Claims Based Authentication in SharePoint 2013, SharePoint 2010 and SharePoint Online

Copyright from: yalla.itgroove.net

What is SharePoint Claims Authentication?

The claims-based identity is an identity model in Microsoft SharePoint that includes features such as authentication across users of Windows-based systems and systems that are not Windows-based, multiple authentication types, stronger real-time authentication, a wider set of principal types, and delegation of user identity between applications.

Claims-based identity is based on the user obtaining a security token that is digitally signed by a commonly trusted identity provider and contains a set of claims. Each claim represents a specific item of data about the user such as his or her name, group memberships, and role on the network. Claims-based authentication is user authentication that utilizes claims-based identity technologies and infrastructure. Applications that support claims-based authentication obtain the security token from the user and use the information within the claims to determine access to resources. No separate query to a directory service like Active Directory is needed.

In a simple analogy:

You check in at the Airport (Authentication)
– present credentials (Passport)
– credentials are validated by security guard

You receive a boarding pass (Signed Claims)
– Seat, Frequent Flyer, Gate etc.

Think of a claim as a piece of identity information (for example, name, e-mail address, age, or membership in the Sales role). The more claims your application receives, the more you know about your user. These are called “claims” rather than “attributes,” as is commonly used in describing enterprise directories, because of the delivery method. In this model, your application does not look up user attributes in a directory. Instead, the user delivers claims to your application, and your application examines them. Each claim is made by an issuer, and you trust the claim only as much as you trust the issuer. For example, you trust a claim made by your company’s domain controller more than you trust a claim made by the user.

Claims-based authentication in Windows is built on Windows Identity Foundation (WIF), which was formerly known as the Security Token Service, or STS. Many areas of SharePoint still refer to the name STS so it’s important to understand that it and WIF are one in the same. The Security Token Service comes pre-baked into the standard SharePoint 2010 install:

The Security Token Service Application in Central Administration:

The Security Token Service Application in IIS:



WIF is a set of .NET Framework classes that is used to implement claims-based identity. Claims-based authentication relies on standards such as WS-Federation, WS-Trust, and protocols such as SAML.

Microsoft recommends Claims-based authentication as the preferred provider to use on fresh SharePoint 2010 installs. You can configure this on a per-Web Application basis in SharePoint via the following dialog in Central Admin > Web Applications > Manage Web Applications > Ribbon Bar – New

If you select Classic-Mode Authentication, you configure the Web application to use Windows authentication and the user accounts are treated by SharePoint Server 2010 as Active Directory Domain Services (AD DS) accounts.

If you select Claims-Based Authentication, SharePoint Server automatically changes all user accounts to claims identities, resulting in a claims token for each user. The claims token contains the claims pertaining to the user. Windows accounts are converted into Windows claims. Forms-based membership users are transformed into forms-based authentication claims. Claims that are included in SAML-based tokens can be used by SharePoint. Additionally, SharePoint developers and administrators can augment user tokens with additional claims. For example, Windows user accounts and forms-based accounts can be augmented with additional claims that are used by SharePoint Server 2010.

Claims Based Authentication (Tokens)	Classic Mode Authentication
-Windows Authentication: NTLM/Kerberos, Basic-Forms-based Authentication (ASP.NET Membership provider and Role Manager) -Trusted Identity Providers-Custom Sign-in page	-Windows Authentication (NTLM/Kerberos) only

*Both map authenticated users to the same SPUser object (security principles)

What does Claims look like/feel like?

The core process of Claims is illustrated as follows:

The core currency of Claims is the identity token.

 
EXAMPLE 1:
i:0#.w|contosojsmith
EXAMPLE 2:
i:0#.w|jsmith@contoso.com

i = Identity Claim all other claims will use “c” as opposed to “i”
: = Colon separator
0 = Reserved to support future Claims
#/? = Claim Type Encoded Value. The out of the box claim types will have a hardcoded encoded value, this will enable parity across farms.
E.g. Key: ? Value: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier

           Key: # Value: http://schemas.microsoft.com/sharepoint/2009/08/claims/userlogonname

./0 = Claim Value Type. The out of the box claim value types will have a hardcoded encoded value, this will enable parity across farms.

            E.g. Key: . Value: urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name

            Key: 0 Value: http://www.w3.org/2001/XMLSchema#string –

w/m/r/t/p/s = Original Issuer Type -> w = windows, m = membership, r = role, t = trusted STS, p = personal card, s= local sts claim

Why do I want to use Claims?

1. Decouples Authentication logic from Authorization and Personalization logic – this means speed and flexibility
2. Provides a common way for applications to acquire the identity information the need about users
3. Cloud-ready – lays the foundation to be able to Authenticate against Azure, Facebook, Google, Windows Live ID etc.
4. Federation – Partner networks, business to business, subsidiaries can all interact in the same sphere of authentication, cross machine and cross-farm
5. Supports existing identity infrastructure (Active Directory, LDAP, SQL, WebSSO etc.)
6. Standards-based and interoperable

Bonus Prize:
7. In SP 2010 we can have a single Web Application configured to use multiple authentication types which allows different auth types to be served from one URL:

Claims Gotchas

General issues for all Claims implementations
– Search crawler requires NTLM in the zone it uses
– Office Client Integration (2007 SP2+, 2010 are minimum requirements in order to maintain Client integration e.g. fluid editing of Word Document)
– SharePoint Designer does not support working with Claims Enabled Endpoints for Web Services

Migration issues when moving from Classic to Claims
– When upgrading from Classic to Claims, you will need to migrate users and Test & re-work customizations (Web parts, workflows etc.)
– After you move to Windows claims, you cannot go back to Windows classic. Ensure that you have good backups before you start and try your migration in a lab first before moving into production.
– Existing alerts may not fire, if this occurs the only workaround may be to delete and recreate the alerts
– Search crawl may not function, double-check the web application policies and ensure that the search crawl account shows the new converted account name. If it does not, you must manually create a new policy for the crawl account.

References

Configure Forms-based Authentication for a Claims-based Web Application
Configure the Security Token Service
SharePoint and Claims-based Identity
A Guide to Claims-based Identity and Access Control
SharePoint Server 2010 IT Professional Evaluation Guide
Plan Authentication Methods (SharePoint Server 2010) on TechNet
Claims-Based identity with Windows
Claims to Windows Token Service Overview (MSDN)
Claims Based Authentication in SharePoint 2010
Friends don’t Let Friends Use Claims Based Authentication

Access is denied: ‘xxx.dll’ – Manually add an assembly (.dll) to the GAC on Windows Server 2008 R2

Copyright from: stepbistep.net

I supposed to post this issue few months ago, but I don’t really know why this has been in my draft folder till this date! When we were migrating our servers to new environment, we deployed some custom web parts manually. While deploying the web part (Drag and drop the assembly (web part .dll) into Global Assembly Cache (GAC) folder) I have got the following wired error message! :(

GAC normally located in C:\Windows\assembly directory, and ‘WebPartStepBiStep.dll‘ is my web part assembly.

After spending some time on the web, I have got the solution here. Actually the ‘User Account Control: run all administrators in Admin Approval Mode’ was Enabled on the Local Security Policy. Which means the local administrators group required Admin Approval Mode (AAM) to perform these kind of operations. Here is the definition for Admin Approval Mode (AAM) from MicroSoft site.

Admin Approval Mode: AAM is a User Account Control (UAC) configuration in which a split user access token is created for an administrator. When an administrator logs on to a Windows Server 2008, the administrator is assigned two separate access tokens. Without AAM, an administrator account receives only one access token, which grants that administrator access to all Windows resources.

To access the Local Security Policy, either we can goto the Administrative Tools –> Local Security Policy OR we can run the ‘secpol.msc’ on the command prompt.

Start –> Administrative Tools –> Local Security Policy

Click Start –> Cmd –> type ‘secpol.msc’ then enter

You will be getting the Local Security Policy window like below and the highlighted is the AAM.

So the solution for our problem is Disabled the User Account Control. To do this double click on the highlighted policy on the Local Security Policy above and then you will be getting this window.

Click Disabled and OK.

After disabling this you will be able to drag and drop the .dll to the GAC.

Please Note:  1. Rebooted required for changes to the local security policy on the server.

2. Disabling this can make security problems in your environment, so after completing task, you should be enabled back the UAC.

That’s all guys, Happy drag and dropping..!

Thanks. R/.

References:

http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/6fe85045-ae27-4741-9412-be283f311d24/

Introduction to SharePoint 2013 Display Templates

Copyright from: MATTHEW MCDERMOTT'S BLOG

BY 

MATTHEW MCDERMOTT

 – JUNE 5, 2013POSTED IN: SHAREPOINT 2013

SharePoint 2013 introduces a new technique for presenting search results: Display Templates. If you have worked in previous versions of SharePoint and had to modify the look and feel of Search Results you know how cumbersome it is. In 2013 the new rendering techniques have several distinct advantages.

• Display templates are HTML and JavaScript rather than XSL
• Display templates are configured for the Site and Site Collection rather than for a Web part
• Display templates are applied with rules and logic
• Display templates are applied to individual result items, not the entire result set
• Display Templates are used for Results of all kinds, search results, content by search results, and refiners
• …and the list goes on

In this post I’ll show you the basics of creating a Display Template and then future posts will focus on the cool stuff you can do once you know these basics. I will assume that you are using a Search Site Collection. If you aren’t then you will have to tailor your changes accordingly. I also assume that you know how to deal with Crawled and Managed Properties. I have written about this for 2010 and it’s not too terribly different in 2013, in fact you can do it from the Site Collection now!

The Business

You have to have a reason to change the look of your results. In my case I have added a property to the User Profile called Twitter User Name. This way, users can opt in to showing off their social connection to Twitter. The HR department wants to increase social engagement in the company so they have asked my SharePoint team (me) to add the Twitter link to their People Search result. They would like it to link to the users Twitter profile page. So here we go:

The Basics

1. From the Search Center navigate to Site Settings. In the Look and Feel section chose Design Manager.
2. In Design Manager choose Upload Design Files.
3. Click the link at the top of the page to open the Master Page Gallery in Windows Explorer.
4. Browse down the folder structure to Display Templates/Search/ and locate the Item_Person.html file. This is the file used for the out of the box People Search result. Notice that there are actually two files named Item_Person. We always work with the HTML file leaving SharePoint to manage the JavaScript file.
5. Copy the Person_Item file to your desktop and rename it to Item_Twitter_Person (this way when we copy it back it won’t overwrite the original file.)
6. Now open the file in a text editor and find the title tag. Change the title to Twitter People Item.
7. In the next section are a bunch of tags that begin with . These control the metadata for the Display Template. The one we’re interested in is the ManagedPropertyMapping tag. We need to add any new custom properties to this tag before we can display that property in the page. This is where you have to decide what Managed Properties from the Search Service you are going to use in your page. In my case the fine IT folks told me it was called TwitterAccountName. So I’ll add that to the end of the line. Pay attention to the syntax here. (In a later post I’ll discuss more about the syntax of this declaration. For now just duplicate the field name.)
8. Now we need to add the field to the display part of the page. If I were to create a link to Twitter for my own account it would look like this: Twitter: 
   MatthewMcD
    What I need to do is swap out my account with a token that will be replaced by the user in the search results. Microsoft introduced a new token that we will use for this purpose _#= to start and =#_ to end. That combination of characters will tell SharePoint to look at what’s in between and treat it like JavaScript. So what we need now is a way to reference our field TwitterAccountName. We do that by referencing the Context of the Current Item in the search results. All put together it looks like this: _#= ctx.CurrentItem.TwitterAccountName =#_. So now our code looks like this inserted below the NameValue div:
9. Save the file and copy it back to the server by dragging it back to the Search Display Templates folder where you started. If you refresh the Explorer windows you will notice that SharePoint automatically created a matching .js file.
10. Now we need to tell SharePoint when to use our new Display Template. We do this with a Result Type. Return to Site Settings and choose Search Result Types from the Site Collection Administration section.
11. Locate the Person result type, hover click and choose Copy.
12. Change the name to Twitter Person and change the Action | What should these results look like? toTwitter People Item. Notice how the Display Template URL changes to the JavaScript sister file SharePoint created.
13. Click Save and return to the Search Center to check your work.
14. Execute a search on the People Search vertical and you should see the results of your work.
15. So we achieved our goal, but there’s something I don’t like about the result. Oso does not have a Twitter account, so we should not show the “Twitter:” text. This is a simple change and demonstrates the last basic concept for the article.
16. You can open and edit the Display Template right our of the Explorer window. Then each time you save the file it will update on the server immediately. So, go ahead, open the file in your text editor right out of SharePoint.
17. Now that you have the file open we need to add some conditional code so we only write the Twitter tag if the user entered a value. This is super easy. The trick is to tell SharePoint that it is a code block. For that I’ll use an HTML comment and our special tag again. This is what our code looks like now. I added my JavaScript in between the comments and wrapped it around my divs.
18. Return to the Search Center and test the search. You should see that the values only display when they are not blank.

Conclusion

So what have we learned?

• You can use a text editor to create Display Templates from copies of the out of the box files.
• You can embed and emit custom managed properties in your search results.
• You can run JavaScript in your Display Template for conditional formatting.

Please remember that Display Templates, like other assets in the Master Page Gallery, must be Published in order for everyone to see them. Once you have completed your edits, return to the Mater Page Gallery and Publish and Approve the files so that your users will be able to see them.

Download the file used in this sample: Item_Person_Twit.zip

What’s Next? Well, I think I am going to show you once and for all how to display the SharePoint presence icon and hover card in search results….next time!

SharePoint 2010 - Drives are running out of free space.

Copyright from: blah.winsmarts.com

As this post on blogs.msdn.com details out, this is due to a health analyzer rule configured in SharePoint. While that blogpost does a great job explaining why this monitoring is necessary, how you can tweak it, it still becomes a nuisance on SharePoint virtual machines used for development.

It also becomes a nuisance on production environments because SharePoint databases are set to auto grow. In other words, as the database is being used, it only grows, and grows, and GROWS!

Seriously, how many of you have put in work to compact the database on a regular basis? Those of you who answered no, you’re sitting on  a time bomb. Shame on you!

Anyway, compacting databases isn’t something you do blindly. This is a science on it’s own, and how and when you compact the database depends on the usage and purpose of the database. Usually this is a consideration for production environments.

In this blogpost, I am not going to go in depth in all that. This blog post is about development virtual machines that are starved on disk space, and this ever growing database issue, makes it worse. So here is how you can give yourself the gift of extra disk space on your dev. vm.

Step #1: Do the usual stuff first, delete files you don’t need. Running the Disk Cleanup Tool is a good start.

Step #2: Go to central admin, and decrease the # of days to store the log files.

• In central admin, go to monitoring
• Go to reporting\Configure diagnostic logging.
• In the Trace Log section, in the Number of days to store log files box, type in a smaller number – I usually am happy with the last 20 mins of logs or so :)
• Go to 14\Logs and delete all the files in there. Don’t delete the “LOGS” directory.

Step #3: All those managed services that the farm wizard created – well they use disk space, in the form of databases generally. Not just disk space, they also take CPU cycles. Delete the services you are not using.

Step #4: Compact databases, login to SQL Server management studio with a user that has sysadmin rights, and run the following script -

  1: DECLARE @DB VARCHAR(255)

  2: DECLARE C CURSOR FOR

  3: SELECT NAME FROM SYS.DATABASES WHERE IS_READ_ONLY=0 AND STATE=0

  4:   AND NAME NOT IN ('master','model','tempdb','msdb')

  5: OPEN C

  6: FETCH C INTO @DB

  7: WHILE @@FETCH_STATUS=0

  8: BEGIN

  9:   EXEC SP_DBOPTION @DB,'trunc. log on chkpt.','true' 

 10:   DBCC SHRINKDATABASE (@DB)

 11:   FETCH NEXT FROM C INTO @DB

 12: END

 13: CLOSE C

 14: DEALLOCATE C

Enjoy all that extra disk space.

Understanding how search results are displayed in SharePoint Server 2013

Copyright from: tothesharepoint

This is a blog post in the series "How to change the way search results are displayed in SharePoint Server 2013 and SharePoint Online."

For an overview of the blog post in this series, go to How to change the way search results are displayed in SharePoint Server 2013.

In this blog post, we’ll learn: 

• How search results are displayed by default
• About controlling how search results are displayed
• About result types
• About the connections between a result type and display templates 
• About display templates that are used by all result types
• About display template settings in the Search Results Web Part

How search results are displayed by default

When you search for something in a Search Center, your results are displayed differently. For example, in the screenshot below, notice how the icons for Word, PDF, and Excel are displayed for each results. 

By hovering over the first result, more information about the search result is displayed.

By hovering over the fourth result, the information that is displayed is different from what you saw when you hovered over the first result.

What’s going on here, and what’s making the search results display so differently? Well, that’s what I’ll explain in this blog post.

About controlling how search results are displayed

Search results are displayed in a Search Results Web Part. The following screenshot shows how SharePoint uses two display templates to control how information about search results should be displayed:

1. Item display template - used to control how you want information in the body of the Search Results Web Part to be displayed.
2. Hover display template - used to control how you want information in the hover panel to be displayed.

There are 90 default search display templates available. This might seem like a lot, but I’ll explain why there are so many later. To see all the default search display templates, go to Site settings --> Master pages and page layouts. In the Master Page Gallery, click Display Templates --> Search.

When you go to this folder, you’ll see that there’s an HTML file, and a JavaScript file for each display template.

 

To view or edit a display template, use the HTML file. SharePoint automatically transforms the HTML file into an associated JavaScript file when you upload it. Because the two files are associated, any changes you make to the HTML file will be automatically updated in the associated JavaScript file.

I’ll explain how display templates work in later posts. For now, let’s move on to result types. 

About result types

If a user is able to see information about search results directly on the search results page, this will save them the hassle of having to click and open each item to see what it’s about. If you look back at theexample in the first section, you can easily see that the first two results are PowerPoint presentations, and that the third result is a Word document.  

To display search results differently, search results have to be sorted into different result types.  A result type distinguishes one search result from another. For example, if a search result is found in a Microsoft Word document, that search result belongs to the Microsoft Word result type. If a search result is found in a PDF file, that search result belongs to the PDF result type.

There are 31 default result types. To see them, go to Site Settings --> Result Types.

For an overview of the default result types, see this TechNet article. You needn’t worry about how default search results are specified; it’s something that happens "under the Hood" in SharePoint.

It’s not possible to edit any of the default result types. However, you can copy them, and add further configurations. I’ll show you how to do this in a later blog post, but first, it’s important that you understand how result types and display templates are connected.

  

About the connections between a result type and display templates

The mechanics of these connections are not particularly straight forward and easy to understand, but let's take a look at it in a step-by-step manner.

1. Each result type contains a reference to an item display template, for example, Item_PowerPoint.
2. Each item display template contains a reference to a hover panel display template, for example,Item_PowerPoint_HoverPanel.

Let’s start with the first connection. To see the connection between a result type and an item display template, go to Site Settings --> Result Types. Select to view a result type, for example Microsoft PowerPoint.

On the Result Type page, in the Display template URL section, you’ll see that there’s a URL that points to a file named Item_PowerPoint.js.

This URL is a reference to an item display template. This means that all search results that belong to theMicrosoft PowerPoint result type will be displayed by using the Item_PowerPoint.js display template.

If you look in the Master Page Gallery, you’ll see the Item_PowerPoint.js file and the associatedItem_PowerPoint.html file.

Now for the second connection. To see the connection between an item display template and a hover panel display template, open Item_PowerPoint.html. You’ll see a reference to a hover panel display template, in this case, Item_PowerPoint_HoverPanel.js.

If you look in the Master Page Gallery, you’ll find the Item_PowerPoint_HoverPanel.js file and the associated Item_PowerPoint_HoverPanel.html file.

 So now you can understand why there are so many search display templates. It’s because four display templates are connected to each result type.

For an overview of the connection between the default result types, item display templates, and hover panel display templates, see this TechNet article.

So, that was pretty straight forward. However, we’re not quite there yet. In addition to the display templates that are connected to a result type, there are additional display templates that are used by all result types.

  

About display templates that are used by all result types

To recap:

1. Each result type contains a reference to an item display template.
2. Each item display template contains a reference to a hover panel display template.

...and then we need to add:

3. Each item display template contains a reference to a common item display template. 
4. Each hover panel display template contain references to three common hover panel display templates.

 These common display templates are located in the same Master Page Gallery folder as the display templates that are specific to individual result types.

Each item display template points to the common item display template. The following screenshot shows how the item display template used for the Microsoft Excel result type points to the common display template Item_CommonItem_Body.

Each hover panel display template points to three common hover panel display templates. The following screenshot shows how the hover display template used for the Microsoft Excel result type points to the three common hover panel display templates.

If all these references were a bit confusing, not to worry. In later blogs I’ll be using examples that will make it easier to understand.  At this point, it’s important that you understand how result types are used to categorize different types of search results, and how result types are connected to different display templates.  

  

About display template settings in the Search Results Web Part

Now for the easiest part of the puzzle: How does the Search Results Web Part know how to display search results based on the different result types?

On the search results page, click to edit the Search Results Web Part. In the Web Part Tool Pane, click to expand Display Templates.

 

You’ll see that the radio button Use result types to display items is selected by default. This means that search results will be displayed based on the result type that they belong to. That's it!

So now you know about the mechanics of how search results are displayed. In my next blog post, I'll go into detail about the item display template, and I’ll also explain the magic of hit highlighting.

How to add a custom action to the hover panel in SharePoint Server 2013

copyright from: SharePoint IT Pro Blog

This is a blog post in the series "How to change how search results are displayed". To demonstrate how you can customize your search results, I'll use examples from an internal Microsoft Search Center.

For an overview of the blog posts in this series, go to How to change how search results are displayed.

In the previous blog post, I showed you how to display values from custom managed properties in the hover panel. In this blog post we’ll learn:

• What is a hover panel action?
• How to add an action to the hover panel

What is a hover panel action?

Before I show you how to add a custom action to a hover panel, I want to make sure that you know what an action is.

At the bottom of the hover panel there are some links that are called actions. When you choose one of these, something will happen. For example, in my Search Center, when I choose “SEND”…

… an email with a link to the list item will open.

To enable your visitors to do something with the search results, without having to leave the search results page, you can add a custom action.

In my Search Center scenario, I wanted to add a custom action that opens the published article. For example, for the search result “Customize search result types in SharePoint 2013”, I wanted to add an action that opens this link: http://technet.microsoft.com/en-us/library/dn135239.aspx.

How to add an action to the hover panel

In our lists, whenever an article is published, the URL to the published article is added to the list item. The screenshot below shows how the URL to the article “Customize search result types in SharePoint 2013” is maintained in the site column “Content Release URL”.

Because this URL is maintained in the list, I can add a custom action to the hover panel that will open this link.

In my previous post I showed you how the hover panel actions are rendered by theItem_Common_HoverPanel_Actions display template. So, to add a custom action, you have to edit this file.

However, similar to what we did when we added a custom property to the hover panel, you have to add the managed property that you want to use in your custom action to the item display template.

Confused? Well, trust me, this is not easy. It took me a while before understanding how things were connected, so let’s go through it step-by-step.

To add a custom action to the hover panel, here’s what you should do:

1. Find the managed property name of the site column that you want to use. I showed you how to do this in a previous blog.
2. In your mapped network drive, open an item display template. In the item display template, in theManagedPropertyMapping tag, use the following syntax to add the custom managed property:
   '':'
   
   In my scenario, I added the custom property that I wanted to use to the TechNet content display template.

1. NOTE: You do not need to do this step if you are using SharePoint Online.
   Go to Site settings --> Search Result Types. Notice that a Property Sync alert is displayed.

This alert is displayed because we have added a new managed property to an item display template (what we did in step 2). To update the result types with the newly added managed properties, chooseUpdate.

IMPORTANT! If you don't do the update, the newly added managed properties will not display in your hover panel.

1. Open the Item_Common_HoverPanel_Actions display template. See how the default actions are created, and use JavaScript and HTML to add your custom action.
   In my internal scenario, I looked at how the OPEN action ( _#= editHmtl =#_ ) is created. Based on that, I created a new action: _#= viewHtml =#_. The following screenshot shows what I did.

 

By doing a new search and hovering over a search result, I saw that my new custom action was displayed. Nice!

So now that you know how to change the way your search results are displayed, I have just one more thing that I want to show you: How you can change the text that is displayed in the Search Box Web Part.