SharePointServices

SharePoint General Questions

Gaurav Taneja — Fri, 06 Oct 2006 15:29:00 GMT

What does partial trust mean the Web Part developer?

If you install assemblies into the BIN directory, you must ensure your code provides error handling in the event that required permissions are not available. Otherwise, unhandled security exceptions may cause your Web Part to fail and may affect page rendering on the page where the Web Part appears.

The following is a typical example of a security exception:

Request for the permission of type

Microsoft.SharePoint.Security.SharePointPermission,

Microsoft.SharePoint.Security, Version=11.0.0.0, Culture=neutral,

PublicKeyToken=71e9bce111e9429c failed

As stated previously, the WSS_Minimal trust level does not grant permission to the SharePointPermission.ObjectModel to assemblies in the BIN directory for an application. Therefore, if your code attempts to use the Microsoft SharePoint object model, the common language runtime (CLR) throws an exception.

Since the minimal permission set provides the smallest set of permissions required for code to execute, the likelihood of additional security exceptions is increased.

Recommendation Try-catch critical areas to address situations where you may not have the necessary permissions to accomplish a specified objective.

What if my assemblies are installed in the GAC?

By default, assemblies installed in the global assembly cache (GAC) run with Full trust. Although, installing your Web Part assembly in the GAC is a viable option, it is recommended that you install Web Part assemblies in the BIN directory for a more secure deployment.

How can I raise the trust level for assemblies installed in the BIN directory?

Windows SharePoint Services can use any of the following three options from ASP.NET and the CLR to provide assemblies installed in the BIN directory with sufficient permissions. The following table outlines the implications and requirements for each option.

Option Pros Cons

Increase the trust level for the entire virtual server. For more information, see "Setting the trust level for a virtual server" Easy to implement.

In a development environment, increasing the trust level allows you to test an assembly with increased permissions while allowing you to recompile assemblies directly into the BIN directory without resetting IIS.

This option is least secure.

This option affects all assemblies used by the virtual server.

There is no guarantee the destination server has the required trust level. Therefore, Web Parts may not work once installed on the destination server.

Create a custom policy file for your assemblies. For more information, see "How do I create a custom policy file?" Recommended approach.

This option is most secure.

An assembly can operate with a unique policy that meets the minimum permission requirements for the assembly.

By creating a custom security policy, you can ensure the destination server can run your Web Parts.

Requires the most configuration of all three options.

Install your assemblies in the GAC Easy to implement.

This grants Full trust to your assembly without affecting the trust level of assemblies installed in the BIN directory.

This option is less secure.

Assemblies installed in the GAC are available to all virtual servers and applications on a server running Windows SharePoint Services. This could represent a potential security risk as it potentially grants a higher level of permission to your assembly across a larger scope than necessary

In a development environment, you must reset IIS every time you recompile assemblies.

Licensing issues may arise due to the global availability of your assembly.

I changed the trust level in the web.config file—now my entire site fails to render. What should I do?

If you change the trust level in the web.config file, Windows SharePoint Services may fail to render on subsequent requests. The following is an example of a typical error:

Assembly <assemblyName> security permission grant set is incompatible

between appdomains.

To resolve the conflicting trust setting, reset Internet Information Services (IIS) such as by using iisreset.

Note This is a known issue related to the architecture of ASP.NET and the .NET Framework.

How do I create a custom policy file?

To customize one of the built-in policy files, it is recommended that you make a copy of it and make changes to the copy to ensure that you can reuse the original file if necessary.

The following procedure describes how to give access to the Microsoft SharePoint object model to a specific assembly.

To give access to an assembly

Copy the wss_minimaltrust.config file.

Rename the file new_file_name.config.

Using a text editor such as NotePad, open new_file_name.config

Under the <SecurityClasses> element, add a reference to the SharePointPermission class as follows:

<SecurityClass Name="SharePointPermission"

Description="Microsoft.SharePoint.Security.SharePointPermission,

Microsoft.SharePoint.Security, Version=11.0.0.0, Culture=neutral,

PublicKeyToken=71e9bce111e9429c" />

</SecurityClasses>

Search for the <PermissionSet> tag where the name attribute equals ASP.Net.

Copy this entire tag and all of its children, and paste a copy of it immediately below the one you copied.

Change the name of the new PermissionSet element from ASP.Net to New_File_Name:

Example (Before)

</PermissionSet>

Example (After)

<PermissionSet class="NamedPermissionSet" version="1"

Name="New_File_Name">

</PermissionSet>

Add the following <IPermission> node to the<PermissionSet> element where the name attribute equals New_File_Name:

<IPermission class="SharePointPermission"

version="1"

ObjectModel="True" />

Therefore, the resulting customized <PermissionSet> will look as follows:

<PermissionSet class="NamedPermissionSet" version="1" Name="

New_File_Name">

<IPermission class="AspNetHostingPermission" version="1"

Level="Minimal" />

<IPermission class="SecurityPermission" version="1" Flags="Execution"

<IPermission class="WebPartPermission" version="1" Connections="True"

<IPermission class="SharePointPermission" version="1"

ObjectModel="True" />

</PermissionSet>

Once you define the customized element, you must create a code group to specify when the CLR should apply the permission set.

Important By default, the AllCode code group is a FirstMatchCodeGroup in ASP.NET policy files. Therefore, the CLR stops assigning permissions to an assembly after the first match to a specific code group. To apply the custom permissions, you must declare the specific code group assigning the custom permissions to your assembly as the first code group within the AllCode group. This ensures that the CLR assigns the MyCustomPermissions permission set and stops without proceeding to the default $AppDirUrl$/* code group that is used to assign permissions based on whether the assembly is located in BIN directory.

In the following example, the membership condition for the new code group is based on strong name membership:

<CodeGroup class="UnionCodeGroup"

version="1"

PermissionSetName="MyCustomPermissions">

<IMembershipCondition class="StrongNameMembershipCondition"

version="1"

PublicKeyBlob="... see note below ..."

Name="MyAssemblyName" />

</CodeGroup>

Note To retrieve the public key blob for an assembly, use the secutil.exe tool as follows:

secutil.exe -hex -s MyAssemblyName.dll

For more information about secutil.exe, see Secutil Tool.

Save and close the file. The policy file is ready to use.

Open the web.config file for the virtual server extended with Windows SharePoint Services and add the following <trustLevel> tag to the SecurityPolicy element:

<trustLevel name="MyCustomTrustLevel"

policyFile="new_file_name.config" />

In the web.config file, change the <trust> tag so that it refers to the newly defined trust level.

Save and close the web.config file.

Reset IIS, such as by using iisreset, to apply the custom policy to the specified virtual server.

What if my assembly is not strongly named? How does my code group change?

You can specify membership conditions for a code group in several ways. You can use the UrlMembershipCondition to specify conditions as follows:

<CodeGroup class="UnionCodeGroup"

version="1"

PermissionSetName="MyCustomPermissions">

<IMembershipCondition class="UrlMembershipCondition"

version="1"

Url="$AppDirUrl$/bin/MyAssemblyName.dll" />

</CodeGroup>

My assembly refers to a library assembly. Everything works when the assembly is installed in the GAC, but fails once the assembly is placed in the BIN directory. What is going on?

Assuming you granted the required permissions to an assembly, the reason your assembly cannot run may be related to how the library assembly was built. By default, strongly named assemblies allow only callers who are granted Full Trust. Therefore, the CLR blocks a partially trusted assembly from calling into a Full Trust-only assembly.

You have several possible solutions, both of which have security implications that you must consider:

When compiling the assembly, you can add the AllowPartiallyTrustedCallersAttribute attribute to the specified library assembly.

Important You can only add this attribute to the source code. If you are using a third-party assembly and do not have access to the source, you cannot choose this option. If you choose this option, you are allowing partially trusted callers to execute code from within the library. This could represent a potential security risk as it opens the specified library assembly for use by other callers with partial trust.

You can give your assembly Full trust by installing it to the GAC.

Important Assemblies installed in the GAC are available to all virtual servers and applications on the server running Windows SharePoint Services. This could represent a potential security risk as it potentially grants a higher level of permission to your assembly across a larger scope than necessary.

You can give your assembly Full trust by creating a custom policy file as outlined in the previous section.

Important It is recommended that you choose this option as it allows you to explicitly grant the required minimum level of permission to your assembly without increasing the scope of access to a larger number of callers.

I am trying to access a Web service by using a Web Part. When I do so, I get a Security Exception as follows:

Request for the permission of type System.Net.WebPermission, System,

Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

failed.

By default, assemblies in the BIN directory do not have the required permission, System.Net.WebPermission, to access Web services. To grant this permission, add the following to the corresponding IPermission element in the appropriate policy file:

</ConnectAccess>

</IPermission>

I want to access a Web service from my Web Part. When I do so, I get an InvalidOperationException as follows:

One or more assemblies referenced by the XmlSerializer cannot be called

from partially trusted code.

When you create a reference to a Web service, Microsoft Visual Studio®.NET creates and places one or more objects in your assembly to store the argument data passed to the method(s) in the Web service. These objects are serialized using the XmlSerializer class when you invoke one or more of the methods in the Web service. By default, if your assembly is strongly named and resides in the BIN directory, callers with partial trust cannot access objects within that assembly. When you make the call to the Web service method, the XmlSerializer detects that there are partially trusted callers on the callstack (i.e. your assembly) and prevents the serialization from taking place even though the object resides in the same assembly.

You have several possible solutions, both of which have security implications that you must consider:

You can add the AllowPartiallyTrustedCallersAttribute attribute to the specified library assembly.

You can give your assembly Full trust by installing it to the GAC.

You can give your assembly Full trust by creating a custom policy file as outlined in the previous section.

Sharepoint Question & Answer

Gaurav Taneja — Wed, 23 Aug 2006 11:38:00 GMT

• What is SharePoint?
Portal Collaboration Software.

• What is the difference between SharePoint Portal Server and Windows SharePoint Services?
SharePoint Portal Server is the global portal offering features like global navigation and searching. Windows SharePoint Services is more content management based with document libraries and lists. You apply information to certain areas within your portal from Windows SharePoint Services or directly to portal areas.

• What is a web part zone?
Web part zones are what your web parts reside in and help categorize your web parts when designing a page.

• How is security managed in SharePoint?
Security can be handled at the machine, domain, or sharepoint level.

• How are web parts developed?
Web parts are developed in Visual Studio .Net. VS.Net offers many web part and page templates and can also be downloaded from the Microsoft site.

• What is a SharePoint farm?
Multiple machines running services for SharePoint. Otherwise known as Topology.

• What is a site definition?
It’s a methods for providing prepackaged site and list content.

• What is a template?
A template is a pre-defined set of functions or settings that can be used over time. There are many templates within SharePoint, Site Templates, Document Templates, Document Library and List Templates.

• How do you install web parts?
Web Parts should be distributed as a .CAB (cabinet) file using the MSI Installer.

• What is the difference between a site and a web?
The pages in a Web site generally cover one or more topics and are interconnected through hyperlinks. Most Web sites have a home page as their starting point. While a Web is simply a blank site with SharePoint functionality built in; meaning you have to create the site from the ground up.

• What are the differences between web part page gallery, site gallery, virtual server gallery and online gallery?
Web Part Page Gallery is the default gallery that comes installed with SharePoint. Site Gallery is specific to one site. Virtual Server gallery is specific to that virtual server and online gallery are downloadable web parts from Microsoft.

• What is the GAC?
Global Assembly Cache folder on the server hosting SharePoint. You place your assemblies there for web parts and services.

• What is a DWP?
The file extension of a web part.

• What is CAML?

Stands for Collaborative Application Markup Language and is an XML-based language that is used in Microsoft Windows SharePoint Services to define sites and lists, including, for example, fields, views, or forms, but CAML is also used to define tables in the Windows SharePoint Services database during site provisioning.

• What is a document library?
A document library is where you upload your core documents. They consist of a row and column view with links to the documents. When the document is updated so is the link on your site. You can also track metadata on your documents. Metadata would consist of document properties.

• What is a meeting workspace?
A meeting workspace is a place to store information, attendees, and tasks related to a specific meeting.

• What is a document workspace?
Document workspaces consist of information surrounding a single or multiple documents.

• What is a web part?
Web parts consist of xml queries to full SharePoint lists or document libraries. You can also develop your own web parts and web part pages.

• What is the difference between a document library and a form library?
Document libraries consist of your core documents. An example would be a word document, excel, powerpoint, visio, pdf, etc… Form libraries consist of XML forms.

• What are themes?
Themes provide a quick a easy way to change the appearance of your SharePoint site

.
• What is presence?
Allows users to see if other users are online and can send them instant messages.

• Can web parts be connected? if so, how?
Web Parts can be connected by Modifying the Shared Part and providing the connection with the correct fields to share.

• What is a personal view and what is a shared view?
Personal views are specific to a user while Shared View is common across all users.

• What is an STP file?
The file extension that applies to site templates.

• What is an FWP file?
The file extension that applies to SharePoint sites that have been backed up.

• How does SharePoint support MS Outlook integration?
Via Web Parts available at the Microsoft Web Component Directory. Oh yeah and Active X Controls.

• How can you extend lists in SharePoint?
If you mean extend by adding columns of data and have specific data types for each column the answer is yes. You can also use Data Views in FrontPage 2003 to pull in XML data from other sites, lists or document libraries to make the information more presentable for users.

• Explain the document versioning in SharePoint document libraries
When versioning is enabled everytime the document is edited from the SharePoint site it creates a new version. You can restore or delete old versions of documents. Version numbers are incremented by the system itself.

• Where are web part resources contained?
The SharePoint file system, SQL, and the GAC folder. They are also referenced in the web.config folder.

• What are the different installation methods for deploying web parts? and what are the pros/cons?
The best way is via a CAB file using the MSI Installer.

• What is a ghosted/unghosted page?
Page that is created from a template oppsed to being created from scratch.

• How is site data stored?
Site data is stored in your content database that either resides in SQL Server 2000 or MSDE.

• Where is metadata for a web stored?
In the content databases stored in SQL.

• What is an audience and describe the use?
Audiences are a pre-defined set of users that you can apply information to. You can apply information to their personal sites as well for dailey information or job tasks.

• What are the trust levels and what is the default trust associated with SharePoint?
SSL and the basic IIS security. SharePoint comes with Integrated Windows Authentication turned on.

• What are the two logging mechanisms for usage statistics?
By default creates log files in the \%windir%\system32\LogFiles\STS directory on the front-end Web server, although an alternate location can be specified. The STS directory contains a folder for each virtual server on the Web server, each named with a GUID that identifies the respective virtual server. Each virtual server folder contains subfolders for each day, which in turn contain the daily usage log for each virtual server. In addition to containing information per virtual server, the Windows SharePoint Services logs are also useful because they associate users with page hits and with time stamps. what functionality does owssup.dll provide for client side activities?

• What is STSAdm and what can it be used for?
STSADMIN is a tool that can do many things from a command prompt like manage users, create new sites and add files to the file system.

• Can WSS search subsites?
Not without the new CorasWorks Search Web Part.

• Can you register alerts for users?
Not unless you are logged in as that user.

• Are PDFs searchable?
Out of the box only the metadata collected in the upload form is search able. Unless you download and install the Adobe iFilter.

• Describe a large deployment
Many front-end webserver with a SQL cluster with the possibility of multiple international locations.

• How can you synchronize custom Active Directory attributes to SharePoint?
Via the Profile Importer.

• If it is anticipated that our organization would need to store 1 terrabyte of documents, what is the recommended configuration and storage requirement?
Multiple front-end web servers with content databases across the server farm. The amount of web-servers can depend on how many users you have and what the typical size of a document is.

• Explain how you would deploy SharePoint on an extranet
Usually servers that are accessible from external sources are housed in DMZ’s. Depending on the requirements and the workflow for publishing content you could go with Multiple Servers hosting the same information. One server would reside inside with the SQL Cluster while the external server resides in the DMZ simply calling data. Security would be handled by the same or different active directory domain clusters as well increasing security.

• What is the BKM for maximum number of virtual servers configured for SharePoint on a single box?
I believe its 15.

• what are the migration strategies for moving sites around?
You could use the SharePoint Portal Server backup and restore tool as well as the STSADMIN and GUI STSAMIN tools. We have migrated databased from the SQL Level and have simply reconnected the front end.