A bit of a worry-- ASP.NET vulnerability and SharePoint

A security advisory has been released concerning a known ASP.NET security issue and the danger it can pose for those of us who have SharePoint deployed (which uses ASP.NET, and therefore can be compromised).

The problem, in an oversimplified example, is that due to this vulnerability, an attacker can send information (cipher text) to the server, and see if it was decrypted correctly based on the error messages that are returned, until they know that they can get in and get private info.

Microsoft does not yet have a fix for this issue, and if you are worried (say, if your SharePoint implementation is internet facing), they offer some workarounds until they do have an official hotfix or patch you can download.

The workaround is detailed at: http://blogs.msdn.com/b/sharepoint/archive/2010/09/21/security-advisory-2416728-vulnerability-in-asp-net-and-sharepoint.aspx

The official (and not super helpful) security advisory is at: http://www.microsoft.com/technet/security/advisory/2416728.mspx

A blog by someone named Scott Guthrie, who seems to be super knowledgeable about this security issue, has two entries concerning it:

The first, as of Sept. 19 is: http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx

The follow up, Sept. 24, is: http://weblogs.asp.net/scottgu/archive/2010/09/24/update-on-asp-net-vulnerability.aspx

My environment, right now, is completely isolated, so I am going to hold off messing with the settings until I finally finish creating new material for the book. But I wanted to let you all know about the issue now, in case it compromised your environment.

It started with not being able to activate wiki page home page feature (or issue with features if you load balance your site...)

I am currently super, super busy finishing up chapters in the SPF book, but I needed to write this down somewhere...

So I finished writing the first draft of chapter 16. It involved, among other things, installing a second server on the farm and enabling load balancing so the readers could see it in action.

That meant that, at this point, my virtual machine of my SharePoint Foundation installation has two SPF servers load balancing content.

I was reading over some edits of one of my chapters and needed to see the home page without it being a wiki page for a moment. Now, there are a couple of ways to do that, the easiest being deactivating the wiki page home page feature (yeah, funny name) , the next easiest being deleting the Home.aspx page from the Site Pages library real quick (restoring it from the recycle bin takes seconds).

I am really, really behind on my edits, so in my rush, I just deactivated the feature.

I checked the stuff I needed to check, then went back in to re-activate the feature-- and it failed. I went to the other server in the set, and it failed there. I did an IISRESET on both, still failed.

I dropped to the powershell console and tried a get-spfeature command (it brings up a long list of features available for the farm at the moment). Wiki page home page was listed.

So I marked the ID of the feature (okay, so I am an old skool admin, not a developer, and it's just easier for me to grab the ID than write a bunch of pipe stuff. I keep it easy)

I then tried to enable the feature for the site manually, using the enable-spfeature command:

(EDITED TO ADD: blogspot deleted the tag I wrote originally about the identity value.. sorry for those of you who thought you could just leave -identity could be empty. Darned blogger...)

enable-spfeature -identity (paste marked ID here) -url http://theurlofmyrootsite

And it failed, saying " Enable-SPFeature : The Web application at http://spf2 could not be found. Verify that you have typed the URL correctly. If the URL should be serving existing content, the system administrator may need to add a new request URL mapping to the intended application."


What?! I know that site exists, and that I typed it's URL correctly, I was just on it.


I tried an IISRESET, no luck, on both servers, still no luck...


So I tried the same command on the other server, thinking maybe it had something to do with it. Nope.


Then I realized something. I had changed the default zone of the site to be the load balanced address.


::head smack:: Doh!!


I then reran the command but with the load balanced address. (in my case that would be http://sharepoint)


enable-spfeature -identity (paste ID here) -url http://sharepoint


And it worked perfectly!

So what does that say?

It says that in the GUI, ie in the Manage Features for the Site page, when you hit the Activate feature button, it points to the site's original URL when the site was created-- so if you change the default zone for the web application of the site you are activating features on, and you don't include the old URL in AAM to point to the web application, the Activate button might not work.


Bottom line: Either plan to activate or deactivate features via PowerShell if you remove the original URL from AAM for the site, or always include the original URL in AAM for a site (even if you don't want users to use it).

SharePoint and Office 2010 Official Launch-- May 12, 2010

Just wanted to remind everyone that tomorrow, May 12th, is the official launch date of SharePoint/Office 2010. There is going to be an online launch event at www.the2010event.com. If you want to check it out.

I know that a lot of us actually downloaded the release to manufacturer copy of SharePoint Foundation around April 22th, but for the rest of the world (that doesn't have TechNet or MSDN), this will be the day they can run out and buy SharePoint server or Office 2010 for the first time.

This date is also significant because it is the date that a whole lot of data about SharePoint should start trickling out of Microsoft, like reporting services for SharePoint Foundation (at least, that's what I am hoping).

Be sure to check out the online launch event, and try to catch the live, in-person launch events in your area. I am sure they are going to have insider info that may not be available online or in book form yet.

Some 2010 RTM (RTW) bits and bobs available right now on TechNet

Hi there ladies and gents,

I thought I'd give those of you with TechNet subscriptions a heads up. Although I am sadly still waiting on SharePoint Foundation and SharePoint Designer, the RTW (or release to web, kind of like release to manafacturer without having to burn DVDs, lol) version of SharePoint Server 2010 and Office 2010 (Professional Plus) are available as of today for download.

Feel free to download now. : )

For those of you still waiting for SharePoint Designer 2010 and SharePoint Foundation, I feel your pain.

As soon as they are up, I'll post about it...

Office/SharePoint 2010 Launch Events

So, SharePoint Foundation 2010 is releasing in mid-May (as are SharePoint Server 2010, Office 2010, and Visual Studio 2010). And to celebrate the release, as they always do, Microsoft is having Launch events.

Unlike they always do, and possibly in response to the economy, the locations where the day long events, full of swag and experts, will be sadly limited.

To see the planned agenda for the event and get your seat first (before they run out), go to https://microsoft.crgevents.com/Register2010/Content/Event_Selection.aspx. You'll find a list of the cities hosting launch events. To sign up you'll need to pick a track, IT Pro or Developer.

And, what about the folks who don't live anywhere near these lucky cities (like myself)?

Well, I found out today that there is a scaled down, half day, less stuff, less content, but still Launch focused "Launch 2010 Highlights" launch event being held at other, less popular cities.

--Basically look at it as the Tier 1 cities, with the higher population, the ones that spend the most money with Microsoft, get the full day real Launch events, and lower tiers get the "highlight" reel. Money's tight everywhere.--

Nonetheless, to register for at least the short (fun sized) version of the 2010 Launch event, go to http://www.microsoft.com/business/2010events/Highlights.aspx. That's what I did.

Besides, I'm am a little busy writing a book. Maybe I shouldn't spend a whole day away from my desk. Maybe a half day event is perfect for me.

Here's hoping, whichever event you can get to, that it'll be perfect for you too.

Interestinger and interestinger...

A few posts ago I'd listed a few of my disappointments about SharePoint 2010. In particular I'd mentioned that SharePoint Templates Packages, or .stp files-- the file type for list and site templates, would no longer be supported in SharePoint 2010. And how, obviously, that would leave those of us with custom site templates, and the 20 Fantastic 40 templates from Microsoft itself, in jeopardy.

Well, I happened to be monitoring the End User SharePoint live coverage twitter feed for the SharePoint Conference because I am not happy about missing all that critical info because I'm not there, and I came across a link to a blog post about one of the sessions. The presenter of the session was none other than Laura Brown, who is Product Manager of SharePoint over at Microsoft. Listed in the blog post was an intriguing sentence:

"The Fantastic 40 templates will be fully upgradable to SharePoint 2010"

Hmmm, does that mean all of the templates (since half of them are already .wsp or "solutions packages" and therefore supported by default in the upcoming version of SharePoint), including .stp's? I am hoping so, because that means that all of the custom templates I use for my book and my presentations will be portable. Hundreds and hundreds of list items won't have to be painstakingly remade, custom views, fields, lists, libraries, and more, all safe to import into a bold new world...

...Well, at least into a new install of SharePoint 2010, and ready to be presented to a new audience in the future.

So for Liam and the other attendees of my sessions of the last year, here's hoping that Laura is saying that, somehow, .stp files, and those who made them, won't be abandoned come SharePoint 2010's release date.

You can see the blog entry I am referring to here.

Want to get your hands on the SharePoint 2010 beta?

Howdy all,

I've had access to the early, early beta 1 bits of SharePoint 2010 (and of course, focused on WSS, or "SharePoint Foundation") since early this summer.

But, just like you (I know, kind of ironic), I've been waiting for the Beta 2 bits to become available for me to play with (and write books based on). For some reason, only TAP participants (Microsoft's Technical Adoption Program-- only available to large, large early adopting businesses), have gotten any of the more recent (ie, actually working) bits. This means that MVPs are in the same boat as the general public when it comes to getting to work with the most recent beta release of SharePoint 2010.

The beta 2 release is basically considered "feature complete." I have been given to believe that this means that all the features of the release version of SP2010 are there, however, it may not be as snappy, resource lean, or, well, functional, as the release version (c'mon, it's a beta).

If you would like to sign up to get a copy of the SharePoint 2010 beta 2 release, you can sign up here http://sharepoint2010.microsoft.com/try-it/Pages/Trial.aspx.

Good luck. : )

SharePoint Conference, SharePoint 2010, and more...

Howdy all,

I had to take a brief break from blogging due to health issues, both mine and my equipment unfortunately. But I am back now, with a vengence, lol.

So, to start, SharePoint 2010.

I didn't get to go to the big, sold out SharePoint Conference in Las Vegas this year, but I did get to see the keynote, and have had access to the beta bits since earlier this summer. However, I was not allowed to tell you about the new version of SharePoint until today.

Today, timed to coincide with the SharePoint conference, the Non-Disclosure agreement against talking about SharePoint 2010 has been lifted.

A few points, just to give you a taste.

• The new version of Windows SharePoint Services, what would have been WSS 4.0, is now been rebranded as "SharePoint Foundation 2010." No one has absolutely promised me that, with this rebranding, it will remain to be free. I will keep you posted.
• Like Server 2008 R2-- SharePoint will not be available in 32 bit. In otherwords, SharePoint only comes in the 64 bit version. So if you haven't upgraded your current 32 bit systems (hey, don't fix what ain't broke, right?), you can't upgrade to the 2010 version of SharePoint.
• SharePoint Foundation 2010 (or what I'm going to call SPF) will offer lots of new things, and take away some old, beloved things. They've made home pages of team site automatically wiki pages-- and removed the option to have a wiki site out of the box. Active Directory Account Creation mode and Directory Management Services are still supported (much to my surprise).
• Currently there is no longer a Site template gallery at the top of each site collection. STP files are no longer supported. So all those cool site templates you've created (or downloaded from Microsoft)? Not gonna fly with SPF 2010. Now, site templates are packaged as "solutions." We'll see if there is going to be any support for converting STP's to WSPs, as time goes by.
• There is a new site template out of the box (oob) for SPF, Groupboard. This site template is very much like a team site template, only it's focused, it seems, on tasks that a receptionist or administrative assistant might need to do to manage a team. I'll be showing that to you soon.
• Some Business Data Catalog capabilities have been surfaced for this version of WSS (I mean SPF). Also, the limited data analysis features have been broadened with the Health analyzer and better monitoring.
• File/document management has some improvements, like Documents sets (something else I'll be showing you at some point).

Things I am not thrilled about:

• The ribbon. Now it takes three or more clicks to do what I could with one thanks to the new, context sensitive Ribbon. With SPF, instead of clicking on the link for the document library, and while the page is barely finished loading, clicking new, you now have to wait for the page to load, the tabs to be drawn, to click on the document tab, wait for that ribbon to populate, then click on another link to start a new document.
• Although STSADM is still going to be supported, MS is throwing everything into PowerShell. That means that there are, apparently, 500 new cmdlets (command-lets) for managing SharePoint in PowerShell. However, when I've used PowerShell to do things, it's much, much harder to do. We'll see what comes of that as the release data for SPF approaches. I don't have high hopes though.

And for those of you going for certification, well, that's 500 more things to learn.

• Edited to add another change to SharePoint that I really don't like with this next version--- The WID,windows internal database, or SSEE, SQL Server Embedded Edition, will not be what SPF installs if you use a Basic, single server installation. Nope-- SPF is taking a step backwards and going to use SQL Express for the database if you do a single server, basic install. I guess the WID worked too well and was valid competition for SQL? So for those of you using WSS 3.0 in a basic configuration-- and database size could be an issue-- do not upgrade. Don't even think about it, unless you want to invest in new hardware, software, and licenses to go full SQL Server. I've been mad about that for a while now, and had to get it off my chest. (that and not supporting all those Site Templates I've made, and taught people how to make, over the years)
  

Beyond the SPC conference, I am also prepping for two SharePoint Saturdays: One in Cleveland Ohio, Nov. 14, and one in Richmond, Virginia on Nov. 21. And, as I have been doing for months, I am still trying to find a venue in which to present the TTT content for a Windows Server 2008 R2 FireStarter event (right now a possibility in Pittsburgh on Dec. 9th).

That's it for now. More later. : )

Some sneak peek info about the next version of SharePoint, SharePoint 2010

This morning Microsoft posted some preview info about SharePoint 2010 on their SharePoint site: http://sharepoint.microsoft.com/2010/Sneak_Peek/Pages/default.aspx. This site has several videos, one for a general overview, one for IT Pros, and one for Developers. In addition, there's data on what kind of specs the new SharePoint will need.

What isn't covered, and this isn't surprising, is what exactly will be in the new Server edition, and what will be available in good old SharePoint Services 2010.

As far as details, well, they're being held of until October, for the SharePoint Conference in Las Vegas. Apparently, it's at that event that SharePoint 2010 is really going to be unveiled.

Now, I can send in abstracts for the event and possibly speak there. However, I am not sure what people would like to see. So if you've got ideas for sessions, questions about the new version of SharePoint Services that might be a good session topic, or otherwise think it's a good idea for me to present at that event, please let me know. : ) I've been spending the summer doing Frugal Admin stuff, and could use some brainstorming.