Onsighting Microsoft products and technologies : MOSS 2007

Securing SharePoint’s People Picker for Extranet use

jro — Thu, 28 Aug 2008 14:06:40 GMT

About People Picker

One of the often used features of SharePoint (WSS 3.0 and MOSS 2007) is People Picker. This is the component responsible for providing a fancy user interface for finding users when provisioning access:

By default, which in this context means - “I did a full installation of MOSS 2007 with mostly default settings and didn’t pay particular attention to securing anything” – People Picker is not secure.

Main issue with People Picker is that it’s accessible for regular users of a given site. Thus by accessing /_layouts/aclinv.aspx">http://<portal>/_layouts/aclinv.aspx anyone with basic access to the site can list and view existing users of the system:

By typing 'a' as the user and hitting search one can review a list of accounts that match this search term. Obviously this isn't a big issue in intranets and similar closed systems where trust is already given for that particular user performing the search. For anonymous sites (public WCM-sites mostly) lockdown mode should resolve most issues related to /_layouts/ application pages. See this article for more details: http://technet.microsoft.com/en-us/library/cc263468.aspx#section6.

What additional approaches can you take to secure People Picker?

Modifying People Picker behavior with stsadm.exe

Stsadm.exe (with SP1) enables you to control People Picker with the following properties:

peoplepicker-activedirectorysearchtimeout
peoplepicker-distributionlistsearchdomains
peoplepicker-nowindowsaccountsfornonwindowsauthenticationmode
peoplepicker-onlysearchwithinsitecollection
peoplepicker-searchadcustomfilter
peoplepicker-searchadcustomquery
peoplepicker-searchadforests
peoplepicker-serviceaccountdirectorypaths

These are well documented here: http://technet.microsoft.com/en-us/library/cc263318.aspx.

Deny access to /_layouts/aclinv.aspx

It would also be a good idea to deny access to /_layouts/aclinv.aspx. For some reason SharePoint doesn't have a built-in security authorization for this given application page like it has for settings.aspx. A proper approach would be to filter access to this given application page on the border firewall.

Alternatively, brewing your own HTTP Handler to filter out requests is also a viable option. See this article for more details: http://msdn.microsoft.com/en-us/library/bb457204.aspx

Modify /_layouts/aclinv.aspx

You should know that modifying anything underneath /_layouts/ probably breaks any support, so proceed with caution.

Modifying aclinv.aspx has its advantages too. This is the control from aclinv.aspx that renders People Picker:

<wssawc:PeopleEditor
    AllowEmpty=false
    ValidatorEnabled="true"
    id="userPicker"
    runat="server"
    ShowCreateButtonInActiveDirectoryAccountCreationMode=true
    SelectionSet="User,SecGroup,SPGroup"
/>

Several properties exist that can help in securing People Picker functionality:

ValidatorEnabled [true, false]: Set to false to disable validation of user accounts
Rows [#]: Set to 1 to prevent multiple user access
ShowButtons [true, false]: Set to false to disable the two functional buttons (check names and addressbook)
ValidateResolvedEntity [true, false]: Set to false to prevent validation of resolved entity
UrlZone [Custom, Intranet, Extranet, Internet, Default]: Specify with zone (AAM) to use for this control. Might be handy to set this to Intranet only

Hope this helps :)

Resources for MOSS 2007 and WSS 3.0

jro — Fri, 26 Oct 2007 11:22:00 GMT

I recently had a chance to participate in delivering a MOSS 2007/WSS 3.0 "Make It Real"-training in Germany (thanks for hosting us, guys). It was a great week of collaboration, finding solutions for technical issues and giving and receiving real life experiences from SharePoint engagements. As part of the training I whipped together a quick list of useful resources that aims to help people who are starting or have started their SharePoint journey sometime ago. I'm sharing this list with you - it's nothing magical, it's by no means complete or comprehensive - it's just a list of "good things to check":

MOSS 2007 SDK: http://www.microsoft.com/downloads/details.aspx?familyid=6d94e307-67d9-41ac-b2d6-0074d6286fa9

WSS 3.0 SDK: http://www.microsoft.com/downloads/details.aspx?familyid=05e0dd12-8394-402b-8936-a07fe8afaffd

MOSS/WSS Technology Specialist –certifications

http://www.microsoft.com/learning/mcp/mcts/spservices/config

http://www.microsoft.com/learning/mcp/mcts/spservices/appdev/

http://www.microsoft.com/learning/mcp/mcts/spserver/config/

http://www.microsoft.com/learning/mcp/mcts/spserver/appdev/

VseWSS 1.1: http://www.microsoft.com/downloads/details.aspx?familyid=19f21e5e-b715-4f0c-b959-8c6dcbdc1057

Minimal Master Page Template for MOSS: http://msdn2.microsoft.com/en-us/library/aa660698.aspx

SharePoint Community Forums: http://mssharepointforums.com/

SharePoint Product Group Blog: http://blogs.msdn.com/sharepoint/

ECM Product Group Blog: http://blogs.msdn.com/ecm/

Kimmo’s migration tools for SharePoint: http://www.codeplex.com/SPMigration

The Fantastic 40 Templates for WSS: http://www.microsoft.com/downloads/details.aspx?FamilyID=5807b5ef-57a1-47cb-8666-78c1363f127d&displaylang=en

Sample Master Templates:

http://www.microsoft.com/downloads/details.aspx?familyid=7C05CA44-869A-463B-84D7-57B053711A96&displaylang=en

Joel Oleson’s Blog: http://blogs.msdn.com/joelo/

Aggregated SharePoint blog feeds from MS employees: http://feeds.feedburner.com/sharepointmsblogs

Aggregated SharePoint blog feeds: http://feeds.feedburner.com/sharepointmvpblogs

Knowledge Network Blog: http://blogs.msdn.com/kn/

Extending STSADM with your own commands: http://sharepointsolutions.blogspot.com/2006/09/extending-stsadmexe-with-custom.html

Which SharePoint am I running? http://mindsharpblogs.com/penny/articles/481.aspx

Best Practices Analyzer for MOSS and WSS: http://www.microsoft.com/downloads/details.aspx?FamilyId=CB944B27-9D6B-4A1F-B3E1-778EFDA07DF8&displaylang=en

ISA 2006 authentication resources: http://www.microsoft.com/technet/isa/2006/authentication.mspx

MOSS 2007 on Technet: http://technet.microsoft.com/en-us/office/sharepointserver/default.aspx

MOSS 2007 Library on Technet: http://technet2.microsoft.com/Office/en-us/library/3e3b8737-c6a3-4e2c-a35f-f0095d952b781033.mspx?mfr=true

Book: SharePoint Companion: http://www.amazon.com/Microsoft-Office-SharePoint-Administrators-Companion/dp/0735622825/ref=pd_bbs_sr_3/102-1594662-5818530?ie=UTF8&s=books&qid=1193312818&sr=8-3

Book: Pro SharePoint 2007 Development: http://www.amazon.com/Professional-SharePoint-2007-Development-Programmer/dp/0470117567/ref=pd_bbs_sr_5/102-1594662-5818530?ie=UTF8&s=books&qid=1193312818&sr=8-5

Book: Workflow in the 2007 Office System: http://www.amazon.com/Workflow-2007-Microsoft-Office-System/dp/1590597001/ref=pd_bbs_9/102-1594662-5818530?ie=UTF8&s=books&qid=1193312818&sr=8-9

Book: Building Office 2007 Solutions in C# 2005: http://www.amazon.com/Microsoft-SharePoint-Building-Solutions-Sharepoint/dp/1590598091/ref=pd_bbs_12/102-1594662-5818530?ie=UTF8&s=books&qid=1193312818&sr=8-12

Book: Inside WSS 3.0: http://www.amazon.com/Microsoft-Windows-SharePoint-Services-Developer/dp/0735623201/ref=pd_bbs_10/102-9382336-2028120?ie=UTF8&s=books&qid=1189518841&sr=8-10

Book: Inside MOSS 2007: http://www.amazon.com/Inside-Microsoft-Office-SharePoint-Server/dp/0735623686/ref=pd_bbs_1/102-9382336-2028120?ie=UTF8&s=books&qid=1189604783&sr=8-1

Development Tools and Techniques for MOSS (2 parts): http://msdn2.microsoft.com/en-us/library/bb530302.aspx

http://msdn2.microsoft.com/en-us/library/bb530301.aspx

Best Practices: Common Coding Issues with MOSS: http://msdn2.microsoft.com/en-us/library/bb687949.aspx

Creating a WSS 3.0 Web Part – step by step: http://msdn2.microsoft.com/en-us/library/aa973249.aspx

Differences between ASP.Net 2.0 web parts and SharePoint web parts: http://msdn2.microsoft.com/en-us/library/bb153523.aspx

MOSS 2007 and SPS 2003/SPS 2001 migration tools public release

jro — Wed, 29 Aug 2007 16:13:00 GMT

I just got a note that the following migration tools for Microsoft Office SharePoint Server 2007 (MOSS) and Microsoft SharePoint Portal Server 2003 (SPS) have been released via CodePlex:

SharePoint 2003 Data Extraction Tool: http://www.codeplex.com/SPMigration/Release/ProjectReleases.aspx?ReleaseId=6766
SharePoint Importer: http://www.codeplex.com/SPMigration/Release/ProjectReleases.aspx?ReleaseId=6763
SharePoint 2001 Data Extractor: http://www.codeplex.com/SPMigration/Release/ProjectReleases.aspx?ReleaseId=6764

Check out the project's homepage at http://www.codeplex.com/SPMigration/.