BIFocal LLC

Month: January 2011

  • The definitive BCS in SharePoint 2010 book now available

    My friend and colleague Scot Hillier has just published his new book with his co-author, Brad Stevenson, called “Professional Business Connectivity Services in SharePoint 2010”. 

    Scot brought me a copy today and from the brief bits that I have had an opportunity to read so far (plus what I was privilege to review prior to the printing), it far exceeds the expectations one might have for simply being THE BOOK (yes I know there is only one out there) on BCS.  Scot targets the book to C# developers, but even a simple admin/architect type like me is able to understand and follow Scot’s easy to read style of writing and grasp the concepts.

    As the “stereotypical SharePoint admin” model punching bag for Scot’s presentations I may be a bit biased as I get to work with this talented guy on a regular basis, but I highly recommend you invest in this book, available in paperback or e-book, and give it a thorough read.  Chapter 8 on “Working with BCS Security” and the details he gives around Secure Store and Claims Authentication make it worth the investment alone for us admin types.

    Shameless Plug (as though this whole post wasn’t already!)
    Buy Scot’s book from the publisher or from Amazon.com and support his good work.

  • How to: Fix the "Unable to access SharePoint sites from the localhost" problem

    Ever try to access a page on your SharePoint site from your web front end only to get prompted for a login that never lets you through?

    The issue happens when dealing with sites that Integrated Authentication and have names that are mapped to the loopback address.  Translation:  if you are using Windows with Claims or Classic Mode web applications  and you are trying to connect from the server, this is you.

    The LoopbackCheck security feature is enabled by default on Windows Server since 2003 SP1 and since most SharePoint Farms are going to have an FQDN AAM or two, this is going to be something that many admins are going to run into.

    There are two options, and as in most scenarios one is easy and the other is the right way.

    Option 1. – create a Multi-String Value that has all of your AAMs for the server and restart the IISADMIN service.

    Option 2. – disable the LoopbackCheck on the server

    The Microsoft recommended option is #1 (I happen to agree), however you have to do this on every server (however if you have access to create and modify GPOs, this should be something that you can just have centrally managed for all SharePoint WFEs) and you need to have the list of all of your AAMs handy with which to do it.  Not a ton of work, so bite the bullet and update the registry entry.

    Serious caveat:  Option 2 is great if you are working on a developer vm or something to play with for a short burst, but if you are going to put something in production, please protect yourself and allow Microsoft to do the same.  This is one of those security scenarios where they are putting a validation check in place to protect you from malicious attacks.

    For the more detailed steps on making the changes visit the KB article and get it from the horse’s mouth.

  • Update: PowerPivot in Windows with Claims Authentication on SharePoint 2010 case

    We had a second great discussion with Lee Graber and Venky Veeraraghavan and our MS Account Team today.  They are actively working on getting a solution to allow PowerPivot to work with Windows Claims Authentication in SharePoint 2010, as I talked about in my previous post.  They are expecting to down select an approach, from 4 down to 1, by the end of the week and give us an update on what the timeline will look like.This has been a great experience working with the two product teams, SharePoint and PowerPivot.  Everyone at Microsoft is very dedicated to getting a solution that will not only work for this one customer (us), but for the general population as well.I will update again once I have more to report!

  • SharePoint 2010 & SQL 2008 R2 build numbers and helpful patching links

    In an effort to make life simpler I have compiled a short list of useful link to build numbers and patching sites for SharePoint 2010 and SQL 2008 R2.

    The Microsoft SharePoint Updates PagesSharePoint 2010 – http://technet.microsoft.com/en-us/sharepoint/ff800847.aspx
    SharePoint 2007- http://technet.microsoft.com/en-us/office/sharepointserver/bb735839.aspx
    This is your official sites for downloading the SharePoint updates from Microsoft.  Highly useful rather than waiting on the blogger community to send you a link, or get the TechNet bulletin, your carrier pigeon to arrive, or any of the other 120+ ways to get your SharePoint update information!

    Cornelius J. van Dyk’s Blog on Versions for SharePoint
    http://www.cjvandyk.com/blog/Lists/Versions/
    Highly useful link if you find yourself a CU or two behind and you want to know what version of the CU is currently applied to your farm.  Simply visit your Central Admin Manage Patch Status page http://localhost:####/_admin/PatchStatus.aspx to check what version number your farm is on.

    SQL 2008 R2 build numbers
    http://support.microsoft.com/kb/981356/    This has proven to be the most reliable site I have found for listing the latest build numbers for SQL Server since 2008 R2 dropped.  To find out what what build you are running do the following:

    1. Open SQL Management Studio
    2. New Query
    3. type and then execute the following command 
      select @@version

      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode, .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode pre
      {font-size:small;color:black;font-family:consolas, “courier new”, courier, monospace;background-color:#ffffff;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode pre
      {margin:0em;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .rem
      {color:#008000;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .kwrd
      {color:#0000ff;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .str
      {color:#006080;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .op
      {color:#0000c0;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .preproc
      {color:#cc6633;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .asp
      {background-color:#ffff00;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .html
      {color:#800000;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .attr
      {color:#ff0000;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .alt
      {background-color:#f4f4f4;width:100%;margin:0em;}
      .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .lnum
      {color:#606060;}

    We are working on getting a SQL Server version’s page up on CvD’s blog as well, but for now I here is a table with the info:

    April 2010 RTM
    10.50.1600.1
    May 2010 CU1
    10.50.1702.0
    June 2010 CU2
    10.50.1720.0
    August 2010 CU3
    10.50.1734.0
    October 2010 CU4
    10.50.1746.0
    December 2010 CU5
    10.50.1753.0

  • All PowerPivot Features supported only in Classic Mode Authentication

    Surprised?  I was this week as well.  I have had a case open with Microsoft since October that we have been playing with back and forth trying to figure out why automated refreshing of a PowerPivot workbook wasn’t working.We let the case go off and on for a quite a while because in the opening days we found that if we ran the PowerPivot Service Application Pool in the context of the farm admin account, that manually refreshing the data would work.  Having a work around in hand threw this issue to the back of the queue for a while.

    After much diagnosis, discussion, and many weeks of thinking that the Secure Store Service wasn’t working properly, along came a very simple explanation: PowerPivot requires Classic Mode Authentication.  FBA and Claims are not supported for doing data refresh or usage data collection scenarios.

    The answer to our question came via 3 references:

    PowerPivot Data Refresh – Everything you always wanted to know  – Page 14 is a good place to start.  Section called “Anatomy of PowerPivot Data Refresh” – written by Mariano Teixeira Neto

    Plan PowerPivot Authentication and Authorization – “To support data refresh and usage data collection scenarios, PowerPivot for SharePoint requires Classic mode authentication. PowerPivot requires a Windows domain user to be the identity behind the SharePoint security token, which it will use to create a history of user activity and document ownership, and to connect to external data sources during data refresh.” – quoted from Technet

    Why PowerPivot requires ‘classic-mode’ web applications – “The second one (i.e. ‘b’ above) is a bit trickier and it is the core issue for this blog entry. In PowerPivot, when connecting through our front-end web services (aka, the PowerPivot Web Service, or PWS in our architectural design) the underlying protocol is the same as the one that earlier versions of Analysis Services used for the ‘data pump’ feature (http://technet.microsoft.com/en-us/library/cc917711.aspx). That protocol does not know about claims – it relies on getting a Windows identity.” – quoted from Dave Wickert, aka PowerPivotGeek

    One of the answers that we got regarding this is that PowerPivot is a part of SQL Server 2008 R2 and not a part of SharePoint 2010, so it wasn’t really a SharePoint authentication problem.  ((Does that sound right?))

    We have gone back to Microsoft and are looking to see if this is something they are going to be able to fix so that Claims Based Authentication can truly be the end-all-be-all solution that we are all hoping that it can be, or if this is just one of many things that we are going to run into that aren’t yet supported in CBA mode.  For those keeping count we are now up to 2 major issues that have come back to CBA as the root cause, the other being the Site Directory issue (which we are still waiting to hear if they are going to accept our hotfix request or not… last update from the engineer was yesterday).

    I have to give a ton of thanks to the MS TAM (Mike Mitchell) that I work with, the engineer (Jason Haak) who worked on this case with us, and the 2 guys who seem to be the experts in the world on PowerPivot, Dave Wickert and Lee Graber.  We spent so much time focused on the technology of the platform and how cool PowerPivot was to work with, that we forgot rule #1 (which they kindly reminded us of)… RTFM.