Monday, 6 June 2016

Hybrid SharePoint and Office 365 Authentication Thoughts

Overview: Hybrid scenarios allow enterprise users to seamlessly interact between SP Online and SP on-prem instances, provide search across on-prem and online sites, access dat on-prem. while using Office365/SP Online, use Office 365 apps like Flow, Video, Graph and utilise OneDrive.  Picking the right authentication allows users to have a seamless high value experience bringing together secure access quickly.  Pretty important and to make this happen you need to deal with access.

Organisations have internal authentication mechanisms such as Microsoft's Active Directory.  Large organisations have a tough time migrating to the cloud and with the rapid changes in Security and the cloud this post aims to broadly define paths or options for architects such as myself to follow.

Options 1. Do nothing.
The 1st option is to ignore the cloud but I am going to presume you want to take advantage of Office 365.

Options 2.  Only use the cloud/O365.
Office 365 is huge and for a small or new business I would strongly look at only using O365 using Azure AD (AAD) credentials.  This means no or little management of Active Directory (AD) and you can pretty much connect to the whole Microsoft SaaS offering quickly.  Most large SaaS offering can work with Microsoft AAD.  Generally this option is not suitable for large enterprises.

Option 3.  Internal AD and externally use Office 365 Azure AD.
Easy to implement as the internal and external credentials do not link.  Your users do not get a single sign-on (SSO) experience.  Users use the Azure AD credentials when working with Office 365 and your internal credentials when working on the internal network.  User needs 2 accounts and to know when to use them.

Option 4.  Internal AD synchronized and creates similar accounts on Azure AD.
Pretty much the same option as option 3 but the usernames appear to be the same to the end users. Their are a few variations in this space, you can simply create the accounts with the same name either manually, using an CSV import or using Directory Sync (DirSync).  At this stage, the passwords and accounts are managed separately, the DirSync reduces effort and provisions and removes accounts in Azure AD to match the companies on-prem. AD.  DirSync will reach end of support in April 2017.

Option 5.  Internal AD automatically syncronises with Azure AD including password sync.
You still have 2 accounts but the accounts on both sides are kept aligned using DirSync and password synchronization.  The same password is stored both in your on-prem. AD and in Microsoft's Azure AD for each user.  The advantage here is that the user name and password for a user is the same if using internal or external applications secured by on-prem. AD or AAD.  This is not SSO enabled, the user needs to login to both AD's separately.

Option 6.  Azure Active Directory Connect.
Similar to option 5 but the Azure AD Connect tooling does all the synchronization of accounts between on-prem. AD and AAD.  Method is easier than option 5 and the latest approach but fundamentally it is the same approach with 2 identical accounts for each user.

Options 7.  Federate (ADFS)
Active Directory Federation Service (ADFS) provides an Identify Provider and can pass claims based authentication between trusted Identity Provider.  This post does not explain passive Identity authentication but this is the more advance option.  There are a lot of federation services but ADFS tends to be the most common (ThinkTexture, Ping, SiteMinder).





Monday, 23 May 2016

How the Recycle bin works


Problem:  A common misunderstanding with technical and business folks is the details of how the recycle bin works.  I missed some of the finer points so I thought I'd record my note.

First stage recycle Bin - User deletes a document and the document goes to the user's recycle bin/1st stage recycle bin.  The 1st stage recycle bin retention period is 30 days by default.  Items in the first stage recycle bin are moved to the second stage recycle bin after the retention period is over or the user chooses to delete the item from their 1st stage recycle bin.

Second stage recycle bin or Site Collection recycle bin - where documents go after they are removed from the 1st stage recycle bin.  SCA can restore or permanently delete the documents from the 2nd stage recycle bin.

Recycle bin explained for Office 365 - as of May 2016
Note:  The views change between the SharePoint versions but the functionality remains the same.
Note:  An item that I have not understood for multiple years is that the retention period for recycle bins applies to both the 1st and 2nd stage recycle bin.  If the recycle bin retain content for 30 days and the user deletes a document, then 22 days later they delete the document from their own 1st stage recycle bin.  The document only stays in the 2nd stage/site collection recycle bin for 8 days.  From Nik Patel's site "In other words, total time spent by the item in both recycle bins".
Note:  If you do not have access to the farm settings, you can see how long the retention period for the recycle bin is by deleting a document/item from the 2nd stage recycle bin, you get a confirmation box that let's you know the setting.   This approach allows me to see that Office365 SharePoint sites hold recycle bin items for 93 days.
In the Site Collection Admin (2nd Stage) recycle bin delete an item to see how long the retention period is set to.
To Access the Recycle bins: Site Collection administrators page > Site Settings > Site Collection Admin > Site Collection

More Info:
Basics of Recycle bins from Microsoft
Nik Patel has a good article on how the recycle bin works

Wednesday, 18 May 2016

Microsoft Graph Simplified

Overview: Microsoft Graph provides an API to allow search to bring back data stored in Office 365 (email/Exchange Online, SharePoint, and others).  The centralized search provides the data source to query and adds a ranking engine on top to allow for easy access to data.

Overview of Office Graph

More Info:
A great article on Graph is here.  NB!

Screenshot from my iPhone 6 using the Microsoft's Delve iOS app with my own Office 365 E3 tenant.



Sunday, 10 April 2016

Co-authoring on SharePoint 2013


Overview:  Co-authoring has been around awhile and I haven't paiudd it any attention in a long time.  The idea is multiple authors can edit the same document at the same time.  

Notes
  1. Word and PowerPoint use to be the only supported files for co-authoring.  SharEPoint 2013 supports co-authoring in word 2013, PowerPoint, OneNote and visio 2013 as of 20April 2016.  
  2. Excel does not provide co-authoring unless you use Office Web Apps or excel services.  More info
WIP  -Versioning issues with Word....

Article describes nicely what applications work with co-authoring  https://technet.microsoft.com/en-us/library/ff718249.aspx

Sunday, 20 March 2016

Hacking SharePoint input field Validation


Problem: Here is an easy way to step around SharePoint 2013's input field validation for a drop down list.  Any list contains a drop-down list (configured to only allowed to chose values from the drop down list), using Internet Explorer (IE) developer tools and amending the DOM, when posting the form, the change value is inserted into the list.
Replication Steps:
  1. Open IE go to the list to add a new list item (the list must have a drop down field column), hit Fn+F12 to open the IE Dev toolbar.
  2. In the "DOM Explorer" tab select the "Select element" icon (top left).
  3. Click on the drop down control i.e. "Primary/Secondary" input control as shown below.
  4. Edit the DOM value for the item selected to some crazy text and save the form.
  5. Open the item in view mode and you will see the crazy data as shown below circled in red in the bottom picture.  


Project Server 2013 Overview Notes

Project Server 2013 is a Service Application and part of SharePoint Server 2013.  You install the on-prem. version on a SP2013 farm and need to follow the best practices for your SharePoint farm.
  • A Project Web Application (PWA) is a a single site collection.  
  • Consider storing each PWA in it's own content database.
  • Each PWA site collection is made up of multiple projects (each project has it's own SharePoint sub site).
  • Project 2013 online or a project server 2013 on-prem are the hosting options.
  • OData services for reporting, Excel can be used to create and view reports.  This is the approach to use on Project Server Online.  Each PWA instance on-prem. can add OLAP cubes from the PWA manage SSAS screen, once the default cubes are generated, it easy to query using Excel or SSRS (assuming you have the infrastructure). 
  • A single Project Web App database for each Project Server 2013 instance whereas in Project Server 2010, each instance had 4 Project Server databases (Draft, Publish, Reporting, and Archive).
  • Upgrade to Project Server 2016 from Project Server 2013 only.
  • PWA manages security and WSSSync manages the security syncronisation with the SharePoint project sub sites.
  • No user management in PWA, now all done in SharePoint assuming SharePointPermissionMode.  SharePointPermissionMode done in SP not in PWA (What ProjectPermsissionMode), pref SharePoint permissions mode.  oldproj server guys prefer ProjectPermissionMode say it gives more fine grained security control.
  • PWA Security explained https://technet.microsoft.com/en-gb/library/fp161361.aspx
  • To access Project Server 2013 with the Project Server client application (desktop software) you can't use the Standard edition but need the pro edition (Microsoft Project Server professional 2013).
FluentBooks from FluentPro looks good for ALM between environments and PWA instances:
  • Desktop tool - Offline Management - download configuration & then uploads configuration to the new PWA
  • Is there anything to install on the farm? No
  • Ports needed? 80 or 443 Uses web Services (PSI & CSOM when uploading change).
  • Highly configurable such as mapping account between domains as we move environments.


Archiving between 2 PWA instances using FluentBooks
================================

  1. Download/Export projects into a FBB file(s), new project professional client.  Gets the Project data.
  2. Download SharePoint sub sites
  3. Upload FBB file to archive PWA 
  4. Upload sub-sites into the archive PWA


More Info:
https://technet.microsoft.com/en-us/library/ff631142.aspx  Project Server 2013 and SharePoint Security
https://www.fluentpro.com/productsfluentbooks.htmll  FluentBooks website

Alternative:  
Bamboo Solutions appear to have a good Project Management Solution that has gone thru several iterations.  Project Manager Central sits on SharePoint 2007, SP2010 or SP2013.  Similar concept to Project Server, Portfolio site is a site collections and then project sites are sub-sites.  There is also an option to have Department sites whereby a sub site is created that subscribes to multiple project sites.

Sunday, 13 March 2016

How Browser Cookies work in SharePoint

Overview:  SharePoint by default uses disk based persistence using a FedAuth Cookie.  In most enterprise clients there are multiple different application and authentication providers.  Cookies can be set for session persistence in multiple ways and as the application world is walking toward SSO is becoming even more prevalent for unexpected behavior to happen with cookies.

Thoughts:
  • Cookies that keep are responsible for authentication can be stored for the browser sessions eithe ron Disk or in session.
  • By default SharePoint uses disk based authentication for the users session using the FedAuth cookie.  Switching to session based persistence should not be undertaken without considerable forethought.
  • Watch out for IE's odd behavior relating to session whereby domain level permissions are passed down to sub-domains.


More Info:
http://erik.io/blog/2014/03/04/definitive-guide-to-cookie-domains 
http://blogs.msdn.com/b/ieinternals/archive/2009/08/20/wininet-ie-cookie-internals-faq.aspx
https://blogs.msdn.microsoft.com/ie/2009/05/06/session-cookies-sessionstorage-and-ie8-or-how-can-i-log-into-two-webmail-accounts-at-the-same-time/