Dr. Z's Blog

Where would you find ULS logs on Office Web Apps (OWA) 2013 server

2013-04-16T20:53:00Z

For my own record as well: C:\ProgramData\Microsoft\OfficeWebApps\Data\Logs\ULS

If you do not see C:\ProgramData folder, you need to change your explorer's viewing option to "Show hidden files, folders and drives".

Enjoy troubleshooting OWA!

Zewei Song, Ph.D.
Microsoft Certified Master: SharePoint 2010
Microsoft Consulting Services

Where Should You Store Your SharePoint Solution’s Configuration Data?

2012-03-27T18:37:00Z

This is a common scenario: you are designing a great SharePoint solution and you have some configuration information, such as URLs, connection strings, list names, and so on, that you have to deal with. What should you do?

The easiest and dirtiest way is hard-coding them in code. It maybe fine for a small and quick proof-of-concept but of cause you should not do it.

Next place is application config file. In the case of SharePoint solutions, it is the web.config. Configuration data stored in web.config is not hard-coded, easy to change (who doesn't like NotePad?), and very easy to access from code.

There are other places to store configuration data, SharePoint lists are also popular. The problem is that you have to store the lists’ sites and names somewhere else, otherwise you code would not know where to get the data. An external data store, such as SQL server, is also being used at some customers. Similarly, you have to deal with the data connection information separately as SharePoint lists.

However, in this blog I am going to recommend *NOT* to use any of the approaches mentioned above. To make my point, please check the comparison sheet below:

Place	Location	Data Management Tools	Backup	Pros	Cons	Should you do this
Code	GAC	Visual Studio	Server	Easy	Dirty	HELL NO!
web.config	File system	Notepad and so on…	Server	Easy	Multiple copies, hard to sync. Requires to restart app pool when changed. Not being backed up by SQL	No
SharePoint List	Content database	SharePoint web UI	Content db	Built-in UI, easy to manage	Have to store location data somewhere else. Too easy to manipulate	Maybe
External Data Source	External data source	Custom	Custom	You have full control	Have to store connection data somewhere else. Outside dependency.	Maybe not
Property Bag	Content database	Custom application page, utility	Content db	Backed up with content, on site and site collection levels	No built-in UI, have to create your own management tool	Yes
Hierarchical Object Store	Config database	Custom application page, utility	Config db	Backed up with config, on farm and web app levels	No built-in UI, have to create your own management tool	Yes

For storing configuration data for SharePoint solutions, I would like to recommend use either property bags or hierarchical object store, maybe together with SharePoint lists depends on the amount of data you are dealing with. Some people may argue that they do not have built-in UI, actually it could be a good thing in this case, because that means they are not likely to be altered by accident, and it is easier to control access.

Below are some useful links on property bags, hierarchical object store, and application pages:

Property bag:

Hierarchical object store:

Application page:

http://msdn.microsoft.com/en-us/library/ee231581.aspx

What about farm level SharePoint solutions? For example one of my customers developed a solution to support their enterprise search, some other customers developed timer jobs. Those solutions are not deployed for a specific site, site collection or a web application. Where should they store the configuration data?

The answer is to store the data in property bag in Central Admin or hierarchical object store, and deploy your application pages to CA. Here is an article about how to do it:

Get CA's URL: http://www.sytone.com/2010/07/getting-the-central-admin-url-for-a-farm-in-sharepoint/
Deploy an app page to CA: http://msdn.microsoft.com/en-us/library/ff798467.aspx

Zewei Song, Ph.D.
Microsoft Certified Master: SharePoint 2010
Microsoft Consulting Services

Dr. Z is Master Z now!

2012-03-26T00:23:00Z

I officially became a Microsoft Certified Master for SharePoint Server 2010 on March 22, 2012.

The journey began more than a year early. If you read my earlier blog (http://blogs.msdn.com/zwsong/archive/2011/02/24/passed-all-4-sharepoint-2010-mcp-exams-at-techready.aspx), you would know that I passed all 4 MCP exams for SharePoint 2010 in February 2011, and that was the hard pre-requisition for being accepted by MCM program.

Around April and May 2011, I started to consider if I wanted to pursue a MCM certificate. An MCM or Master title not only is the second highest Microsoft certificate (there is a higher MCA title for enterprise architects), but also highly respected by the whole industry.

However, MCM is not easy, actually it is very hard, time consuming and expensive to achieve. Not only do you have to spend large amount of time to prepare and take very intense trainings and exams, but also would cost more than $25,000, and significant billable hours (I am a consultant).

Fortunately, my manager was very supportive and was willing to spend the big amount of money for MCM on me. (Microsoft employees get less than 50% discount on MCM training and exam fees). So, like a fool, I decided to go down the route.

Here is a list of major events of my entire MCM experience:

Pass all SharePoint 2010 MCP exams (Feb. 2011)
Apply for MCM: online application with $250 fee (May 2011)
Submit resume and a write-up about my SharePoint projects (May 2011)
Telephone interviewed by MCM program manager and a SharePoint Master (July 2011)
Being accepted by MCM program and pick up a training rotation (July 2011)
Pay the MCM program fee ($25,000 minus discount) (July 2011)
Prepare for the rotation (July – early September 2011)
Attend the on-site 3-week MCM training rotation in Redmond, WA (September 2011)
Pass knowledge exam (September 2011)
Fail Hands-on Qualification Lab (September 2011)
Prepare for QualLab retake (October 2011 – March 2012)
Pick a slot for QualLab retake (February 2012)
Pay QualLab retake fee ($2,500 minus Microsoft discount) (February 2012)
Take the QualLab retake (March 20, 2012)
Pass the retake and officially become a MCM (March 22, 2012)

As you can see, it has been a very intense year for me and my team has spent a lot of money and lost quite some billable hours on it. And frankly speaking, I still couldn't believe I am a Master now. I still couldn't believe that my name will be listed with the world's best SharePoint gurus whom I look up to.

My many thanks go to my manager, MCM program managers, MCM instructorsm, my classmates at the rotation, and especially my wife and kids, they suffered when I was away preparing and going on training, they comforted me when I did not pass all the exams at first try, they supported my efforts and rejoiced when it had finally come.

Here are some links for the MCM program if you want to learn more about it:

MCM Overview: http://www.microsoft.com/learning/en/us/certification/master.aspx
MCMs and MCAs List: http://www.microsoft.com/learning/en/us/certification/master.aspx#meet
Master Blog: http://blogs.technet.com/themasterblog/

Zewei Song, Ph.D.
Microsoft Certified Master: SharePoint Server 2010
Microsoft Consulting Services

Set-MsolAdfscontext Authentication Error

2011-06-08T20:00:38Z

You are setting up Office 365 ADFS/SSO, you are connected to your Office 365 tenant with Microsoft Online Services Module for Windows PowerShell, you are trying to run Set-MsolAdfscontext -Computer <ADFS server FQDN> but keep getting prompted for your Windows credential and eventually receive an authentication error, you make sure that the Windows AD account you use has all the permissions and the ADFS server's FQDN is correct and there is no network issues between your server and the ADFS server, but it just would not let you to set the MSOnline ADFS context.

Turns out the fix is very simple: Run "Enable-PSRemoting -Force"cmdlet before your Set-MsolAdfscontext cmdlet.

This is what you do to set up an Office 365 SSO domain:

$cred=Get-Credential
Connect-MsolService -Credential $cred
Enable-PSRemoting -Force
Set-MsolAdfscontext -Computer <ADFS server FQDN>
New-MsolFederatedDomain -DomainName <Domain FQDN>

Enjoy Office 365!

Zewei Song, Ph.D.
MCPD, MCITP, MCTS: SharePoint 2010, .NET 3.5
Enterprise Services, Microsoft Corporation

This is what you would see in log file for this error:

6/6/2011 2:46:42 PM Command Set-MsolADFSContext invoked.
6/6/2011 2:46:42 PM Creating ADFS Server PS session.
6/6/2011 2:46:42 PM ContextCredentialsCommand:CreatePowerShellSessionToGenevaServer: Invoked.
6/6/2011 2:46:42 PM Creating PS session to 'adfsServer.contoso.com' ADFS server
6/6/2011 2:46:42 PM Connect using current logged-on user creds.
6/6/2011 2:46:42 PM Runspace Connection info: Scheme:http Port:5985, AuthenticationType:Default Uri:adfsServer.contoso.com AppName:wsman, Shell:http://schemas.microsoft.com/powershell/Microsoft.PowerShell
6/6/2011 2:46:42 PM Connection Uri: http://adfsServer.contoso.com:5985/wsman/
6/6/2011 2:46:42 PM Opening runspace to 'http://adfsServer.contoso.com:5985/wsman/'
6/6/2011 2:46:45 PM System.Management.Automation.Remoting.PSRemotingTransportException: Connecting to remote server failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.
at System.Management.Automation.Runspaces.AsyncResult.EndInvoke()
at System.Management.Automation.Runspaces.Internal.RunspacePoolInternal.EndOpen(IAsyncResult asyncResult)
at System.Management.Automation.Runspaces.RunspacePool.Open()
at Microsoft.Online.Identity.Federation.Powershell.PowerShellSession.VerifyAndReconnectRunSpacePool()
6/6/2011 2:46:45 PM fullyQualifiedErrorId: System.Management.Automation.Remoting.PSRemotingDataStructureException
6/6/2011 2:46:45 PM Command failed: Microsoft.Online.Identity.Federation.Powershell.IdentityFederationException: Connecting to remote server failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.
at Microsoft.Online.Identity.Federation.Powershell.PowerShellSession.ParseAndThrowErrorRecord(ErrorRecord errorRecord, String overRideErrorId)
at Microsoft.Online.Identity.Federation.Powershell.PowerShellSession.VerifyAndReconnectRunSpacePool()
at Microsoft.Online.Identity.Federation.Powershell.ContextCredentialsCommand.OpenToGenevaServer(PSCredential serverCredential)
at Microsoft.Online.Identity.Federation.Powershell.ContextCredentialsCommand.<>c__DisplayClass2.<CreatePowerShellSessionToGenevaServer>b__0()
at Microsoft.Online.Identity.Federation.Powershell.Utility.InvokeOperationWithRetry(Action operation, Type exceptionType, String errorId, Int32 retryCount, Int32 retryWaitTimeInMilliseconds)
6/6/2011 2:46:45 PM Retry errorId: ConnectionToGenevaServerFailed
6/6/2011 2:46:45 PM Retry exception: Microsoft.Online.Identity.Federation.Powershell.IdentityFederationException
6/6/2011 2:46:45 PM Going to sleep mode for 1000 milliseconds before reattempt - 2
6/6/2011 2:46:46 PM Runspace Connection info: Scheme:http Port:5985, AuthenticationType:Default Uri:adfsServer.contoso.com AppName:wsman, Shell:http://schemas.microsoft.com/powershell/Microsoft.PowerShell
6/6/2011 2:46:46 PM Connection Uri: http://adfsServer.contoso.com:5985/wsman/
6/6/2011 2:46:46 PM Opening runspace to 'http://adfsServer.contoso.com:5985/wsman/'
6/6/2011 2:46:49 PM System.Management.Automation.Remoting.PSRemotingTransportException: Connecting to remote server failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.
at System.Management.Automation.Runspaces.AsyncResult.EndInvoke()
at System.Management.Automation.Runspaces.Internal.RunspacePoolInternal.EndOpen(IAsyncResult asyncResult)
at System.Management.Automation.Runspaces.RunspacePool.Open()
at Microsoft.Online.Identity.Federation.Powershell.PowerShellSession.VerifyAndReconnectRunSpacePool()
6/6/2011 2:46:49 PM fullyQualifiedErrorId: System.Management.Automation.Remoting.PSRemotingDataStructureException
6/6/2011 2:46:49 PM Command failed: Microsoft.Online.Identity.Federation.Powershell.IdentityFederationException: Connecting to remote server failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.
at Microsoft.Online.Identity.Federation.Powershell.PowerShellSession.ParseAndThrowErrorRecord(ErrorRecord errorRecord, String overRideErrorId)
at Microsoft.Online.Identity.Federation.Powershell.PowerShellSession.VerifyAndReconnectRunSpacePool()
at Microsoft.Online.Identity.Federation.Powershell.ContextCredentialsCommand.OpenToGenevaServer(PSCredential serverCredential)
at Microsoft.Online.Identity.Federation.Powershell.ContextCredentialsCommand.<>c__DisplayClass2.<CreatePowerShellSessionToGenevaServer>b__0()
at Microsoft.Online.Identity.Federation.Powershell.Utility.InvokeOperationWithRetry(Action operation, Type exceptionType, String errorId, Int32 retryCount, Int32 retryWaitTimeInMilliseconds)
6/6/2011 2:46:49 PM Retry errorId: ConnectionToGenevaServerFailed
6/6/2011 2:46:49 PM Retry exception: Microsoft.Online.Identity.Federation.Powershell.IdentityFederationException
6/6/2011 2:46:49 PM Going to sleep mode for 2000 milliseconds before reattempt - 3
6/6/2011 2:46:51 PM Runspace Connection info: Scheme:http Port:5985, AuthenticationType:Default Uri:adfsServer.contoso.com AppName:wsman, Shell:http://schemas.microsoft.com/powershell/Microsoft.PowerShell
6/6/2011 2:46:51 PM Connection Uri: http://adfsServer.contoso.com:5985/wsman/
6/6/2011 2:46:51 PM Opening runspace to 'http://adfsServer.contoso.com:5985/wsman/'
6/6/2011 2:46:54 PM System.Management.Automation.Remoting.PSRemotingTransportException: Connecting to remote server failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.
at System.Management.Automation.Runspaces.AsyncResult.EndInvoke()
at System.Management.Automation.Runspaces.Internal.RunspacePoolInternal.EndOpen(IAsyncResult asyncResult)
at System.Management.Automation.Runspaces.RunspacePool.Open()
at Microsoft.Online.Identity.Federation.Powershell.PowerShellSession.VerifyAndReconnectRunSpacePool()
6/6/2011 2:46:54 PM fullyQualifiedErrorId: System.Management.Automation.Remoting.PSRemotingDataStructureException
6/6/2011 2:46:54 PM Command failed: Microsoft.Online.Identity.Federation.Powershell.IdentityFederationException: Connecting to remote server failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.
at Microsoft.Online.Identity.Federation.Powershell.PowerShellSession.ParseAndThrowErrorRecord(ErrorRecord errorRecord, String overRideErrorId)
at Microsoft.Online.Identity.Federation.Powershell.PowerShellSession.VerifyAndReconnectRunSpacePool()
at Microsoft.Online.Identity.Federation.Powershell.ContextCredentialsCommand.OpenToGenevaServer(PSCredential serverCredential)
at Microsoft.Online.Identity.Federation.Powershell.ContextCredentialsCommand.<>c__DisplayClass2.<CreatePowerShellSessionToGenevaServer>b__0()
at Microsoft.Online.Identity.Federation.Powershell.Utility.InvokeOperationWithRetry(Action operation, Type exceptionType, String errorId, Int32 retryCount, Int32 retryWaitTimeInMilliseconds)
6/6/2011 2:46:54 PM Retry errorId: ConnectionToGenevaServerFailed
6/6/2011 2:46:54 PM Retry exception: Microsoft.Online.Identity.Federation.Powershell.IdentityFederationException
6/6/2011 2:46:54 PM Failure after too many retries attempts..
6/6/2011 2:46:54 PM Wrong credentials to ADFS Server connection, attempt #'1'
6/6/2011 2:46:54 PM Prompting the user for 'adfsServer.contoso.com' ADFS Server creds.
6/6/2011 2:46:54 PM ContextCredentialsCommand:GetServerCredentials: Invoked.

Killing two birds with one stone: SharePoint HA and DR with stretch farm, and everything you want to know about it

2011-04-04T17:10:00Z

A single SharePoint farm running across multiple data centers is called a “stretch farm”. Using a stretched SharePoint farm, you can provide fault tolerance by following the standard guidance for making databases and service applications redundant. Therefore you can achieve high availability and disaster recovery at the same time.

You can follow this articles to set up a stretch farm using SQL mirroring: http://technet.microsoft.com/en-us/library/dd207314.aspx

Following Q&As are based on my real-world experiences with SQL mirror and SharePoint stretch farm.

Questions and Answers (DC stands for Data Center):

What are the requirements for setting up a SharePoint stretch farm?
For a stretched farm to work, there must be less than 1 millisecond latency between all the SQL Servers and the front-end Web servers in one direction, and at least 1 gigabit per second bandwidth.
Where to put the witness server?
Put the witness server in the most reliable DC. If the secondary DC is more reliable and the connection between the DCs is at least as reliable as the DCs, you can put the witness in the secondary DC, otherwise, it should be in the primary DC.
What is the minimum firewall requirements for the witness server?
Open up the TCP port of the SQL mirroring endpoint for inbound traffic.
Can I use SQL Express as the witness?
Yes, you can.
How to test a stretch farm?
You can simulate a failed SQL server by stopping its service using SQL Management Studio. Open the studio, connect to the SQL instance and right click on the instance name on the left pane and select Stop command. If the SQL instance is the principal, the mirror SQL instace will take over the principal role and the SharePoint farm will come back to service within a few seconds.
How to manually failover from one DC to another DC?
Run following T-SQL command on the principal SQL server instance. You need to run the command for each database.

ALTER DATABASE <your database name> SET PARTNER FAILOVER
What to do when I lose the primary DC?
When you have the witness server in primary DC and the whole DC is gone (disaster happens), the mirror SQL instance will become "Principal - In Recovery" but won't serve data. To bring it back online so your SharePoint services resume, you need to run following T-SQL commands. You have to do it for all of your databases.

ALTER DATABASE <your database name> SET PARTNER OFF

RESTORE DATABASE <your database name> WITH RECOVERY

Above commands break the mirroring partnership. You have to backup/restore the databases and resume the partnership after the primary DC is recovered.
If the witness server is in the secondary DC, the mirror SQL instance will automatically become the principal server, your SharePoint farm will resume services in a few seconds.
What to do when the primary DC is recovered after a disaster?
Assume you already ran the commands to break the mirror partnership. You have to follow the steps to resume it. Note the principal SQL instance is in the secondary DC at this point:
1. On the principal server, back up all SharePoint databases.
2. Copy the backup files to the mirror database server. The server should be running on stand-alone mode.
3. Delete all the SharePoint databases from the mirror database server if they are still present
4. Restore the databases to the mirror server.
5. On the mirror server, set up the mirroring partnership.
6. On the principal server, set up the mirroring partnership.
7. On the principal server, set up the witness partnership.
8. Test SharePoint and make sure it is still functioning.
9. Failover to the original principal server if necessary.
If the SQL instance in the secondary DC automatically took over the principal role, you don't have to do anything but just give them some time to sync up.
What happens if I lose connection between the primary and the secondary data centers?
Assume both the DCs are still working but the connection between them is broken. Both the SQL instances will become principal. The one with access to the witness server will be serving data, the one without access to the witness will stop serving data and the SharePoint servers in that DC will stop working.
Can SQL mirroring work with cluster?
Mirroring can work between SQL clusters, and a SQL cluster and a single server SQL instance. Mirroring, however, does not work within a SQL cluster.
What happens when my principal cluster fails over?
SQL cluster failover always takes longer time than SQL mirroring witness interval. Therefore, SQL mirroring roles will be switched when the principal cluster fails over. You can failover back to the original cluster after SQL cluster failover is complete.
Does stretch farm affect SharePoint performance?
According to my limited performance tests, no.
How do I set up failover for SharePoint features that do not have UI to set up failover instances?
You can run following PowerShell commands in SharePoint PowerShell console on a SharePoint server:

$db = get-spdatabase | where {$_.Name -eq "<database name>"}

$db.AddFailoverServiceInstance("<failover SQL instance name>")

$db.Update()
Does stretch farm protects all SharePoint functionalities?
No. It does not protect functionalities with dependencies beyond 14-hive and databases. Some examples of the not supported dependencies are file shares, and external data sources. Some 3rd party SharePoint solution without failover capabilities will also not be protected. Contact your vendors for more information.

Zewei Song, Ph.D.
MCPD, MCITP, MCTS: SharePoint 2010, .NET 3.5
Enterprise Services, Microsoft Corporation

Passed all 4 SharePoint 2010 MCP exams at TechReady

2011-02-24T22:13:00Z

I passed all 4 SharePoint 2010 MCP exams at TechReady-12 (a Microsoft field employees only tech conference) and have gained following new MCP titles:

Microsoft Certified Professional Developer (MCPD): SharePoint Developer 2010
Microsoft Certified IT Professional (MCITP): SharePoint Administrator 2010
Microsoft Certified Technology Specialist (MCTS):
- SharePoint 2010, Configuration
- SharePoint 2010, Application Development

Here are the exams I passed:

70-573 TS: Microsoft SharePoint 2010, Application Development
70-667 TS: Microsoft Office SharePoint 2010, Configuring
70-576 PRO: Designing and Developing Microsoft SharePoint 2010 Applications
70-668 PRO: Microsoft SharePoint 2010, Administrator

It turned out that the PRO exams were easier to me than the TS'. However, without passing the TS exams, the PRO's would not be activated. The hardest one for me was 70-573, I failed the first time (scored 624) and had to re-take it.

I chatted with the guy who was managing the makeshift exam site at the conferece, he said the passing rate was about the same as his other "official" sites, around 50%. I figure since the exams for TechReady attendees were free so there would be much less stress and preparations for our Microsofties, like me, I didn't prepare for the exams at all. Therefore, we do know better about our own products.

OK, here are some tips I would like to share if you plan to take these exams:

Each exam has 50 questions, you have enough time to complete them, don’t rush
PRO exams are more focusing on case studies
PRO Admin exam requires SharePoint enterprise deployment experience
Make sure you have clear knowledge on basic SharePoint concepts, for example, web app, site collection, site, …
Make sure you understand the new 2010 features and concepts well
Don’t stay on a single question for too long, make a guess, mark it and come back later
Don’t change your answer if you guessed it, chances are your first guess is the correct one
Don’t panic and don’t blame yourself if you don’t pass, even I have failed J

Zewei Song, Ph.D.
MCPD, MCITP, MCTS: SharePoint 2010, .NET 3.5
Enterprise Services, Microsoft Corporation

Dealing with SAML token “The signature verification failed” error

2011-01-13T17:05:00Z

If you are working with WIF and SAML tokens, chances are you have seen “The signature verification failed” error. It happened to me and almost drove me crazy!

Signed SAML tokens are very elegant XML documents/nodes. You are not supposed to touch it once it is generated and signed, because even a space added or removed would cause the verification to fail.

In my case it was even more confusing: my code could successfully verify SAML tokens from one STS but always failed for another one. And to make things worse, the failing STS source was the production STS. (It seems that’s always the case J)

Turned out, the problem was a combination of the STS and the way .NET handles XML classes’ InnerXml property:

· The production STS generated SAML tokens with some newlines (“\n” or 0D-0A in hex)

· When calling XmlNode’s InnerXml property to get the XML of the token from the XML document, it removes the newlines

It toke a lot of efforts to figure this out but it was pretty easy to fix after you know what went wrong. This is the method I wrote to get the XML of the token from the whole XML doc:

private string GetTokenXMLString(string originalXmlString, XmlNode assertion)

{

string assertionHeader = assertion.Name;

string beginPoint = @"<" + assertionHeader;

string endPoint = @"</" + assertionHeader + @">";

int beginIndex = originalXmlString.IndexOf(beginPoint, StringComparison.InvariantCultureIgnoreCase);

int endIndex = originalXmlString.IndexOf(endPoint, beginIndex, StringComparison.InvariantCultureIgnoreCase);

return originalXmlString.Substring(beginIndex, endIndex - beginIndex + endPoint.Length);

}

Before you call this method, you need to verify that there is an assertion Node within the XML document and pass it as assertion parameter. The originalXmlString parameter is the original XML string of the XML document, and you don’t want to get it by using Inner or OuterXml properties. Of cause you need to trap errors and add your log/trace logic to this routine.

Good luck and enjoy SAML!

Zewei Song, Ph.D.

MCPD, MCTS: .NET 3.5, MOSS AppDev, Configuration

Enterprise Services, Microsoft Corporation

Changing SharePoint Account's Password on Client OS

2010-10-07T20:45:00Z

As promised, I will show you how to refresh your SharePoint account on a client OS (Windows 7) after you changed its password.

On my Windows 7 laptop, I use my corporate domain user (you have to use a domain account for a full version of SharePoint) as SharePoint 2010's service account (for how to install a full SharePoint 2010 to Windows 7, please check my other post at: http://blogs.msdn.com/b/zwsong/archive/2010/04/29/installing-complete-version-of-sharepoint-server-2010-on-windows-7.aspx), and it can't be managed by SharePoint itself. So after I changed my domain account's password, my SharePoint farm stopped working. I see a 503 error when I try to visit the CA site:

Service Unavailable

HTTP Error 503. The service is unavailable.

There are two sets of accounts you need to refresh:

SharePoint Windows Services
SharePoint IIS Application Pools

To refresh Windows Services' accounts' passwords, go to your machine's Services Management Console (I always right click Computer and select Manage). Now, navigate to Services under Services and Application. On the right pane, click on its title bar's Log On As to sort the list by account name. I see four SharePoint services under my domain account. Go to each of them and refresh their passwords. The 4 services are:

SharePoint 2010 Timer
SharePoint 2010 User Code Host
SharePoint Server Search 14
Web Analytics Service

Now, navigate to IIS Manager, and click on Application Pools. On your application pools list, click on Identity to sort it by account name. You have to refresh passwords for all the application pools using your domain accounts.

After all the changes, restart SQL server and IIS, you should have your SharePoint 2010 farm back.

Zewei Song, Ph.D.
MCPD, MCTS: .NET 3.5, MOSS AppDev, Configuration
Enterprise Services, Microsoft Corporation

How To Hide Ribbon From Users Without Edit Page Privilege

2010-04-29T20:28:00Z

Ribbon is a great new feature introduced by SharePoint 2010. It provides great user experience for users with elevated privileges, like contributors and site owners. However, for users with lease privilege, such as visitors and anonymous users, it seems like a big waste of page real estate. Because for those users, all ribbon provides are navigation breadcrumb and welcome control (user name with a drop down list on top-right corner).

So I have been asked to figure out a way to remove or hide the ribbon area from user with lease privilege, and here is how:

1) Open your SharePoint master page

2) Locate this line:
<div id="s4-ribbonrow" class="s4-pr s4-ribbonrowhidetitle">

3) Change it to:
<div id="s4-ribbonrow" class="s4-pr s4-ribbonrowhidetitle" style="display:none">

4)      Now find the end of the “s4-ribbonrow” tag and add following block right after it:
<Sharepoint:SPSecurityTrimmedControl ID="SPSecurityTrimmedControl2" runat="server" PermissionsString="AddAndCustomizePages">
    <script type="text/javascript">
        document.getElementById("s4-ribbonrow").style.display = "block";
    </script>
</Sharepoint:SPSecurityTrimmedControl>

5) Save the new master page and publish it.

Now when a user without “AddAndCustomizePages” access to view the site, they would not see the ribbon area. You may want to move at least the welcome control to somewhere outside the ribbon area so your lease privilege users can see their user names.

The reason that you have to do it the other way around: make the ribbon invisible (step 3) and make it visible only when users have “AddAndCustomizePages” access (step 4) is the ribbon HTML code has to be rendered to the browser otherwise you would lose some basic abilities on the page, like, to be able to scroll up and down.

Enjoy your page real estate back!

Zewei Song, Ph.D.

MCPD, MCTS: .NET 3.5, MOSS AppDev, Configuration

Enterprise Services, Microsoft Corporation

Installing Complete Version of SharePoint Server 2010 on Windows Client OS

2010-04-29T16:27:00Z

Yes, I successfully installed complete version (not the standalone one) of SP2010 on my Windows 7 laptop. Here is how I did it:

Make sure your Windows client OS is 64-bit and domain joined and you have a domain account with local administrator's privilege.

I followed most of the instructions from this article: http://msdn.microsoft.com/en-us/library/ee554869(office.14).aspx

At the #3 of Step 3, instead of clicking on "Standalone", click on "Server Farm", and selected "Complete" option on the following screen.

After SharePoint 2010 installation is finished, skip the Configuration Wizard and install SQL Server 2008. Here are the tricks for installing SQL 2008:

Use either a domain account or NETWORK SERVICES to run the SQL services
Assign the domain account as SQL's administrator
Download and install SQL 2008 SP1 right after SQL 2008 installation: http://www.microsoft.com/downloads/details.aspx?FamilyID=66ab3dbb-bf3e-4f46-9559-ccc6a4f9dc19&displaylang=en
Download and install SQL 2008 SP1 CU2 right after SP1 installation: http://support.microsoft.com/kb/970315

Now, after rebooting, you can start SharePoint 2010's Configuration Wizard, select create a new farm and give it your SQL server's information. Note, you will need to use your domain account to set up the new farm, and during the configuration processes, SharePoint 2010 Configuration Wizard would need to talk to you domain controllers, so make sure your Windows PC is connected to the domain (I did this via VPN).

Happy playing with a "real" version of SharePoint 2010 on your PC!

Zewei Song, Ph.D.

MCPD, MCTS: .NET 3.5, MOSS AppDev, Configuration

Enterprise Services, Microsoft Corporatio