protected string operation;               
        protected StringBuilder strOutput;               
        protected bool canWrite;               
        public FilterNameSpace(Stream Sink)               
        {               
            sinkStream = Sink;               
            changed = false;               
        } 
                    public void SetChange(string OriginalNameSpace, string NewNameSpace, string Operation, bool CanWrite)               
        {               
            originalNS = OriginalNameSpace;               
            newNameSpace = NewNameSpace;               
            operation = Operation;               
            inputStream = new MemoryStream();               
            canWrite = CanWrite; 
                    }              
        public void DocumentStream()               
        {               
            if(changed) return;               
            XmlDocument doc = new XmlDocument();               
            inputStream.Position = 0;               
            if (canWrite)               
                doc.Load(inputStream);               
            else               
                doc.Load(sinkStream);               
            System.Xml.XmlNodeList nodes = doc.GetElementsByTagName(operation);               
            if (nodes.Count > 0)               
            {               
                string prefix = nodes[0].GetPrefixOfNamespace(newNameSpace);               
                nodes[0].Attributes["xmlns"].Value = newNameSpace; 
                        }              
            changed = true;               
            inputStream.Position = 0;               
            if (canWrite)               
                doc.Save(sinkStream);               
            else               
                doc.Save(inputStream);               
            inputStream.Position = 0;               
        }               
        public override bool CanRead               
        {               
            get { return true; }               
        } 
                    public override bool CanSeek               
        {               
            get { return false; }               
        } 
                    public override bool CanWrite               
        {               
            get { return true; }               
        } 
                    public override long Length               
        {               
            get {               
                DocumentStream();               
                return inputStream.Length;               
            }               
        } 
                    public override long Position               
        {               
            get { return inputStream.Position; }               
            set { throw new NotSupportedException(); }               
        } 
                    public override int Read(byte[] buffer, int offset, int count)               
        {               
            DocumentStream();               
            int c = (int)((long)count > inputStream.Length ? inputStream.Length : (long)count);               
            c=inputStream.Read(buffer, offset, count);              
              
            return c;               
        } 
                    public override long Seek(long offset, System.IO.SeekOrigin direction)               
        {               
            throw new NotSupportedException();               
        } 
                    public override void SetLength(long length)               
        {               
            throw new NotSupportedException();               
        } 
                    public override void Close()               
        {               
            inputStream.Close();               
            sinkStream.Close();               
        } 
                    public override void Flush()               
        {               
            DocumentStream();               
            inputStream.Flush();               
            sinkStream.Flush();               
        } 
                    public override void Write(byte[] buffer, int offset, int count)               
        {               
            inputStream.Write(buffer, offset, count);               
        } 
                }              
</script>

Table 6 – Code to accomplish the namespace substitution

Troubleshooting Claims to Windows NT Token Service (c2WTS) in SharePoint 2010 may be difficult if you don’t know where to start

Rodney Viana - MSFT - DSI Team — Wed, 20 Jul 2011 02:29:36 GMT

I have been writing some blogs entries (and even a Microsoft KB) about c2WTS, but the subject never exhausts. I was helping two different customers to troubleshoot issues with SharePoint Excel Services. In one of the cases the problem happened randomly and the error message was saying that the request to the external data (SQL) had failed because the request did not include a valid Kerberos header, but no reference to c2WTS in the ULS logs.

The other case was that some users could access Excel Services while others could not, this time there was an error in ULS logs pointing to access denied in c2WTS. Without explaining the internals of these two cases, one can say that in both cases c2WTS was working as expected but some other factor was impairing its use with SharePoint.

Before pointing at c2WTS as culprit of some SharePoint access error, look for these three tags in the ULS logs: g8g7, fvx8 or bz7l in Claims Authentication category (Medium).

This ULS entry would look like this:

07/14/2011 14:33:34.03 w3wp.exe (0x1144)0x1960 SharePoint Foundation Claims Authentication bz7l Medium
SPSecurityContext.WindowsIdentity: Could not retrieve a valid windows identity for NTName='CONTOSO\jdoed', UPN='jdoed@contoso.com'. UPN is required when Kerberos constrained delegation is used. Exception: System.ServiceModel.Security.SecurityAccessDeniedException: Access is denied.    Server stack trace:
at System.ServiceModel.Channels.ServiceChannel.ThrowIfFaultUnderstood(Message reply, MessageFault fault, String action, MessageVersion version, FaultConverter faultConverter)
at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc& rpc)
at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)    Exception rethrown
at [0]:
at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
at Microsoft.IdentityModel.WindowsTokenService.S4UClient.IS4UService_dup.UpnLogon(String upn, Int32 pid)
at Microsoft.IdentityModel.WindowsTokenService.S4UClient.<>c__DisplayClass1.<UpnLogon>b__0(IS4UService_dup channel)
at Microsoft.IdentityModel.WindowsTokenService.S4UClient.CallService(Func`2 contractOperation)
at Microsoft.SharePoint.SPSecurityContext.GetWindowsIdentity().

SharePoint uses c2WTS to transform a claim identity into a valid Windows Identity Token. You cannot (for now) send a request to SQL Server or other data sources passing the claim. So, for internal users in Active Directory the claim will be mapped to a Windows Identity Token and that token will be used to access the resource. Since c2WTS only requires the UPN to generate a token, by default no one can access the service. To allow access you have to edit the .config file to add the groups and users to the allowed callers section.

SharePoint installs c2WTS as part of its pre-requisites as c2WTS is actually part of Windows Identity Foundation SDK. The configuration happens when you add the correspondent service in the farm. If everything is alright the service will be configured to start automatically (read my previous post on dependencies) under SYSTEM\NT AUTHORITY and will add the SharePoint local group WSS_WPG to the list of allowed groups in c2WTS. When adding SharePoint Excel Services, the domain account provided needs to be able to create Windows tokens in the c2WTS machine (the service only works with local requests) and it will be added automatically to WSS_WPG by SharePoint (you don’t have to do this). All this actions are necessary since once accessing the service you can impersonate a user by simply supplying the UPN claim. The input is the UPN string. The return is the (limited) Windows Token or an error.

Testing c2WTS configuration is not possible without some code. You have to be logged (or impersonating) an account that has rights to c2WTS. I suggest the account you used for Excel Services. To test using the same method that SharePoint does, you only need to call this static class in c2WTS:

WindowsIdentity wi = S4UClient.UpnLogon("rviana@contoso.com");

This static method will use WCF net.pipe (only local) to communicate with the real c2WTS service (I blogged about net.pipe and real pipes in a previous post). The full test of the complete configuration is a bit more complex. I have put together a sample application to perform all tests I could remember. The App looks like:

Quick Instructions:

Start the Application as Administrator. If you want to impersonate Excel Account, change “User Login” to enable the Password field. By default the user will be the account running the application. If you want to continue with the interactive user, you will not need to enter password. For UPN you can enter any valid UPN claim (normally user@domain), if you want to test your own account you can choose to get UPN from logged user. If you want to impersonate another user or test if the current user can obtain tokens, please enter the UPN manually.

Full Result:

Testing Service c2WTS
+- Service c2WTS found
+- Service c2WTS is running
+- Path of service: C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe
+- Config File: C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config
+- Service Logon: SYSTEM\NT AUTHORITY
----- start of config file ----
<?xml version="1.0"?>
<configuration>
<configSections>
    <section name="windowsTokenService" type="Microsoft.IdentityModel.WindowsTokenService.Configuration.WindowsTokenServiceSection, Microsoft.IdentityModel.WindowsTokenService, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
</configSections>
<startup>
    <supportedRuntime version="v4.0" />
    <supportedRuntime version="v2.0.50727" />
</startup>
<windowsTokenService>
    
    <allowedCallers>
      <clear />
      <add value="WSS_WPG" />
    </allowedCallers>
</windowsTokenService>
</configuration>
----- end of config file ----
Retrieving security groups/users allowed to use the service from config file
+- WSS_WPG
Trying to login .........
Using current Windows Credentials
c2WTS Service provided a valid Windows Token for: CONTOSO\cpajaro
Now Verifying if user CONTOSO\rviana has rights on c2WTS
+- User CONTOSO\rviana has access rights per group/user WSS_WPG. Other groups will not be checked
*** Analysis Complete ***

You can download source and EXE here:

http://rodneyviana.codeplex.com/releases/view/19103

Please notice that since this is supposed to mimic SharePoint 2010, the App is 64-bits. Also be aware this application is provided “AS IS” with no guarantees. You need to accept the license to use it.

Console Application to discover Effective Named Pipe Path of a WCF net.pipe Endpoint

Rodney Viana - MSFT - DSI Team — Wed, 23 Mar 2011 23:17:03 GMT

As I have promised in my previous post, I am making available a C++ console application to troubleshoot named pipes endpoints in WCF. Below is a screenshot of the application:

Application logic:

It gets the endpoint from the command line and substitute the host name by +, * depending on the wildcard mode.
It then add a “/” to the end if not present already and transform to up case all characters of pipe and path
If the size of the resulting string is bigger than 128 characters a hash is applied to the resulting string (not implemented)
The final name is net.pipe:E + Base64 of string generated in item 2 or net.pipe:H + Base64 of string generated in item 3 if uri is bigger than 128 characters

Post detailing the problem:

http://blogs.msdn.com/b/rodneyviana/archive/2011/03/22/named-pipes-in-wcf-are-named-but-not-by-you-and-how-to-find-the-actual-windows-object-name.aspx

Source Code is as shown below (subject to this license: http://rodneyviana.codeplex.com/license).

// ReadMemory.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"

void NormalizeEndPoint(const std::wstring &source, std::wstring& normal)
{
normal.assign(source);

    if(!normal.compare(0, 10, L"net.pipe://"))
    {
        normal.clear();
        return;
    }

int hoststart = normal.find_first_of(L"//");
int hostend = normal.find(L"/", hoststart+2);

    std::wstring ending(normal.substr(hostend));
    std::wstring starting(normal.substr(0, hoststart).append(L"//+"));
    std::transform(ending.begin(), ending.end(), ending.begin(), (int(*)(int))std::toupper);
    std::wstring normalized(starting.append(ending));
    if(normalized.substr(normalized.length()-1).compare(L"/"))
    {
        normalized.append(L"/");
    }

    normal.assign(normalized);
    return;

}

void ShowSyntax(bool SyntaxError)
{
    std::wprintf(L"ReadMemory version 1.0\n");
    std::wprintf(L"Written by Rodney Viana - http://blogs.msdn.com/rodneyviana\n");
    std::wprintf(L"\n");
    if(SyntaxError)
        std::wprintf(L"Syntax Error\n\n");

    std::wprintf(L"Syntax:\n");
    std::wprintf(L"ReadMemory <PipeNameEndPoint> | -file <MappedMemoryFile>\n");
    std::wprintf(L"Where:\t<PipeNameEndPoint> is a endpoint for a net.pipe in WCF in\n\t the format net.pipe://host/path\n");
    std::wprintf(L"\t<MappedMemoryFile> is a memory mapped file\n");
    std::wprintf(L"\n");
    std::wprintf(L"Examples\n");
    std::wprintf(L"\tReadMemory net.pipe://localhost/Service/Service1\n");
    std::wprintf(L"\tReadMemory -file \"net.pipe:EbmV0LnBpcGU6Ly8rLzhFNjFFRUM5LUYxOUEtNEIxNy04REE4LTM5NTc1QzhGMTU4QS8=\"\n");

}

int _tmain(int argc, _TCHAR* argv[])
{
    if(argc < 2)
    {
        ShowSyntax(false);
        return 0;
    }

    if(argc > 3)
    {
        ShowSyntax(true);
        return 1;

}

    std::wstring original;
    std::wstring normalized;
    std::wstring mapFile;

    if(argc == 2)
    {
        original.append(argv[1]);
        NormalizeEndPoint(original, normalized);
        std::wprintf(L"\nOriginal Endpoint: %s", original.c_str());

std::wprintf(L"\nNominal Endpoint: %s", normalized.c_str());

char base64A[1000];

        CW2A ansiNormal(normalized.c_str());
        int size = 1000;

        Base64Encode((BYTE*)ansiNormal.m_psz, normalized.length(), base64A, &size, ATL_BASE64_FLAG_NOCRLF | ATL_BASE64_FLAG_NOPAD );

base64A[size]='=';
base64A[size+1]='\0';

CA2W base64W(base64A);

mapFile.append(L"net.pipe:E");
mapFile.append(base64W.m_psz);

}

    if(argc == 3)
    {
        std::wstring force(argv[1]);
        std::transform(force.begin(), force.end(), force.begin(), (int(*)(int))std::toupper);
        if(!force.compare(0, 4, L"-FILE"))
        {
            ShowSyntax(true);
            return 2;
        }

mapFile.append(argv[2]);

}

//original.append(L"net.pipe://localhost/TradeService/Service1");

std::wprintf(L"\nMapped Memory Object Name: %s", mapFile.c_str());

    HANDLE map = OpenFileMapping(FILE_MAP_READ, FALSE, mapFile.c_str());
    MEMORY_BASIC_INFORMATION mi;
    if(map)
    {
        std::wprintf(L"\nGood News: Mapped memory Object was found. It shows that Host is enabled.");

PVOID contents = MapViewOfFile(map, FILE_MAP_READ, 0, 0, 0);
SIZE_T s = VirtualQuery(contents, &mi, sizeof(mi));

        if(s<sizeof(GUID)+4)
        {
            std::wprintf(L"\nMapped memory Object seems to be corrupted. Restart your WCF Host.\n");
        }

        PBYTE bytes = ((PBYTE)contents)+4;

std::wprintf(L"\nRaw Bytes:\n");

        if(contents)
        {
            for(SIZE_T i=0;i<sizeof(GUID);i++)
            {
                printf("%02x ", *(bytes+i));
            }

            std::wprintf(L"\n");

            for(SIZE_T i=sizeof(GUID);i<s-4;i++)
            {
                printf("%02x ", *(bytes+i));
            }

            GUID *guid = (GUID*)bytes;
            RPC_WSTR guidStr;

            UuidToString(guid, &guidStr);
            std::wprintf(L"\nActual Named Pipe Name: %s", guidStr);
            std::wprintf(L"\nFull Named Pipe Name: \\Device\\NamedPipe\\%s", guidStr);

            std::wstring localPipe(_T("\\\\.\\pipe\\"));
            localPipe.append((LPWSTR)guidStr);

std::wprintf(L"\nAttempting to connect to Named Pipe for 20 seconds ...\n");

            if(!WaitNamedPipe(localPipe.c_str(), 20000))
            {
                std::wprintf(L"\nBad News: Unable to connect to local pipe: %s.\nReason: Time out.", localPipe.c_str());

            } else
            {
                std::wprintf(L"\nGood News: Local pipe \"%s\" is alive.", localPipe.c_str());

                HANDLE pipe;

std::wprintf(L"\nAttempting to open Named Pipe...\n");

pipe = CreateFile(localPipe.c_str(), GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, 0, NULL);

                if(pipe == INVALID_HANDLE_VALUE)
                {
                    std::wprintf(L"\nBad News: Unable to open local pipe: %s.\nLast Error: %i.", localPipe.c_str(), GetLastError());
                } else
                {
                    std::wprintf(L"\nGood News: Named Pipe opened successfully.\n");

TCHAR* send = L"<bad><\\bad>\n";
DWORD bytesUsed;

                    if(!WriteFile(pipe, (void*)send, wcslen(send)*sizeof(TCHAR), &bytesUsed, NULL))
                    {
                        std::wprintf(L"\nBad News: Unable to send bytes.\n");

                    } else
                    {
                        std::wprintf(L"\nGood News: Pipe accepted bytes\n");
                        std::wprintf(L"\nTest completed successfully!\n");

                    }
                    CloseHandle(pipe);
                }

}

        } else
        {
            std::wprintf(L"\nBad News: Host is not informing pipe id.");

        }
        UnmapViewOfFile(map);
    } else
    {
        std::wprintf(L"\nBad News: Mapped File %s was not found. LastError: %x", mapFile.c_str(), GetLastError());

    }

    CloseHandle(map);
    std::wprintf(L"\n");
    return 0;
}

Download the project/executable here:

WCF Named Pipes Identification

Named Pipes in WCF are named but not by you (and how to find the actual windows object name)

Rodney Viana - MSFT - DSI Team — Wed, 23 Mar 2011 00:54:00 GMT

If Windows Communication Foundation (WCF) implementation has its own idiosyncrasies, named pipes provider is the champion. First, let’s start with the name of the provider. Named Pipes in Windows can be used to communicate between process on the same machine or between different machines across a network. WCF only implements the on-machine part of it. Named Pipes name has the format \\ServeName\pipe\PipeName and for on-machine pipes you can use \\.\pipe\PipeName. WCF, if you remember, use the uri format net.pipe://host/path but unlike it may seem, the actual pipe name (Windows Object) will not be anything near \\host\pipe\path but rather a randomly generated GUID that will be different every time you start your host. When troubleshooting a TCP host/client in WCF, you can simple use netstat /ano to verify if the port is there and which process is listening to it. If it is not listening you know that the host is either not running or running in a different port. For Named Pipes, you will not be able to identify whether the host is listening or not because you don’t have the pipe name.

I will explain how WCF client can figure out the pipe name. Instead of writing a very large paragraph no one will read let’s put it all in perspective with a scenario: I have created a host with a named pipe biding. The endpoint is net.pipe://localhost/TradeService/Service1. I deploy my solution in my server as Windows Service and one day I cannot connect to my host. I check the ABC (Address-Biding-Contract) of my client and it is as expected. The same happens in the host. My objective is identify if the named pipe is available.

First I download SysInternals tools (http://technet.microsoft.com/en-us/sysinternals/default.aspx) and install everything on c:\systenternals. SysInternals include a tool to list all pipes available in the machine. I start a new cmd prompt with Administrator Privileges, move to my SysInternals folder a run PipeList.exe.

You will see two GUID-like Named Pipes in the list (76637f46-853d-4984-8fd5-a4ef6c56606a and 58c9f8e0-67dc-4050-aa4f-24960a7260dd). But I want to know which one is listening to net.pipe://localhost/TradeService/Service1. Named Pipe implements the naming in the listener factory class in this way: it generates a random GUID to use as pipe name, it creates a shared memory object based on the listen address uri to store this GUID and creates some instances of the named pipe to listen to the requests. The client uses the same technique to generate the shared memory file name and read its contents to know the named pipe name.

The shared memory object (or memory mapped file) name is generated this way:

It gets the endpoint and substitute the host name by + or * depending on the wildcard mode.
It then add a “/” to the end if not present already and transform to up case all characters of pipe and path
If the size of the resulting string is bigger than 128 characters a hash is applied to the resulting string
The final name is net.pipe:E + Base64 of string generated in item 2 or net.pipe:H + Base64 of string generated in item 3 if uri is bigger than 128 characters

For our example:
Endpoint: net.pipe://localhost/TradeService/Service1

Normalized Endpoint: net.pipe://+/TRADESERVICE/SERVICE1/

Base 64 representation: bmV0LnBpcGU6Ly8rL1RSQURFU0VSVklDRS9TRVJWSUNFMS8=

Final memory mapped file: net.pipe:EbmV0LnBpcGU6Ly8rL1RSQURFU0VSVklDRS9TRVJWSUNFMS8=

If you use Handle.exe from SysIntenals you can verify the existence of the file in both host server and client.

And of course using Handle.exe net.pipe: will show all memory mapped files with GUIDs for named pipes generated by WCF.

Inside these memory mapped files you will find the GUID in binary format starting at the 5th character. There is no easy way to read mapped memory files in .NET (at least before .NET 4.0) and I will publish a C++ console application in my next post to implement the endpoint name resolution for named pipes in WCF.

In SharePoint 2010 when you create a new Top Link Bar entry the Home tab will not highlight anymore

Rodney Viana - MSFT - DSI Team — Sat, 05 Mar 2011 03:32:26 GMT

After adding page links to the Top Link Bar of team sites tab, the Home tab (the first one) was not getting highlighted anymore when selected. All other page links added to the Top Link Bar were being highlighted as expected. Some people came out with the idea of disabling the Wiki Feature to make Home highlights again. Even though it seems to bring the highlight back to the Home tab, it was disabling a very useful web feature. This is not a very efficient workaround in my humble opinion.

Since I had to work in this issue I was able to put together a workaround that resolves the problem without much effort. First, I will explain how to reproduce the problem, then I will show my solution. I am really curious to know how many people are experiencing the problem, so if it helped you, please add your comment.

These are the steps to reproduce the problem

1. Create a new site collection using the Team Site template

2. After created, navigate to the site and verify that at this moment there is only a tab in the top link bar (Home) and it is highlighted as expected.

3. In Site Actions, choose New Page

4. Enter the new page name and click on Create

5. After the page is created, copy the full Url of the new page to your clipboard as you will need this URL to create the link later

6. In Site Actions, choose Site Settings and click on “Top link bar” under Look and Feel

7. On the Top Link Bar page, click on “New Navigation Link”

8. Enter the URL of the new page you have created in item 3 and 4 and also a name for the link then click ok

9. Click on the newly created tab in the Top Link Bar and you will move to the page and the tab will be highlighted

10. When you click on the tab Home in the Top Link Bar you will go to the page, but it will not be highlighted

Enough of talking about problems. Let’s go to the solution.

Steps to resolve the issue

1. On Site Actions choose Site settings and click on Top link bar.

2. You should see all the tabs in the Top Link Bar

3. Click on the Edit icon for the tab Home

4. Make sure you are indeed in the item for Home and click on Delete (confirm the operation when the popup shows up)

5. You will be back to the Top Link Bar page and Home will not be available anymore

6. Click on the link “New Navigation Link” to add the Home tab again with full URL

7. Enter the full url of the home page in the Web Address field and “Home” (without quotes) in the Description field

8. You will be back to the Top Link Navigation Bar and Home will be the last entry

9. Click on the Link Change Order

10. Make sure you change the Link Order of Home to be 1. It will move Home to the first position and reorder the rest. Click OK when done

11. After clicking Ok check to see if Home is indeed in the first position in the Top Link Bar page

12. Click on the Home tab in Top Link Bar and you will be taken to the Home page

13. Home is now highlighted when selected (as expected)

You only have to do this once for each site collection facing the problem.

Step by step configuration of Excel Calculation Services (ECS) when using Kerberos

Rodney Viana - MSFT - DSI Team — Thu, 24 Feb 2011 04:52:01 GMT

There is no better way of learning something than to observe someone doing it step-by-step. I gathered information from different sources during the beta phase of SharePoint. So my thanks go to Darin Roulston, Eric Adams, Tracy Paddock, Jon Waite and other brave people who created the eco-system for all of us.

The topology is as follows:

• MSF1 is the WFE Server and the site collection is http://msf1

• MSF2 is the APP Server

• DC is the domain controller and SQL server (in real life don’t install SQL in the domain controller)

• Excel Calculation Services account is contoso\xlsvcs and service account running SQL is contoso\SQLSvc

• Domain is contoso.com

A few information before you start:

The Claims to Windows Token Services (c2WTS) is installed by WIF which is part of SharePoint pre-requisites (you don’t have to worry about this installation). The configuration file is called c2wtshost.exe.config, located in c:\Program Files\Windows Identity Foundation\v3.5. The configuration does not allow any user to access the service by default, thus SharePoint add the security group WSS_WPG to enable access from SharePoint services. See screenshot below.

If you have not done yet, install and enable the following via the SharePoint PowerShell Management Console (run as Administrator).

Install-SPFeature –path "DataConnectionLibrary"

Enable-SPFeature –url http://msf1 –identity "DataConnectionLibrary"

Steps:

1. On all the servers running Excel Calculation Services, verify the Claims to Windows Token Service (c2WTS) is Started and set to Automatic.

VERY IMPORTANT: There is a known issue with the C2WTS where it may not automatically startup successfully on system reboot. A workaround to the issue is to configure a service dependency on the Cryptographic Services service:

a) Open the command-prompt window.

b) Type: sc config c2wts depend= CryptSvc

c) Find the Claims to Windows Token Service in the services console.

d) Open the properties for the service.

e) Check the Dependencies tab. Make sure Cryptographic Services is listed.

f) Click OK.

From Central Administration > Manage Services on Server page:

2. Identify the Service Application service account for Excel Services (example: contoso\xlsvcs)

3. Create the service account to be running SQL Server.

a. Open Active Directory Users and Computers and add SQLSvc in the list of users, choose a password and uncheck “requires user to change the password” and make sure password will not expire.

b. Open SQL Configuration Manager from the Start menu,

c. Right-click MSSQLSERVER and click Properties. On the Log On tab of the dialog that appears, click ‘This account’ and enter contoso\SQLSvc and choose a password. Click OK. On the dialog box that appears confirm the restart of the service.

d. Make sure the service is running after restarting.

1. Using the SETSPN tool or the ADSIEdit console, create Service Principal Names (SPNs) for each service account as follows:

a. For each Excel Services Server, add a SPN for the Excel Services service account.

Setspn –a HTTP/MSF2 contoso\xlsvcs

Setspn –a HTTP/MSF2.contoso.com contoso\xlsvcs

2. Set the SPN for the SQL Service account.

Setspn -a MSSQLSvc/DC:1433 contoso\SQLSvc

Setspn -a MSSQLSvc/DC.contoso.com:1433 contoso\SQLSvc

3. Next we will setup our delegation paths. There are two of them: one for the Claims to Windows Token Service, the other for the Excel Service Application.

a. First we will setup the Claims to Windows Token Service delegation path to the back-end data source.

i. In Active Directory Users and Computers, ensure each Computer Account for each ECS Server in the farm is set to constrained delegation to the back-end service. Constrained delegation means that Kerberos delegation is constrained to a specific service.

4. In Active Directory Users and Computers, find MSF2 open its Properties.

a. Click the Delegation tab. Change the Delegation to Trust the computer for delegation to specific services only and select Use any authentication protocol. See example below. Then click the Add button for the next dialog.

5. The next window appears. Click Users or Computers.

At this point, you will need to enter either the SQL Server name or the SQL Server service account.

6. If the SQL server is running under ‘Local System’ then enter the computer name in the following dialog.

7. If the SQL server is running under a service account (like this example), then enter that account. Click OK after you have entered the appropriate Computer or User account.

8. Assuming all steps were completed correctly to this point, you will see the MSSQLSvc principal entry available as a selection. Select your desired entry and click OK.

9. This will be the result of your selection:

10. Next, we will setup the Excel Service Application delegation path. In Active Directory Users and Computers, make each Excel Service Application service account trusted for delegation:

The Excel Services service account should also be set for constrained delegation to the back-end service. Find the Excel Services service account in Active Directory Users and Computers and open its Properties.

11. Repeat the process using Steps 6-9 above for the Excel Service service account and you will see this result:

12. You now have successfully configured Excel Services to use Kerberos delegation (via the Claims to Windows Token Service), and the Windows Authentication method for the workbook data connection is ready to work.

Claims to Windows Token Service (c2WTS) may not start automatically when you reboot your server (don’t blame SharePoint for that)

Rodney Viana - MSFT - DSI Team — Sun, 20 Feb 2011 22:57:00 GMT

I know a large number of people who believe that Claims to Windows Token Service is a SharePoint feature. They are mistaken, c2WTS is part of Windows Identity Foundation (WIF) which is one of the pre-requisites for SharePoint.

SharePoint indeed relies on c2WTS for delegation. It works this way: c2WTS extracts UPN claims from non-Windows security token (like SAML and X.509) and generates a valid Windows security token to be used for impersonation. You will only need to have this service running in SharePoint if you need services that requires impersonation (in a way it is a replacement for SSO) such as Excel Calculation Services (ECS) and PerformancePoint Services.

It happens though that besides configuring ECS being alone a complex task you may face an intermittent problem: c2WTS may not start automatically when you reboot your server. You will of course blame SharePoint for not starting the service as appropriate and this is the misleading part. Even though you set the SharePoint service Claims to Windows Token in Central Administration you are only setting up the tip of the iceberg that is managed by SharePoint. This setting will let SharePoint knows where the actual c2WTS (which is a Windows Service) is installed (you can choose more than one server). It also configures the service and add the appropriate security group (WSS_WPG) to the service config (c:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config) and that’s it. All the hard work is done by the WIF service from this point on.

After having installed the service appropriately you may see it fails to start automatically and your ECS will break. Starting manually will have things back to normal, but this is not a desirable workaround. The problem with starting automatically is that c2WTS has a dependency on another windows service: Cryptographic Services. If Cryptographic Services take too long to start, c2WTS will timeout. This is a known issue with WIF that is not so well documented. To resolve this issue, you will have to add the dependency yourself. The good news is that you only have to do it once for each server running the service.

Fixing the problem:

a) Open the command-prompt window as Administrator.

b) Type: sc config c2wts depend= CryptSvc

c) Find the Claims to Windows Token Service in the services console (run: services.msc)

d) Open the properties for the service.

e) Check the Dependencies tab. Make sure Cryptographic Services is listed.

f) Click OK.

**** UPDATE: I have created a KB article on the subject. It can be found here: http://support.microsoft.com/kb/2512597

Application to check cascade access rights for a particular user or anonymous user in SharePoint

Rodney Viana - MSFT - DSI Team — Thu, 11 Nov 2010 20:09:28 GMT

Don’t you hate when you have access denied and you don’t know where it is coming from? It is even worse when it is related to anonymous access where a single detail can prevent a page from being rendered (IIS authentication, broken inheritance, you name it). The application will show the detailed cascade rights for anonymous, current user and given user for a given item in url. In the example below it will show all details from site to page item:

The output will look like it:

Object Type: File
**** Start Miscellaneous for Site http://rviana-moss-w28
IIS Allow Anonymous: [True]
IIS is impersonating: [False]
Zone:                 [Default]
Host Name:            [rviana-moss-w28]
Write Locked:         [False]
**** End Miscellaneous for Site
**** Start Miscellaneous for Web http://rviana-moss-w28
Web Allow Anonymous: [True]
Anonymous Access to Lists and Libraries: [On]
********* Start of List of Rights to anonymous in this web
Perm Mask - Hex: 1000031041 Binary 1000000000000000000110001000001000001
    ViewListItems Hex [00000001] Binary [1]
    ViewVersions Hex [00000040] Binary [1000000]
    ViewFormPages Hex [00001000] Binary [1000000000000]
    Open Hex [00010000] Binary [10000000000000000]
    ViewPages Hex [00020000] Binary [100000000000000000]
    UseClientIntegration Hex [1000000000] Binary [1000000000000000000000000000000000000]
    FullMask Hex [1000031041] Binary [1000000000000000000110001000001000001]
********* End of List of Rights to anonymous in this web

********* Start of List of Rights for User CONTOSO\alanew
Perm Mask - Hex: 1b03c4312ef Binary 11011000000111100010000110001001011101111
    ViewListItems Hex [00000001] Binary [1]
    AddListItems Hex [00000002] Binary [10]
    EditListItems Hex [00000004] Binary [100]
    DeleteListItems Hex [00000008] Binary [1000]
    OpenItems Hex [00000020] Binary [100000]
    (... lines removed for space ...)
    CreateAlerts Hex [8000000000] Binary [1000000000000000000000000000000000000000]
    EditMyUserInfo Hex [10000000000] Binary [10000000000000000000000000000000000000000]
    FullMask Hex [1b03c4312ef] Binary [11011000000111100010000110001001011101111]
********* End of List of Rights

********* Start of List of Rights for Current User CONTOSO\rviana
Perm Mask - Hex: 7fffffffffffffff Binary 111111111111111111111111111111111111111111111111111111111111111
    ViewListItems Hex [00000001] Binary [1]
    AddListItems Hex [00000002] Binary [10]
    EditListItems Hex [00000004] Binary [100]
    DeleteListItems Hex [00000008] Binary [1000]
    (... lines removed for space ...)
    EditMyUserInfo Hex [10000000000] Binary [10000000000000000000000000000000000000000]
    EnumeratePermissions Hex [4000000000000000] Binary [100000000000000000000000000000000000000000000000000000000000000]
    FullMask Hex [7fffffffffffffff] Binary [111111111111111111111111111111111111111111111111111111111111111]
********* End of List of Rights

**** End Miscellaneous for Web

**** Start Miscellaneous for List Pages at /Pages/Forms/AllItems.aspx
Access to Template List is Restricted     : [False]
Users Access Limited to Items they Created: [False]
Anonymous can access                      : [True]
Everyone can view List                    : [False]
********* Start of List of Rights to anonymous in this List
Perm Mask - Hex: 1000031041 Binary 1000000000000000000110001000001000001
    ViewListItems Hex [00000001] Binary [1]
    ViewVersions Hex [00000040] Binary [1000000]
    ViewFormPages Hex [00001000] Binary [1000000000000]
    Open Hex [00010000] Binary [10000000000000000]
    ViewPages Hex [00020000] Binary [100000000000000000]
    UseClientIntegration Hex [1000000000] Binary [1000000000000000000000000000000000000]
    FullMask Hex [1000031041] Binary [1000000000000000000110001000001000001]
********* End of List of Rights to anonymous in this List

********* Start of List of Rights for User CONTOSO\alanew
Perm Mask - Hex: 1b03c4312ef Binary 11011000000111100010000110001001011101111
    ViewListItems Hex [00000001] Binary [1]
    AddListItems Hex [00000002] Binary [10]
    EditListItems Hex [00000004] Binary [100]
    DeleteListItems Hex [00000008] Binary [1000]
    OpenItems Hex [00000020] Binary [100000]
    ViewVersions Hex [00000040] Binary [1000000]
    (... lines removed for space ...)
    EditMyUserInfo Hex [10000000000] Binary [10000000000000000000000000000000000000000]
    FullMask Hex [1b03c4312ef] Binary [11011000000111100010000110001001011101111]
********* End of List of Rights

********* Start of List of Rights for Current User CONTOSO\rviana
Perm Mask - Hex: 7fffffffffffffff Binary 111111111111111111111111111111111111111111111111111111111111111
    ViewListItems Hex [00000001] Binary [1]
    AddListItems Hex [00000002] Binary [10]
    (... lines removed for space ...)
    EditMyUserInfo Hex [10000000000] Binary [10000000000000000000000000000000000000000]
    EnumeratePermissions Hex [4000000000000000] Binary [100000000000000000000000000000000000000000000000000000000000000]
    FullMask Hex [7fffffffffffffff] Binary [111111111111111111111111111111111111111111111111111111111111111]
********* End of List of Rights

**** End Miscellaneous for List

**** Start Miscelaneous for List Item default.aspx at Pages/default.aspx
Anonymous has access to list item    : [True]
Permission Inheritance is broken     : [False]
********* Start of List of Rights for User CONTOSO\alanew
Perm Mask - Hex: 1b03c4312ef Binary 11011000000111100010000110001001011101111
    ViewListItems Hex [00000001] Binary [1]
    AddListItems Hex [00000002] Binary [10]
    EditListItems Hex [00000004] Binary [100]
    (... lines removed for space ...)
    UpdatePersonalWebParts Hex [20000000] Binary [100000000000000000000000000000]
    UseClientIntegration Hex [1000000000] Binary [1000000000000000000000000000000000000]
    UseRemoteAPIs Hex [2000000000] Binary [10000000000000000000000000000000000000]
    CreateAlerts Hex [8000000000] Binary [1000000000000000000000000000000000000000]
    EditMyUserInfo Hex [10000000000] Binary [10000000000000000000000000000000000000000]
    FullMask Hex [1b03c4312ef] Binary [11011000000111100010000110001001011101111]
********* End of List of Rights

********* Start of List of Rights for Current User CONTOSO\rviana
Perm Mask - Hex: 7fffffffffffffff Binary 111111111111111111111111111111111111111111111111111111111111111
    ViewListItems Hex [00000001] Binary [1]
    AddListItems Hex [00000002] Binary [10]
    EditListItems Hex [00000004] Binary [100]
    (... lines removed for space ...)
    EnumeratePermissions Hex [4000000000000000] Binary [100000000000000000000000000000000000000000000000000000000000000]
    FullMask Hex [7fffffffffffffff] Binary [111111111111111111111111111111111111111111111111111111111111111]
********* End of List of Rights

********* Item Xml
<z:row xmlns:z='#RowsetSchema' ows_ContentTypeId='0x010100C568DB52D9D0A14D9B2FDCC96666E9F2007948130EC3DB064584E219954237AF390064DEA0F50FC8C147B0B6EA0636C4A7D400B86BB823B4EF734998C6CF97A89029EE' ows_FileLeafRef='1;#default.aspx' ows_Modified_x0020_By='SHAREPOINT\system' ows_File_x0020_Type='aspx' ows_Title='Search Center' ows_PublishingPageLayout='http://rviana-moss-w28/_catalogs/masterpage/searchmain.aspx, Search Page' ows_ContentType='Welcome Page' ows_ID='1' ows_Created='2010-10-22 20:43:50' ows_Author='1073741823;#System Account' ows_Modified='2010-10-22 20:43:50' ows_Editor='1073741823;#System Account' ows__ModerationStatus='0' ows_FileRef='1;#Pages/default.aspx' ows_FileDirRef='1;#Pages' ows_Last_x0020_Modified='1;#2010-10-22 20:43:50' ows_Created_x0020_Date='1;#2010-10-22 20:43:50' ows_File_x0020_Size='1;#739' ows_FSObjType='1;#0' ows_PermMask='0x7fffffffffffffff' ows_CheckedOutUserId='1;#' ows_IsCheckedoutToLocal='1;#0' ows_UniqueId='1;#{B9F29A82-3E82-4817-B8A5-77CED27512E8}' ows_ProgId='1;#' ows_ScopeId='1;#{037929C6-B73A-4F2B-BD14-07003EADB4CD}' ows_VirusStatus='1;#739' ows_CheckedOutTitle='1;#' ows__CheckinComment='1;#' ows__EditMenuTableStart='default.aspx' ows__EditMenuTableEnd='1' ows_LinkFilenameNoMenu='default.aspx' ows_LinkFilename='default.aspx' ows_DocIcon='aspx' ows_ServerUrl='/Pages/default.aspx' ows_EncodedAbsUrl='http://rviana-moss-w28/Pages/default.aspx' ows_BaseName='default' ows_FileSizeDisplay='739' ows_MetaInfo='1;#vti_modifiedby:SR|SHAREPOINT\\system
vti_parserversion:SR|12.0.0.6545
vti_cachedhastheme:BR|false
vti_cachedcustomprops:VX|ContentType vti_title PublishingPageLayout
ContentType:SW|Welcome Page
vti_title:SR|Search Center
vti_cachedtitle:SR|Search Center
vti_charset:SR|utf-8
ContentTypeId:SW|0x010100C568DB52D9D0A14D9B2FDCC96666E9F2007948130EC3DB064584E219954237AF390064DEA0F50FC8C147B0B6EA0636C4A7D400B86BB823B4EF734998C6CF97A89029EE
PublishingPageLayout:SW|/_catalogs/masterpage/searchmain.aspx, Search Page
vti_author:SR|
vti_setuppath:SX|SiteTemplates\\SRCHCEN\\default.aspx
vti_cachedneedsrewrite:BR|false
' ows__Level='1' ows__IsCurrentVersion='1' ows_SelectTitle='1' ows_SelectFilename='1' ows_Edit='0' ows_owshiddenversion='2' ows__UIVersion='512' ows__UIVersionString='1.0' ows_Order='100.000000000000' ows_GUID='{5FAA46F1-443E-4FF7-A60B-7A229EBD9C03}' ows_WorkflowVersion='1' ows_ParentVersionString='1;#' ows_ParentLeafName='1;#' ows_Combine='0' ows_RepairDocument='0' ows_ServerRedirected='0'/>

********* End of Item XML

********* Role Assignments Xml
<permissions><permission memberid='3' mask='9223372036854775807' />
<permission memberid='4' mask='756052856929' />
<permission memberid='5' mask='1856436900591' />
<permission memberid='6' mask='206292717568' />
<permission memberid='7' mask='1856438737919' />
<permission memberid='8' mask='4611688150860241903' />
<permission memberid='9' mask='1856436900863' />
<permission memberid='10' mask='206292848673' />
<permission memberid='11' mask='206292717568' />
<permission memberid='13' mask='756052856897' />
<permission memberid='1073741823' mask='206292717568' />
</permissions>
********* End of Role Assignments Xml

**** End Miscellaneous for List Item

*** File default.aspx content:

???<%@ Page Inherits="Microsoft.SharePoint.Publishing.TemplateRedirectionPage,Microsoft.SharePoint.Publishing,Version=12.0.0.0,Culture=neutral,PublicKeyToken=71e9bce111e9429c" %> <%@ Reference VirtualPath="~TemplatePageUrl" %> <%@ Reference VirtualPath="~masterurl/custom.master" %>

<!--[if gte mso 9]><xml>
<mso:CustomDocumentProperties>

<mso:ContentType msdt:dt="string">Welcome Page</mso:ContentType>

<mso:PublishingPageLayout msdt:dt="string">/_catalogs/masterpage/searchmain.aspx, Search Page</mso:PublishingPageLayout>

</mso:CustomDocumentProperties>
</xml><![endif]-->

<title>Search Center</title></head>

*** End File
*** Anonymous has rights on File default.aspx: [True]

The code core is below. The cascade walking class was based on Sanjay’s class defined at http://blogs.msdn.com/b/sanjaynarang/archive/2009/04/07/find-sharepoint-object-type-from-url.aspx .

You can download code and executable here: http://rodneyviana.codeplex.com/releases/view/19103

It works for SharePoint 2010 but you have to change the references and recompile using 14.x assemblies.

using System;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.Linq;
using System.Text;
using System.Web;
using Microsoft.SharePoint;
using Microsoft.SharePoint.Administration;
using Microsoft.SharePoint.Deployment;

namespace CheckEffectiveProperties
{
    public class SPObjType
    {
        public Guid objectGuid;
        public object obj;
        public string url;
        public string siteRelativeUrl;
        public SPDeploymentObjectType objType;
        public StringBuilder message = new StringBuilder(2000);
        public SPBasePermissions currUserRights;
        public SPBasePermissions testUser;
        public SPBasePermissions anonymousMask;
        public bool? isAnonymousEnabled = null;

        public static string EnumeratePermission(SPBasePermissions Mask)
        {
            StringBuilder sb = new StringBuilder(100);
            sb.AppendFormat("Perm Mask - Hex: {0} Binary {1}\n", ((ulong)Mask).ToString("x8"), Convert.ToString((Int64)Mask, 2));
            foreach (string permName in Enum.GetNames(typeof(SPBasePermissions)))
            {
                ulong i = (ulong)Mask & (ulong)(Enum.Parse(typeof(SPBasePermissions), permName));
                if (i > 0)
                {
                    sb.Append(String.Format("    {0} Hex [{1}] Binary [{2}]\n", permName, i.ToString("x8"), Convert.ToString((Int64)i, 2)));
                }
            }
            return sb.ToString();
        }
        public void GetFile(SPFile File, SPBasePermissions Mask)
        {
            try
            {
                byte[] binFile = File.OpenBinary();
                ASCIIEncoding asc = new ASCIIEncoding();
                string fileContent = asc.GetString(binFile);
                message.AppendFormat("\n*** File {0} content:\n\n{1}\n\n", File.Name, fileContent);
                message.Append("\n*** End File");
                if (File.Item != null)
                {
                    message.AppendFormat("\n*** Anonymous has rights on File {0}: [{1}]\n\n", File.Name, File.Item.DoesUserHavePermissions(Mask));
                }
                else
                {
                    message.AppendFormat("\n*** Unable to test Anonymous rights on File {0}\n\n", File.Name);
                }
            }
            catch (Exception ex)
            {
                message.AppendFormat("\n\n*************** Error opening file {0}: {1} ************\n\n", File.Name, ex.Message);

            }

}
}

    // The class below was originally created by Sanjay Narang to identify the object type from a URL
    // The code for this intent is found here: http://blogs.msdn.com/b/sanjaynarang/archive/2009/04/07/find-sharepoint-object-type-from-url.aspx
    //
    // It was modified to check properties and cascade access (Anonymous | Current User | GivenUser)
    //    for an object pointed by Rodney Viana
    // You have to agree with this license to use this code/application: http://rodneyviana.codeplex.com/license
    // Details of the implementation can be found at: http://blogs.msdn.com/rodneyviana
    // This project can be downloaded at: http://rodneyviana.codeplex.com/releases/view/19103

    class SanjayMossUtilities
    {
        public SPObjType GetObjectTypeFromURL(string passedUrl, string User)
        {
            SPObjType oType = new SPObjType();
            oType.objType = SPDeploymentObjectType.Invalid;

oType.objectGuid = Guid.Empty;

            SPSite site = null;
            SPWeb web = null;
            SPList list = null;
            oType.obj = null;
            oType.url = null;
            oType.siteRelativeUrl = null;
            NameValueCollection queryParams = null;

oType.url = GetModifiedUrl(passedUrl, out queryParams);

            try
            {
                site = new SPSite(oType.url);
                oType.message.AppendFormat("**** Start Miscellaneous for Site {0}\n", site.Url);
                oType.message.AppendFormat("IIS Allow Anonymous: [{0}]\n", site.IISAllowsAnonymous);
                oType.message.AppendFormat("IIS is impersonating: [{0}]\n", site.Impersonating);
                oType.message.AppendFormat("Zone:                 [{0}]\n", site.Zone.ToString());
                oType.message.AppendFormat("Host Name:            [{0}]\n", site.HostName);
                oType.message.AppendFormat("Write Locked:         [{0}]\n", site.WriteLocked);
                oType.message.Append("**** End Miscellaneous for Site\n");

                web = site.OpenWeb();
                oType.message.AppendFormat("**** Start Miscellaneous for Web {0}\n", web.Url);
                oType.message.AppendFormat("Web Allow Anonymous: [{0}]\n", web.AllowAnonymousAccess);
                oType.message.AppendFormat("Anonymous Access to Lists and Libraries: [{0}]\n", web.AnonymousState.ToString());
                if (web.AllowAnonymousAccess)
                {
                    oType.message.Append("********* Start of List of Rights to anonymous in this web\n");
                    oType.message.Append(SPObjType.EnumeratePermission(web.AnonymousPermMask64));
                    oType.message.Append("********* End of List of Rights to anonymous in this web\n\n");
                }

                if (!String.IsNullOrEmpty(User))
                {
                    oType.message.AppendFormat("********* Start of List of Rights for User {0}\n", User);
                    oType.message.Append(SPObjType.EnumeratePermission(web.GetUserEffectivePermissions(User)));
                    oType.message.Append("********* End of List of Rights\n\n");

                }
                string curUser = Environment.UserDomainName + "\\" + Environment.UserName;
                if (User.ToLower().Trim() != curUser.ToLower().Trim())
                {
                    oType.message.AppendFormat("********* Start of List of Rights for Current User {0}\n", curUser);
                    oType.message.Append(SPObjType.EnumeratePermission(web.GetUserEffectivePermissions(curUser)));
                    oType.message.Append("********* End of List of Rights\n\n");
                }
                oType.message.Append("**** End Miscellaneous for Web\n\n");

                if (oType.url.Equals(site.Url, StringComparison.OrdinalIgnoreCase))
                {
                    oType.objectGuid = site.ID;
                    oType.objType = SPDeploymentObjectType.Site;

                    return oType;
                }

                if (oType.url.Equals(web.Url, StringComparison.OrdinalIgnoreCase))
                {
                    oType.objectGuid = web.ID;
                    oType.objType = SPDeploymentObjectType.Web;
                    return oType;
                }

oType.siteRelativeUrl = oType.url.TrimStart(web.Url.ToCharArray());

                try
                {
                    list = web.GetList(oType.url);
                }
                catch(Exception ex)
                {
                    oType.message.AppendFormat("\n\n ******* Error trying to retrieve List : {0} ***** \n\n", ex.Message);
                    list = null;
                }

                if (null != list )
                {
                    oType.objectGuid = list.ID;
                    oType.objType = SPDeploymentObjectType.List;

                    oType.message.AppendFormat("**** Start Miscellaneous for List {0} at {1}\n", list.Title, list.DefaultViewUrl);
                    oType.message.AppendFormat("Access to Template List is Restricted     : [{0}]\n", list.RestrictedTemplateList);
                    oType.message.AppendFormat("Users Access Limited to Items they Created: [{0}]\n", (list.ReadSecurity==2));
                    oType.message.AppendFormat("Anonymous can access                      : [{0}]\n", list.DoesUserHavePermissions(list.AnonymousPermMask64));
                    oType.message.AppendFormat("Everyone can view List                    : [{0}]\n", list.AllowEveryoneViewItems);

                    oType.message.Append("********* Start of List of Rights to anonymous in this List\n");
                    oType.message.Append(SPObjType.EnumeratePermission(list.AnonymousPermMask64));
                    oType.message.Append("********* End of List of Rights to anonymous in this List\n\n");

                    if (!String.IsNullOrEmpty(User))
                    {
                        oType.message.AppendFormat("********* Start of List of Rights for User {0}\n", User);
                        oType.message.Append(SPObjType.EnumeratePermission(list.GetUserEffectivePermissions(User)));
                        oType.message.Append("********* End of List of Rights\n\n");

                    }
                    if (User.ToLower().Trim() != curUser.ToLower().Trim())
                    {
                        oType.message.AppendFormat("********* Start of List of Rights for Current User {0}\n", curUser);
                        oType.message.Append(SPObjType.EnumeratePermission(list.GetUserEffectivePermissions(curUser)));
                        oType.message.Append("********* End of List of Rights\n\n");
                    }
                    oType.message.Append("**** End Miscellaneous for List\n\n");

                    if (oType.siteRelativeUrl.Equals(list.RootFolder.Url, StringComparison.OrdinalIgnoreCase))
                    {
                        return oType;
                    }
                }

                // if we are here, it means URL is none of these:
                // site, web, list
                // So, it can be either file, folder or a list item.
                // Finding that is intricated.

oType.obj = web.GetObject(oType.url);

                if (null != oType.obj)
                {
                    SPListItem item = (oType.obj as SPListItem);
                    if (item != null)
                    {
                        if (!String.IsNullOrEmpty(User))
                        {
                            oType.message.AppendFormat("**** Start Miscellaneous for List Item {0} at {1}\n", item.Name, item.Url);
                            oType.message.AppendFormat("Anonymous has access to list item    : [{0}]\n", item.DoesUserHavePermissions( list.AnonymousPermMask64));
                            oType.message.AppendFormat("Permission Inheritance is broken     : [{0}]\n", item.HasUniqueRoleAssignments);

// oType.message.Append(SPObjType.EnumeratePermission(web.AnonymousPermMask64));

                            oType.message.AppendFormat("********* Start of List of Rights for User {0}\n", User);
                            oType.message.Append(SPObjType.EnumeratePermission(item.GetUserEffectivePermissions(User)));
                            oType.message.Append("********* End of List of Rights\n\n");

                        }
                        if (User.ToLower().Trim() != curUser.ToLower().Trim())
                        {
                            oType.message.AppendFormat("********* Start of List of Rights for Current User {0}\n", curUser);
                            oType.message.Append(SPObjType.EnumeratePermission(item.GetUserEffectivePermissions(curUser)));
                            oType.message.Append("********* End of List of Rights\n\n");
                        }
                        oType.message.AppendFormat("********* Item Xml\n", curUser);
                        oType.message.AppendFormat("{0}\n", item.Xml);

                        oType.message.Append("********* End of Item XML\n\n");
                        oType.message.AppendFormat("********* Role Assignments Xml\n", curUser);
                        oType.message.AppendFormat("{0}\n", item.RoleAssignments.Xml);

oType.message.Append("********* End of Role Assignments Xml\n\n");

                        oType.message.Append("**** End Miscellaneous for List Item\n\n");

                    }
                    if (oType.obj is SPFile)
                    {
                        // Generally, we get here for Forms Pages,
                        // such as DispForm.aspx, AllItems.aspx
                        // so, a SPFile object could be a list item Or
                        // a folder in a list or a Folder

// Pages in root of the web are also returned as
// SPFiles e.g. http://moss/default.aspx

                        // The URLs that point to a file in doc lib are
                        // returned as SPListItem by GetObject method
                        //

SPFile file = oType.obj as SPFile;

                        if (null != queryParams)
                        {
                            // The logic to identify folder or item has
                            // been explained in ValidateQueryString
                            string idValue = queryParams["ID"];
                            string folderValue = queryParams["RootFolder"];
                            if (null != idValue)
                            {
                                item = list.GetItemById(int.Parse(idValue));
                                oType.objectGuid = item.UniqueId;
                                oType.objType = SPDeploymentObjectType.ListItem;
                                return oType;
                            }
                            else if (null != folderValue)
                            {
                                SPFolder folder = web.GetFolder(folderValue);
                                oType.objectGuid = folder.UniqueId;
                                oType.objType = SPDeploymentObjectType.Folder;
                                return oType;
                            }
                            else
                            {
                                // Deployyment Object Type is: Invalid, so no need
                                // to do anything
                            }
                        }
                        else
                        {
                            oType.objectGuid = file.UniqueId;
                            oType.objType = SPDeploymentObjectType.File;
                            oType.GetFile(file, web.AnonymousPermMask64);
                            return oType;
                        }
                    }
                    else if (oType.obj is SPFolder)
                    {
                        SPFolder folder = oType.obj as SPFolder;
                        oType.objectGuid = folder.UniqueId;
                        oType.objType = SPDeploymentObjectType.Folder;
                        return oType;
                    }
                    else if (oType.obj is SPListItem)
                    {

item = oType.obj as SPListItem;

                        // item can contain a folder of file also. e.g.
                        // http://moss.litwareinc.com/Documents/folderinlibrary
                        // http://moss.litwareinc.com/Documents/FolderInLibrary/File2.doc

                        if (null != item.Folder)
                        {
                            oType.objectGuid = item.Folder.UniqueId;
                            oType.objType = SPDeploymentObjectType.Folder;
                            return oType;
                        }
                        else if (null != item.File)
                        {
                            oType.objectGuid = item.File.UniqueId;
                            oType.objType = SPDeploymentObjectType.File;
                            oType.GetFile(item.File, web.AnonymousPermMask64);

return oType;
}

                        oType.objectGuid = item.UniqueId;
                        oType.objType = SPDeploymentObjectType.ListItem;
                        return oType;
                    }
                }

            }
            finally
            {
                if (web != null)
                {
                    web.Dispose();
                }
                if (site != null)
                {
                    site.Dispose();
                }
            }
            return oType;
        }

        private string GetModifiedUrl(string url, out NameValueCollection queryParams)
        {
            string modUrl = url; //modified url
            string querystring = string.Empty;
            queryParams = null;

            // if it's a site or web or folder, user can pass '/' at
            // the end, which we need to trim
            if (url.EndsWith("/"))
            {
                modUrl = url.TrimEnd(new char[] { '/' });
            }

            // we need to get the URL without query string as it creates
            // problem getting the parent folder
            if (url.Contains("?"))
            {

                int tmp = url.IndexOf("?");
                modUrl = url.Substring(0, tmp);
                querystring = url.Substring(tmp + 1);

                queryParams = HttpUtility.ParseQueryString(querystring);
                // apply custom rules
                ValidateQueryString(queryParams);
            }

return modUrl;
}

        private void ValidateQueryString(NameValueCollection queryParams)
        {
            // when there's query string in the URL, the URL can point to a
            // list item (in a list) or a folder.
            // For example if an item is a folder
            // 'FolderInTasksList' the URL of item would look like this
            // http://moss.litwareinc.com/Lists/Tasks/DispForm.aspx?ID=2&RootFolder=/Lists/Tasks/FolderInTasksList OR
            // http://moss.litwareinc.com/Lists/Tasks/DispForm.aspx?ID=2&RootFolder=%2fLists%2fTasks%2fFolderInTasksList
            //
            // And if we need Url of the folder, it would be like this:
            // http://moss.litwareinc.com/Lists/Tasks/AllItems.aspx?RootFolder=%2fLists%2fTasks%2fFolderInTasksList&FolderCTID=&View=%7bD8E1251D%2d829B%2d4FCE%2d9127%2d5E4FC6E6A5C4%7d
            //
            // From the above two examples, I'm applying the following
            // rules on the query string
            // 1. It can contain only these keys: ID, RootFolder, FolderCTID, View
            //    If there's any other key, i would treat that as invalid query string
            //
            // 2. ID and RootFolder should never be empty
            //    otherwise, raise exception here rather than hitting that later
            //
            // 3. the query string has to contain at least one of the following
            //    a. ID, b. RootFolder

            // Build a string collection with possible values. For comparison,
            // we'll use lower case only
            StringCollection strColl = new StringCollection();
            strColl.Add("ID".ToLower());
            strColl.Add("RootFolder".ToLower());
            strColl.Add("FolderCTID".ToLower());
            strColl.Add("View".ToLower());

            // Apply the Rules
            bool hasID = false;
            bool hasRootFolder = false;

            Console.WriteLine();
            foreach (string str in queryParams.AllKeys)
            {
                // can be used for debugging
                // Console.WriteLine("Name: " + str + " | Value: " + queryParams[str]);

                // Rule 1
                if (!(strColl.Contains(str.ToLower())))
                {
                    throw new ArgumentException("Invalid argument in passed query string");
                }
                // Rule 2
                if (str.Equals("id", StringComparison.OrdinalIgnoreCase))
                {
                    hasID = true;
                    if (queryParams[str].Equals(String.Empty))
                    {
                        throw new ArgumentException("Query string parameter \"" + str + "\" can not be empty.");
                    }
                }
                // Rule 2
                if (str.Equals("rootfolder", StringComparison.OrdinalIgnoreCase))
                {
                    hasRootFolder = true;
                    if (queryParams[str].Equals(String.Empty))
                    {
                        throw new ArgumentException("Query string parameter \"" + str + "\" can not be empty.");
                    }
                }
            }
            // Rule 3
            Console.WriteLine();
            if (!(hasID || hasRootFolder))
            {
                throw new ArgumentException("Query string must have at least one parameter from these: ID and RootFolder");
            }
        }

}
}

Creating a Web Application using Kerberos as authentication instead of NTLM in SharePoint 2010 programmatically via PowerShell

Rodney Viana - MSFT - DSI Team — Fri, 08 Oct 2010 20:41:50 GMT

If you have ever tried to programmatically create a Web Application using Kerberos as authentication provider you noticed that the Authentication Provider resets to NTLM. The cmdlet to create a new Web Application is New-SPWebApplication (or New-SPWebApplicationExtension to extending an exixting one) which comes with the toggle parameter to disable Kerberos authentication (DisableKerberosAuthentication). It happens, though, that by default DisableKerberosAuthentication is set to True and as it is toggle type it does not enable the use of “DisableKerberosAuthentication $true”.

Making a few tests to help respond a forum question I found out that we can circumvent this behavior in two ways:

Mode 1 - Setting Authentication Provider’s property DisableKerberos to false after creating an instance and passing this instance to New-SPWeb*. See example below:

> $ap = (New-SPAuthenticationProvider)
> $ap | fl

DisplayName                        : Windows Authentication
ClaimProviderName                  : AD
AllowAnonymous                     : False
UseBasicAuthentication             : False
DisableKerberos                    : True          <<<< Note that Kerberos is disabled by default
UseWindowsIntegratedAuthentication : True
AuthenticationRedirectionUrl       : /_windows/default.aspx
UpgradedPersistedProperties        :

> $ap.DisableKerberos = $false

> $ap | fl *

DisplayName                        : Windows Authentication
ClaimProviderName                  : AD
AllowAnonymous                     : False
UseBasicAuthentication             : False
DisableKerberos                    : False   <<< Now I made sure that Kerberos is enabled
UseWindowsIntegratedAuthentication : True
AuthenticationRedirectionUrl       : /_windows/default.aspx
UpgradedPersistedProperties        : {}

> New-SPWebApplication -Name "Kerberos App" -ApplicationPool "SharePoint - 80" -port 90 -url http://www.contoso.com -AuthenticationProvider $ap

Mode 2 - Forcing the property DisableKerberos to be false during instantiation using a hack (thanks to Dan Holme):

> $ap = New-SPAuthenticationProvider -DisableKerberos:$false

> New-SPWebApplication -Name "Kerberos App" -ApplicationPool "SharePoint - 80" -port 90 -url http://www.contoso.com -AuthenticationProvider $ap

Or using all in one single line:

> New-SPWebApplication -Name "Kerberos App" -ApplicationPool "SharePoint - 80" -port 90 -url http://www.contoso.com –AuthenticationProvider (New-SPAuthenticationProvider -DisableKerberos:$false)

*** SECOND WORKAROUND CREDIT ***

Binging around before posting this I found a post where Dan Holme suggests the second workaround:

http://www.windowsitpro.com/article/sharepoint/Power-Trip-PowerShell-Bug-and-Claims.aspx

ForeFront The Missing Manual

Rodney Viana - MSFT - DSI Team — Wed, 14 Apr 2010 01:22:33 GMT

My friend Yuri Diogenes, one of the security gurus here at Microsoft, in partnership with Jim Harrison, Mohit Saxena and having Tom Shinder as Technical Reviewer released last February the Microsoft Press Administrator’s Companion for Forefront TMG 2010, the new generation of Microsoft Firewall, which had ISA Server as it predecessor. The book has around 1050 pages of technical content, and it is the only official Forefront TMG 2010 book released by Microsoft Press. If you want to try it before buy, read the two sample chapters available at MSPress Blog. For more information on this book you can access www.mstmgbook.org. The book is now available at Amazon.com with 37% discount, better hurry to get yours.

Some thoughts on Impersonation

Rodney Viana - MSFT - DSI Team — Wed, 30 Dec 2009 23:57:08 GMT

I normally talk about SharePoint topics but this post is also important for non-SharePoint people. First let me explain what is the relationship between impersonation and SharePoint, or better, the relationship between SharePoint and the thread [security] token. SPRequest is the unmanaged low level class in SharePoint that works as HtppHandler for SharePoint requests. In the very heart of the security checks in SPRequest, it tries to get the SID of the user being impersonated in the current thread (Microsoft.SharePoint.Library.SPRequestInternalClass.OpenWebInternal() will be the last managed stack entry followed by some variation of Microsoft.SharePoint.Library.SPRequest when an error occurs). In some occasions, the thread token cannot be retrieved and you will see an error like System.Security.Authentication.AuthenticationException. This situation is normally related to custom code when there are other levels of Http Handlers involved, however it is potentially possible to happen in other situations which I am not aware of.

I have faced such problem and being in a production environment and not reproducible outside that environment, I was unable to do a live debug of the problem. I’ve got the iDNA trace which is the closest you can get to a live debug in a situation like that. I could confirm the very point where the application was failing (and the last point of failure was indeed in SharePoint as most errors end up in kernel.dll even though the problem is not in kernel.dll). In normal circumstances the thread token can be retrieved. The problem always happens when the custom application is involved (and the custom http handlers are in the way of SharePoint Http Handler). To make things even worse the custom application was not failing in other environments. All indications led to problems in the authentication mechanism of the environment (read this as Active Directory Problems). In order to create some tests that would help identify the problem in the environment I put together an application to test impersonation of threads and “logon as” kind of behavior. I am sure this could be done in .NET but I decided to use C++ instead because it showed to be easier to implement (and reuse some available code).

The source code and installation binaries can be found at http://rodneyviana.codeplex.com (downloads).

Running in elevated privilege (not necessary but since I implemented I kept the code)

When you start an application there is no way you can change the privileges of that instance, you will have to run it again as Administrator to make it work. If you verify how Task Manager works in Vista and above you will notice that seeing process for all users (which requires run in elevated privileges) requires a restart in Task Manager.

This is the code that implement it:

void CImpersonationDlg::OnBnClickedButton4()
{
    // TODO: Add your control notification handler code here
    SHELLEXECUTEINFO sei = { sizeof(SHELLEXECUTEINFO) };
    int argc;
    PWSTR *argsv = CommandLineToArgvW(GetCommandLine(), &argc);
    if(argc == 0)
    {
        PrintError(L"Error retrieving path. Elevation was aborted");
        return;
    }

// Get Process Full Path
sei.lpFile = (LPCWSTR)argsv[0];

// Ask for privileges elevation.
sei.lpVerb = _T("runas");

    sei.nShow = SW_SHOWNORMAL;
    bool closeWindow = true;
    if(!ShellExecuteEx(&sei))
    {
        PrintError(L"Unable to elevate privileges");
        closeWindow = false;
    }
    HeapFree(GetProcessHeap(), 0, argsv);
    if(closeWindow)
    {
        this->CloseWindow();
    }
}

Getting the Thread Token

In my test I get the same error that the custom application was getting (it is normal to get the error when you do not impersonate).

This is the code for that:

void CImpersonationDlg::OnBnClickedButtonThreadget()
{
    // TODO: Add your control notification handler code here
    HANDLE tokenHandle;
    ClearFields();
    if(!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, FALSE, &tokenHandle))
    {
        PrintError(L"Unable to get Current Thread Token. Try to impersonate first.");
        return;
    }
    AfxMessageBox(L"Current Thread Token retrieved successfully");
    FillUserInformationFromToken(tokenHandle);
    CloseHandle(tokenHandle);
}

And the code to show the latest system error formatted:

// Print System Error adapted from http://msdn.microsoft.com/en-us/library/ms680582(VS.85).aspx
void CImpersonationDlg::PrintError(LPTSTR lpszFunction)
{
// Retrieve the system error message for the last-error code

    LPVOID lpMsgBuf;
    LPVOID lpDisplayBuf;
    DWORD dw = GetLastError();

    FormatMessage(
        FORMAT_MESSAGE_ALLOCATE_BUFFER |
        FORMAT_MESSAGE_FROM_SYSTEM |
        FORMAT_MESSAGE_IGNORE_INSERTS,
        NULL,
        dw,
        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
        (LPTSTR) &lpMsgBuf,
        0, NULL );

// Display the error message

    lpDisplayBuf = (LPVOID)LocalAlloc(LMEM_ZEROINIT,
        (lstrlen((LPCTSTR)lpMsgBuf) + lstrlen((LPCTSTR)lpszFunction) + 40) * sizeof(TCHAR));
    StringCchPrintf((LPTSTR)lpDisplayBuf,
        LocalSize(lpDisplayBuf) / sizeof(TCHAR),
        TEXT("%s\nFailed with error %d: %s"),
        lpszFunction, dw, lpMsgBuf);
    MessageBox((LPCTSTR)lpDisplayBuf, TEXT("Error"), MB_OK);

LocalFree(lpMsgBuf);
LocalFree(lpDisplayBuf);
}

Getting Process Token

Process Token must exist. You may not have rights to see it.

This is the code:

void CImpersonationDlg::OnBnClickedButtonProcessget()
{
    // TODO: Add your control notification handler code here
    HANDLE tokenHandle;
    ClearFields();
    if(!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &tokenHandle))
    {
        PrintError(L"Unable to get Current Process Token");
        return;
    } else
    FillUserInformationFromToken(tokenHandle);
    AfxMessageBox(L"Process Token was retrieved successfully");
    if(tokenHandle)
        CloseHandle(tokenHandle);
}

Code for getting user information from the token:

void CImpersonationDlg::FillUserInformationFromToken(HANDLE Token)
{
    TCHAR user[MAX_PATH], domain[MAX_PATH];
    DWORD sizeSID;
    DWORD sizeUser = sizeof(user);
    DWORD sizeDomain = sizeof(domain);

    SID_NAME_USE sidNameUse;
    TOKEN_USER* tokenUser = (TOKEN_USER*)malloc(MAX_PATH);
    TCHAR* sidString;
    if(!GetTokenInformation(Token, TokenUser, tokenUser, MAX_PATH, &sizeSID))
    {
        PrintError(L"Unable to retrieve user info.");
        return;
    } else
    {
        ConvertSidToStringSid(tokenUser->User.Sid, &sidString);
        textSID.SetWindowText(sidString);
        LocalFree(sidString);
    }
    if(!LookupAccountSid(NULL, tokenUser->User.Sid, user, &sizeUser, domain, &sizeDomain, &sidNameUse))
    {
        PrintError(L"Unable to retrieve user infomation (UserName and Domain). Only SID was retrieved");

    } else
    {
        textDomain.SetWindowText(domain);
        textUserName.SetWindowText(user);
        //textPassword.SetWindowText(L"nopassword");
    }
}

Impersonating the process user (button Impersonate Self)

After doing this you can retrieve the thread token.

Code:

void CImpersonationDlg::OnBnClickedButtonImpersonate()
{
    // TODO: Add your control notification handler code here
    HANDLE tokenHandle;
    ClearFields();
    if(!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &tokenHandle))
    {
        PrintError(L"Unable to get Current Process Token");
        return;
    }
    if(!ImpersonateLoggedOnUser(tokenHandle))
    {
        PrintError(L"Unable to impersonate credential. Try 'Interactive Logon' instead.");
    } else
    {
        AfxMessageBox(L"Impersonation from Process Token was sucessful");
        btnRevertToSelf.EnableWindow();
        ClearFields();
        FillUserInformationFromToken(tokenHandle);

    }
    if(tokenHandle)
        CloseHandle(tokenHandle);

}

Impersonating User you typed in

In this option you can choose whether to Logon as Network token or Logon as a user. If the user has no logon rights in the computer the attempt will fail (and you would probably would get no error from NETWORK logon). Logging on as network will not enable you to access both Process and Thread tokens (“Revert to Self” will resolve the problem in this case).

Code:

void CImpersonationDlg::OnBnClickedButtonProcessset()
{
    // TODO: Add your control notification handler code here
    HANDLE token;
    TCHAR userName[MAX_PATH], domain[MAX_PATH], password[MAX_PATH];
    textUserName.GetWindowText(userName, sizeof(userName));
    textDomain.GetWindowText(domain, sizeof(domain));
    textPassword.GetWindowText(password, sizeof(password));
    textSID.SetWindowText(L"");

    DWORD logonType = LOGON32_LOGON_NETWORK;
    if(chkInteractive.GetCheck() == BST_CHECKED)
        logonType = LOGON32_LOGON_INTERACTIVE;
    if(!LogonUser(userName, domain, password, logonType, LOGON32_PROVIDER_DEFAULT, &token))
    {
        PrintError(L"Unable to logon with user credential.");
    } else
    {
        if(!ImpersonateLoggedOnUser(token))
        {
            PrintError(L"Unable to impersonate credential.");
        } else
        {
            AfxMessageBox(L"Impersonation was sucessful. You may want to Impersonate Self now.");
            btnRevertToSelf.EnableWindow();
            ClearFields();
            FillUserInformationFromToken(token);

        }
    }
    if(token)
        CloseHandle(token);
}

Reverting to Self

Returns to the user that initiated the application.

Code:

void CImpersonationDlg::OnBnClickedReverttoself()
{
    // TODO: Add your control notification handler code here
    // TODO: Add your control notification handler code here
    if(!RevertToSelf())
    {
        PrintError(L"Unable to revert to self.");
    } else
    {
        AfxMessageBox(L"Revert to Self was successful.");
    }

}

You cannot edit list or document library items on existing SharePoint sites

Rodney Viana - MSFT - DSI Team — Thu, 17 Dec 2009 02:19:30 GMT

This problem was fixed in KB961175. The patch will keep the problem from happening again in new lists/libraries you create after applying the patch. However if you have a backup before the patch the restored contents will continue to show the same error. It is also true to existing items. In order to fix this other issue, Microsoft released KB971351 showing some code to fix the problem in existing items. There are two code blocks: one for webs and another for lists. At the time of this writing the codes contained some minor typos and also some memory leaks. Nothing that would prevent a developer to make it work. The memory leak is not an issue as well since it is supposed to only run once. I understand that most of the support people are not that into coding, I put together a more intuitive code together which can be downloaded here (including executable):

http://rodneyviana.codeplex.com/

How do you know you are experience this problem?

The symptom is having someone with full access to a site collection, web, list or document library being unable to edit list items (user receives access denied) however user can see list items using view item.

Source Code:

You know the disclaimer: I work for Microsoft but the code I put in codeplex is NOT endorsed by Microsoft. This is a community tool and must be treated as such. That being told, the application complies with Microsoft best practices and can be used in your environment if you are experiencing the problems described in KB961175. The application will not change anything if you are not facing the problem described.

This is the full source code:

using System;
using System.Collections.Generic;
using System.Text;
using Microsoft.SharePoint;
using System.Xml;

namespace KB971351
{
    class Program
    {
        static private string RenderXMLPattenAttribute = "RenderXMLUsingPattern";
        static private string webUrl = "http://localhost";

        static void FixList()
        {
            Console.Write("Please enter web site (http://localhost): ");
            string inputWeb = Console.ReadLine();
            if (!String.IsNullOrEmpty(inputWeb))
                webUrl = inputWeb;
            Console.WriteLine("\nTrying to open web site: {0}", webUrl);
            string listName = null;
            try
            {
                using (SPSite site = new SPSite(webUrl))
                {
                    Console.WriteLine("Web site {0} found", webUrl);
                    using (SPWeb web = site.OpenWeb())
                    {
                        while (String.IsNullOrEmpty(listName))
                        {
                            Console.Write("Enter list name or press [enter] to display all lists: ");
                            listName = Console.ReadLine();
                            if (String.IsNullOrEmpty(listName))
                            {
                                for (int i = 0; i < web.Lists.Count; i++)
                                {
                                    if (!web.Lists[i].Hidden)
                                        Console.WriteLine(web.Lists[i].Title);
                                }
                            }

}

                        SPList list = web.Lists[listName];
                        SPField f = list.Fields.GetFieldByInternalName("PermMask");
                        string s = f.SchemaXml;
                        XmlDocument xd = new XmlDocument();
                        xd.LoadXml(s);
                        XmlElement xe = xd.DocumentElement;
                        if (xe.Attributes[RenderXMLPattenAttribute] == null)
                        {
                            XmlAttribute attr = xd.CreateAttribute(RenderXMLPattenAttribute);
                            attr.Value = "TRUE";
                            xe.Attributes.Append(attr);
                            string strXml = xe.OuterXml;
                            f.SchemaXml = strXml;
                            Console.WriteLine("SUCESS: problem identified in KB 971351 was found and fixed");
                        }
                        else
                        {
                            Console.WriteLine("WARNING: problem identified in KB 971351 was NOT found. No change was made");
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine("\nApplication Failed with error: {0}", ex.Message);
                Console.WriteLine("No changes were made. Please run application again");

}

        static void FixWeb()
        {
            Console.Write("Please enter web site (http://localhost): ");
            string inputWeb = Console.ReadLine();
            if (!String.IsNullOrEmpty(inputWeb))
                webUrl = inputWeb;
            Console.WriteLine("\nTrying to open web site: {0}", webUrl);
            try
            {
                using (SPSite site = new SPSite(webUrl))
                {
                    Console.WriteLine("Web site {0} found", webUrl);
                    using (SPWeb web = site.OpenWeb())
                    {
                        SPField f = web.Fields.GetFieldByInternalName("PermMask");
                        string s = f.SchemaXml;
                        XmlDocument xd = new XmlDocument();
                        xd.LoadXml(s);
                        XmlElement xe = xd.DocumentElement;
                        if (xe.Attributes[RenderXMLPattenAttribute] == null)
                        {
                            XmlAttribute attr = xd.CreateAttribute(RenderXMLPattenAttribute);
                            attr.Value = "TRUE";
                            xe.Attributes.Append(attr);
                            string strXml = xe.OuterXml;
                            f.SchemaXml = strXml;
                            Console.WriteLine("SUCESS: problem identified in KB 971351 was found and fixed");
                        }
                        else
                        {
                            Console.WriteLine("WARNING: problem identified in KB 971351 was NOT found. No change was made");
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine("\nApplication Failed with error: {0}", ex.Message);
                Console.WriteLine("No changes were made. Please run application again");

}

        static void Main(string[] args)
        {
            Console.WriteLine("Implementation of code in KB 971351");
            Console.WriteLine("====================================");
            Console.WriteLine("Written by Rodney Viana");
            Console.WriteLine("More info at http://blogs.msdn.com/rodneyviana and http://support.microsoft.com/kb/971351 \n");
            Console.WriteLine("This sample application is supplied \"AS IS\"");
            Console.WriteLine("It is ONLY for demonstration/proof of concept purposes");
            Console.WriteLine("If you DO NOT agree with the license at:\n\thttp://www.codeplex.com/rodneyviana/license\n\tPress Ctrl+C\n\n\n");
            Console.WriteLine("Choose one of the options below:");
            Console.WriteLine("0. If you don't want to do it now and end the application");
            Console.WriteLine("1. If you are experiencing problems in anye web site fields");
            Console.WriteLine("2. If you are experiencing problems in a list or document library");
            ConsoleKeyInfo key = new ConsoleKeyInfo();
            while(key == null || (key.KeyChar != '0' && key.KeyChar != '1' && key.KeyChar != '2'))
            {
                key = Console.ReadKey();
            }

            if(key.KeyChar == '1')
            {
                Console.WriteLine("You have chosen to fix a web site");
                FixWeb();
            }

            if(key.KeyChar == '2')
            {
                Console.WriteLine("You have chosen to fix a list");
                FixList();
            }

            if(key.KeyChar == '0')
            {
                Console.WriteLine("You have chosen to abort application");
            }
            Console.Write("Press any key...");
            Console.ReadKey();

}
}
}

MOSS Load Test

Rodney Viana - MSFT - DSI Team — Thu, 03 Sep 2009 08:23:17 GMT

I had put together an application to perform Load Test in both Microsoft Office SharePoint Server (MOSS) 2007 and Windows SharePoint Services (WSS) 3.0. The application as it is now is more “Load” than “Test”. The next step will be to save the results in a database and enable live queries. I am planning to use the Jet Database (Access). I am releasing this intermediate version because if used with other tools it can complete the cycle. This can be used to test capacity problems before publishing a SharePoint portal.

This is how the application works: you enter a SharePoint URL (Web Collection or Web) and the application enumerates all items (lists, list items, webs, sub-webs, documents, pages etc) and hit each once for every user you define. In the screen below we will simulate 5 users hitting the site for 30 minutes. You can run the application from any workstation. You don’t have to run it from the server. All operations used in this application are supported in production environment (i.e. it only uses webservices and browser requests) and it does not alter any configuration nor add any content. It access the information in a similar way of SharePoint Designer’s.

When you click the “Start” button you are asked to enter your credentials (no anonymous or FBA authentication since it will use the webservices to enumerate the content). Choose current user or enter the credentials if you don’t have the appropriate rights.

After logging in, the application will enumerate all items and hit them. In this fiddler except you can see how it silently works:

If there is any error (unauthorized user, resource not found or time out) it will show up in the error list view. Note that some errors from SharePoint will not show in this version as it does not return a status error. A tool like Fiddler can help in this gap.

Full Project including source code can be found here:

http://mossloadtest.codeplex.com/

I plan to continue this project and feedback is highly appreciated via this blog.

Notice that this is another private project and it is not endorsed or supported by my employer Microsoft. I will try my best to answer questions and fix bugs, but it is an application AS IS.

Presenting MOSS Support Explorer (Not even Beta Yet)

Rodney Viana - MSFT - DSI Team — Thu, 13 Aug 2009 04:50:53 GMT

There are some occasions in the course of work as Support Escalation Engineer in Microsoft that we rely heavily in analyzing SharePoint metadata. Installing software in a production environment is a no-no for most companies (or at least it requires a change control request). I had put together a few features in an Explorer like SharePoint GUID that uses web-services and thus does not have to be installed in the server (any desktop will do). The way it is now, it is still very incipient but it enables you to verify most of internal metadata of lists definition and results sets. I had put it in codeplex a long time a go and planned to get back to work with it again soon. This time actually never came. Now, a friend in Australia volunteered to help me finish the application. I am also bringing this back to life because a colleague here at Microsoft, Yuri Diogenes, from the Security Team worked with me in a MOSS/ISA issue and found the application helpful to identify Alternate Access Mapping (AAM) and Host Headers issues. The application let's you choose your authentication mode with SharePoint (User/Password, Current User or Certificate).

After connecting, it lists all site collection lists and libraries:

Including the metadata internals:

You can download it here:

http://www.codeplex.com/MOSSSupportExplorer

The full source code is also included. Please noticed that this is a personal project I put in Codeplex. This is not a Microsoft Product.

Blobcache will not work if the request url is not in the Alternate Access Mapping list

Rodney Viana - MSFT - DSI Team — Wed, 24 Jun 2009 07:50:00 GMT

There are scenarios on which you can access a unique site collection using different URLs even if these URLs are not listed in the Alternate Access Mapping (AAM) of the application. This normally does not cause any problem and even though you should not, you can live without adding DNS/Netbios aliases to AAM. If you plan to use blob cache, however, make sure that you list all URLs you may think of in the AAM.

One probable and common scenario is that on which you have multiples Web Front End (WFEs) and they are reached via Network Load Balancer (NLB). You did not add any host header when you created the web application and yet you can access the web application using both the local server name (eg. MOSS-WFE01) or the DNS entry (eg. http://myportal.contoso.com). However, when you add blob cache functionality to the site (see how to do this here), the cache does not seem to (and actually does not) work.

It happens because blob cache serving and caching happens in a level above SharePoint. It relies on the class HttpApplication rather than WebApplication. If necessary it goes to SharePoint to get the content and cache or just skip the file. If the file is already cached it retrieves from the file system rather than via SharePoint. At some point the blob cache trims the resource accordingly to user permission. At this point SharePoint has to be inquired and if part of the URL containing the web application is not in the AAM, SharePoint will assume the user has no rights and will not return anything at all.

How to verify if I am using the correct Alternate Access Mapping in my Network Load Balancer

Knowing the exact host header coming from the NLB is not so easy. Depending on the configuration, the NLB may use just an IP address or a FQDN. In order to find out do the following.

1. Enable IIS logging by selecting Web Sites, right-clicking and choosing properties.

2. In Properties/Advanced make sure Host (cs-host) is enabled.

3. Clear the cache in the web browser in any workstation (make sure the request will go through the NLB) and hit a couple of pages to populate the log

4. Navigate to the log file in the server you made the change (normally c:\windows\system32\LogFiles) and fin the latest file. You will something like this (in this example cs-host = team.learning.local):

5. Make sure the host header is listed in the Alternate Access Mapping (Central Administration | Operations | Alternate Access Mapping | Edit Public Url | Choose Web Application):

*** UPDATE: I submitted this blog entry as KB and it was published here:

http://support.microsoft.com/kb/2000283

*** UPDATE 2: See this article for instructions on how to add log fields in IIS 7.x

http://technet.microsoft.com/en-us/library/cc754702(WS.10).aspx

The fine art of updating MOSS 2007 and WSS 3.0

Rodney Viana - MSFT - DSI Team — Wed, 20 May 2009 04:42:52 GMT

Let's face it, updating Sharepoint is not an easy task. It is true for both Microsoft Office Sharepoint Server (MOSS) 2007 and Windows Sharepoint Services 3.0. Let's highlight some points:

MOST IMPORTANT: MOSS is built on top of WSS and you have to apply WSS and MOSS updates on MOSS installation
You have to install localized versions of the updates even if you only uses English
If you have MOSS, you have to install localized version of the updates even if you use English only
VERY IMPORTANT: A later update patch DOES NOT include previous patches, so you may have to install a series of patches to get to a specific version. For example, August CU requires you to install SP1, Infrastructure Updates and other patches to be installed before.
The only reliable information about current and past update paths can be found at http://blogs.msdn.com/sharepoint
Before December Cumulative Update (CU) Uber Package, you were supposed to download a patch for each additional language you have installed in your farm.

How to update:

First, know where you are now. The way to know your version is going to Central Administration | Operations | Servers in Farm. The version will be shown in the page. This version will not tell you all as you have other components besides the server version. Some people, including me, prefer to check the version in the files. To get the version of the files, we use SPSReports.

SPSReports will generate a large amount of captured files. The file version will be available at <SERVERNAME>_WSEVer.TXT. This is an excerpt of such file (showing SP1 files):

    c:\program files\common files\microsoft shared\web server extensions\12\bin\*.*
--a-- W32i   DLL ENU         6.6.7.5 shp 1,030,144 02-21-2007 dbghelp.dll
--a-- W32i   APP   - 12.0.4518.1016 shp     23,824 11-08-2006 hcinstal.exe
--a-- W32i   DLL   - 12.0.4518.1014 shp    123,232 10-26-2006 microsoft.office.irm.formprotector.dll
--a-- W32i   DLL   - 12.0.4518.1014 shp     38,736 10-26-2006 microsoft.office.irm.msoprotector.dll
--a-- W32i   DLL   - 12.0.4518.1014 shp     34,640 10-26-2006 microsoft.office.irm.ofcprotector.dll
--a-- W32i   DLL   - 12.0.6211.1000 shp     92,000 08-24-2007 msscntrs.dll
--a-- W32i   APP   - 12.0.6211.1000 shp    282,496 08-24-2007 mssdmn.exe
--a-- W32i   APP   - 12.0.6211.1000 shp    159,648 08-24-2007 mssearch.exe
--a-- W32i   DLL   - 12.0.6211.1000 shp    694,104 08-24-2007 mssph.dll
--a-- W32i   DLL   - 12.0.6211.1000 shp 2,059,104 08-24-2007 mssrch.dll
--a-- W32i   DLL   - 12.0.6212.1000 shp 1,079,200 09-02-2007 offparser.dll
--a-- W32i   DLL   - 12.0.6219.1000 shp 3,012,136 11-15-2007 owssvr.dll
--a-- W32i   DLL   - 12.0.6211.1000 shp     26,496 08-25-2007 oisimg.dll
--a-- W32i   DLL   - 12.0.4518.1016 shp     26,456 11-08-2006 oleparser.dll
--a-- W32i   DLL   - 12.0.6211.1000 shp    357,264 08-25-2007 onetnative.dll
--a-- W32i   DLL   - 12.0.6219.1000 shp 1,983,528 11-16-2007 onetutil.dll
--a-- W32i   DLL   - 12.0.4518.1014 shp    100,144 10-27-2006 osafehtm.dll
--a-- W32i   APP   - 12.0.6211.1000 shp     58,232 08-25-2007 owstimer.exe
--a-- W32i   DLL   - 12.0.4518.1014 shp    400,200 10-26-2006 microsoft.office.policy.dll
--a-- W32i   DLL   - 12.0.4518.1014 shp     52,040 10-26-2006 microsoft.office.workflow.tasks.dll
--a-- W32i   DLL   - 12.0.6211.1000 shp 6,407,584 08-24-2007 microsoft.sharepoint.portal.dll
(....)

Depending on the product, there will be files with more significance than others and be aware that not all files will be updated to the latest build. In the excerpt above oleparser.dll is still in version 12.0.4518 (RTM version) while owssrv.dll is in SP1 (12.0.6219).

Checking your version:

For WSS Global: Check OWSSVR.dll
For WSS Local: normally by checking the localized javascript version and comparing with the global javascript files and by mssmsg.dll (it may vary - see Knowledge Base method later in this post)
For MOSS Local: normally by checking the localized javascript version and comparing withe the global javascript files and by Htmlchkr.dll (it may vary - see knowledge Base method later in this post)
For MOSS Global: Check Microsoft.Sharepoint.Portal.dll (also make sure all other updates as WSS and DLC are compatible with the build, I will talk about it later)
For Document Lifecycle Management (DLC) aka Workflow: highest version between microsoft.office.policy.dll and microsoft.office.workflow.tasks.dll
For Infrastructure Updates (IU): It varies (see Knowledge Base method later in this post)

Checking what takes to get up-to-date

As I told you before, the Sharepoint Team blog is the most reliable source of update path. If you want to update to the latest recommended version or just fix a previous update not working so well because you did not know that WSS updates was also mandatory, you better check the blog. Other reason to fix a previous update is when your javascript yields an error every time you try to edit a rich edit field or it only yields an error when you are not editing in English.

One of the problems I see occasionally in my work at Microsoft is clients who were not aware they had to install the language patch update for every language they have in addition to the local English patch. One symptom of the problem is the Javascript errors I mentioned. Sometimes they prefer to wait for SP2 and avoid to update in all Cumulative Updates released. Before December CU, all other patches required a long list of prerequisites. My colleague Robert Gullick put together a list for all paths up to December CU.

The new updates make things easier. For example, October CU required at least 4 patches (if you don't have other languages installed) while December CU only requires two patches no matter how many languages you have installed.

Let's take a look at the requirements for having October CU in MOSS (i.e. update path):

KB936988 - WSS SP1 + LanguagePack SP1 - 6219
KB957109 - WSS August CU Local - 6327
KB957691 - WSS October CU Global - 6332
KB936984 - MOSS SP1 + Language Pack SP1 - 6219
KB955586 - MOSS DLC Component Update Local - 6324
KB955937 - MOSS Excel Services security update - 6324 *
KB958569 - MOSS DLC Component Update Global - 6331
KB958567 - MOSS October CU Local - 6331
KB957693 -MOSS October CU Global - 6331

If you had installed any of the KBs in the path you don't have to install the KB again. And now we finally will talk about how to use the KB method.

How to identify if the KB is already installed (Knowledge Base method)

Unfortunately the KBs are not visible in Add/Remove Programs in Control Panel. But the information is in the registry. Let's say I want to check if KB958569 is installed or not.

Open Registry Editor (Start | Run | Regedit.exe)
Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Press Ctrl+F to start a search
Look for the KB number by entering only the number without the prefix (eg. 958569)
If you find it under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall it is because it is installed.
This method is not so reliable because it does not keep track of past KB installed but it can be a good start
You can issue the command "reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall uninst.txt" to dump the registry info in the text file.

How to download a specific KB hotfix (don't forget the local patches also)

Some hotfixes do not have an immediate public download place. You have to request. Please see the sample below for KB 958567 which is local update (and must be installed for each language you have in your environment).

The KB is located here:

http://support.microsoft.com/kb/958567

for other KBs, just change the number in the url.

The hotfix can be download here:

http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=958567

Notice that you will be offered only the English version initially. Click on “Show hotfixes for all platforms and languages” and it will show for all languages and architectures (x86 and x64).

Choose all languages and architectures that apply. You will receive an e-mail with instructions on how to download the patch.

Please follow these for all patches.

Getting Sharepoint Site/Web Context in a Console Application

Rodney Viana - MSFT - DSI Team — Wed, 20 May 2009 04:35:00 GMT

I had recently faced a problem which I believe other people will face at least once: how to get the context from a URL in a C# Console Application. I needed to use ProfileLoader which requires a context. You cannot get current context when you run an application outside a Sharepoint page (like in Windows or Console Application). The solution below gets a context from the topology (which happens to be deprecated but works) and get all properties from the profile. See the sample code below:

using System;
using System.Collections.Generic;
using System.Text;
using Microsoft.Office.Server.UserProfiles;
using Microsoft.Office.Server;
using Microsoft.SharePoint.Portal;
using Microsoft.SharePoint.Portal.Topology;
using Microsoft.SharePoint;
using System.Web;

namespace TestProperties
{
    class Program
    {
        static void Main(string[] args)
        {
            //get portal site context from topology
            string strUrl = "http://myserver";
            TopologyManager tm = new TopologyManager();
            PortalSite ps = tm.PortalSites[new Uri(strUrl)];
            PortalContext pc = PortalApplication.GetContext(ps);
            ServerContext sc = pc.ServerContext;

PropertyCollection props = ProfileLoader.GetProfileLoader(sc).GetUserProfileManager().Properties;

            foreach (Property prop in props)
            {
                if (prop.Type != PropertyDataType.Binary && prop.DefaultPrivacy == Privacy.Public)
                {
                    Console.WriteLine("{0} - {1}", prop.DisplayName, prop.Name);
                }
            }

}
}
}

How to test the Mail Settings for a Sharepoint Web Application

Rodney Viana - MSFT - DSI Team — Thu, 06 Nov 2008 05:05:04 GMT

WSS and MOSS enable outgoing e-mail configuration and most of the time this configuration is straightforward. As of matter of fact you do not have much to configure as shown below:

Figure 1 - Outgoing e-mail settings

This same configuration is used for alerts and notifications as it is for invitations. Most of the e-mail sending is accomplished by OWSTIMER.EXE (The Sharepoint Timer Service) which run as the Farm Administrator Account in all servers in the farm. When you have alerts sending e-mail most of the time and failing just occasionally, it is possible that one of the servers is not able to deliver the e-mail. Testing e-mail delivery in WFEs (Web Front Ends) is easier, since adding someone to a site and sending a welcome (see screenshot below) mail will force Sharepoint to send the e-mail from the WFE serving the request and the result is shown immediately when you press OK. It may bring some extra configuration to identify the WFE if you are using NLB (Network Load Balancer), but nothing compared to OWSTIMER.EXE identification problem.

Figure 2 - Sending Welcome mail is a fast to way to identify connection problems as the result is in the next page

However if you still have problems to identify why e-mails are not being delivered using the Welcome Page or the server you suspect is not serving pages you may need to run a few other tests. First, you have to check if the suspect server is reaching the SMTP server. You can use the basic ping and then try the telnet connection to see if you get the right response as specified in KB153119. If everything seems correct and you still have problem, try the following code:

(UPDATED)

using System;
using System.Collections.Generic;
using System.Text;
using Microsoft.SharePoint;
using Microsoft.SharePoint.Administration;
using Microsoft.SharePoint.Utilities;
using System.Net.Mail;

namespace SendMail
{
    public class MailServerInfo
    {
        protected string server;

        public string Server
        {
            get { return server; }
        }
        protected string from;

        public string From
        {
            get { return from; }
        }
        protected string replyTo;

        public string ReplyTo
        {
            get { return replyTo; }
        }

        public MailServerInfo(SPSite spSite)
        {
            server = "(empty)";
            from = "(empty)";
            replyTo = "(empty)";
            SPWebApplication spWebApplication = spSite.WebApplication;
            if (spWebApplication.OutboundMailServiceInstance != null)
            {
                from = spWebApplication.OutboundMailSenderAddress;
                replyTo = spWebApplication.OutboundMailReplyToAddress;
                SPOutboundMailServiceInstance smtpServer = spWebApplication.OutboundMailServiceInstance;
                server = smtpServer.Server.Address;
            }

}

        public string ServerInformation
        {
            get
            {

return String.Format("Site Specific - server: {0}, From: {1}, ReplyTo: {2}",
server, from, replyTo);

            }
        }
    }

class Program
{

        static void Main(string[] args)
        {
            Console.WriteLine("Sharepoint e-mail configuration tester");
            Console.WriteLine("======================================");
            Console.WriteLine("Written by Rodney Viana");
            Console.WriteLine("More info at http://blogs.msdn.com/rodneyviana\n");
            Console.WriteLine("This sample application is supplied \"AS IS\"");
            Console.WriteLine("It is ONLY for demonstration/proof of concept purposes");
            Console.WriteLine("If you DO NOT agree with the license at:\n\thttp://www.codeplex.com/rodneyviana/license\n\tPress Ctrl+C");
            Console.Write("Press any other key to continue...");
            Console.ReadKey();
            Console.Write("\n\nPlease enter url (eg.: http://localhost):");
            string siteUrl = Console.ReadLine();

            try
            {
                using (SPSite spSite = new SPSite(siteUrl))
                {
                    using (SPWeb web = spSite.OpenWeb())
                    {
                        if (web == null)
                        {
                            Console.WriteLine("Web could not be found (OpenWeb returned null). Aborting.");
                            return;
                        }
                        Console.WriteLine("The site has been found at " + web.Url);
                        Console.Write("Please enter recipient login name (eg. domain\\administrator): ");
                        string login = Console.ReadLine();
                        string displayName = "";
                        string emailAddress = "";
                        try
                        {
                            SPUtility.GetFullNameandEmailfromLogin(web, login, out displayName,
                                out emailAddress);
                        }
                        catch (Exception ex)
                        {
                            Console.WriteLine("Unable to get user information.");
                            Console.WriteLine("Error: "+ex.Message);
                            Console.Write("Press any key...");
                            Console.ReadKey();

                            return;
                        }
                        Console.WriteLine("Display Name: {0}\nE-mail: {1}", displayName,
                            emailAddress);
                        string subject = "Test message";
                        string body = "Testing app message";
                        MailServerInfo serverInfo = new MailServerInfo(spSite);

                        string server = serverInfo.Server;
                        string replyTo = serverInfo.ReplyTo;
                        string from = serverInfo.From;

Console.WriteLine(serverInfo.ServerInformation);
Console.WriteLine("Trying to send e-mail via Sharepoint...");

                        if (!SPUtility.SendEmail(web, true, true, emailAddress, subject, body))
                        {
                            Console.WriteLine("Error: Unable to send e-mail via Sharepoint");
                            Console.WriteLine("Trying via SMTP...");

                            SmtpClient client;
                            try
                            {
                                client = new SmtpClient(server);
                            }
                            catch (Exception ex)
                            {
                                Console.WriteLine("Could not contact server");
                                Console.WriteLine("Error: " + ex.Message);
                                Console.Write("Press any key...");
                                Console.ReadKey();

                                return;
                            }
                            try
                            {

client.Send(from, emailAddress, subject, body);

                            }
                            catch (Exception ex)
                            {
                                Console.WriteLine("Unable to send via SMTP client");
                                Console.WriteLine("Error: " + ex.Message);
                                Console.Write("Press any key...");
                                Console.ReadKey();

                                return;
                            }
                            Console.WriteLine("E-mail has been sent successfully via SMTP client");

                        }
                        else
                        {
                            Console.WriteLine("E-mail has been sent successfully via Sharepoint");
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine("Unable to find url.");
                Console.WriteLine("Error: " + ex.Message);

            }
            Console.Write("Press any key...");
            Console.ReadKey();

}
}
}

You can download project and executable at http://www.codeplex.com/rodneyviana/Release/ProjectReleases.aspx?ReleaseId=19103.

If you are not much in software development you can extract only the .exe file (SendMail\SendMail\bin\Debug\SendMail.exe) and run it without installation. This application will send an e-mail using the farm's configuration. Enter the url of a valid site and a valid user login name which will be the recipient of the test message. The application will retrieve the e-mail information from the user login name. You must run the application from one of the servers in the farm.

Figure 3 - The application will resolve the recipient e-mail address as well as the farm's outgoing e-mail configuration

If the configuration is correct the intended recipient will receive the following e-mail:

Figure 4 - E-mail will be received if everything is configured correctly

If you can receive this e-mail and still are unable to receive e-mail from sharepoint check the Application Pool credential (in case of Welcome page) or web farm administrator account (in case of alert and other e-mails sent by OWSTIMER.EXE).

Org Chart Web Part - Part I - Overview and Download

Rodney Viana - MSFT - DSI Team — Fri, 25 Jul 2008 05:12:00 GMT

In this post we are going to explore User Profiles by extending the Organizational Hierarchy in MOSS. I've posted in Codeplex both installer and code for the Organizational Chart Hierarchy web part. This post will only discuss installation and configuration. I will discuss the code in posts to come.

What this webpart does:

This web part reads and analyzes the user profiles in MOSS and creates a full hierarchical organizational chart. See screenshot below:

What I need to make it work:

1. It requires MOSS (Microsoft Office Sharepoint Server) 2007.

2. It requires you have imported profiles from you AD.

3. In order to have the hierarchy displayed correctly you have to include managerial and department information for all users who have manager (see the example in the snapshot below).

4. You have to edit the departmentconfig.xml file if you want links to the department sites. After the install, this file normally is found at: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\TEMPLATE\LAYOUTS\OrgChartPart\. This file is only available after the install is complete.

5. Just edit, add or delete <Mapping Department="[Department Name As in Profile]">[url]</Mapping> entries as appropriate. The mapping must be exact. As the example below (this entry is case sensitive):

<Mapping Department="Operations">http://myweb/sites/operations</Mapping>

Installing Steps:

1. Download the latest release here: http://www.codeplex.com/orgchartpart/Release/ProjectReleases.aspx?ReleaseId=15590 and save in a folder you will remember later (eg. c:\downloads).

2. Go to MOSS Bin folder, commonly at C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN

3. Run the following commands from the command prompt when logged as farm administrator (assuming the .wsp file is in C:\Downloads):

stsadm -o addsolution -filename c:\downloads\OrgChartPart.wsp
stsadm -o deploysolution -name c:\downloads\OrgChartPart.wsp -allowgacdeployment -immediate
stsadm -o execadmsvcjobs

4. Go to the shared services provider you use for personalization in Central Administration.

5. Choose Personalization services permission under User Profiles and My Sites.

6. Make sure NT AUTHORITY\Authenticated Users has "Personal Features" and "Personal Site" rights.

7. Go to the site collection you want to include the web part (eg. http:/myweb).

8. Go to Site Actions | Site Settings | Modify All Site Settings

9. Go to Site Collection Features under Site Collection Administration

10. Activate Org chart Web Part

11. Verify if OrgChartPart is available in the Web Part Gallery of the Site Collection (Site Actions | Site Settings | Galleries | WebParts)

12. Add the web part wherever you want in a page

13. Make sure you adjust the web part to render correctly:

Notes:

The beautiful tree layout in Javascript was developed by the talented Emilio CL and can be found here: http://www.codeproject.com/KB/scripting/graphic_javascript_tree.aspx
Don't try it in a large Enterprise with over 500 user profiles. It will work but will be slow. A few modifications are necessary to enable better performance.
Next post will be about the source code.

Populating BDC fields from a query string in MOSS (Microsoft Office Sharepoint Server) 2007

Rodney Viana - MSFT - DSI Team — Fri, 06 Jun 2008 03:46:00 GMT

Whomever tried to populate a MOSS (Microsoft Office Sharepoint Server) form field using Javascript noticed that it is far from being straightforward. The secret is in the undocumented core.js After a client's request I was able to come up with a not so-intrusive Javascript solution.

You have to open the site in Sharepoint Designer, navigate to the list you want (in my example I used a list called "Public Details"), look for a spot in the html code and copy the Javascript code below to both EditForm.aspx and NewForm.aspx.

For each list in your site there will be a folder. For instance, let’s say you have a list called Public Details. In Sharepoint Designer you should edit files under site\Lists\Public Details as shown below (be aware these pages will be unghosted after that):

To test the application, just add the query string ?BDC=<value> to the url (eg. http://portal/Lists/Public+Details.aspx?BDC=123). See code below:

<script type="text/javascript" language="javascript" for="window" event="onload">

var elems = document.getElementsByTagName("DIV");
var bdcString="";

var queryString = document.location.search.split("&");

for (var i=0;i<queryString.length;i++) {
if ((queryString[i].split("=")[0]=="BDC") || (queryString[i].split("=")[0]=="?BDC")) bdcString=queryString[i].split("=")[1];
}

if(bdcString == "") return;

for (var i=0;i<elems.length;i++) {

if (elems[i].id.indexOf("_upLevelDiv") > 1)
{
        var subs = elems[i].id.substring(0,elems[i].id.indexOf("_upLevelDiv"));
        var upLevel = document.getElementById(subs+"_upLevelDiv");
        if(upLevel == null)
        {
         alert("error Up Level is invalid: "+subs+"\n"+upLevel);
         return;
        }
        var downlevel=document.getElementById(getSubControlID(subs, g_EntityEditorDownLevelId));
        downlevel.value = bdcString;
        var editor=document.getElementById(subs)
        SetInnerText(upLevel, bdcString);
      copyUplevelToHidden(subs);
}
}

</script>