SharePoint Shenanigans

Using SSL with SharePoint 2010 Send To Connections

BlairBMSFT — Wed, 18 Aug 2010 13:39:26 GMT

In working on a customer POC for the Content Organizer and Records Management in SharePoint 2010, I ran into an issue trying to add a new Send To Connections in Central Administration that doesn’t seem to yet be documented.

For my scenario, I needed to route user documents from the Drop Library that gets created when you enable the Content Organizer feature on a SharePoint Web in one site collection – to another Content Organizer in different site collection. I am using the Content Type Synchronization Hub feature in 2010 to make sure all the site collections in the POC have the same Content Types available. My site, my.fourthcoffee.com, is using a SSL certificate from a Trusted Root CA in my AD DS domain – making the default URL for the site: https://my.fourthcoffee.com.

The URL that you need to add to the Send To Connections list in CA can be found in Site Actions –> Site Settings –> Content Organizer Settings (in the Submission Points section) of the target Web that has the Content Organizer feature activated. For my POC this URL is https://my.fourthcoffee.com/subweb/_vti_bin/officialfile.asmx. When I went to Send To Connections to add the new connection, I used the “Click here to test” link to make sure my connection was valid. This will open a dialog box with the results of the test. In my case the message said:

Verification failed: URL is not a valid routing destination.

I then put the URL in the browser and made sure I got the Web Services page for the ASMX file successfully. I tried to click OK and got the same message on the next page with a correlation ID. Using ULS Viewer and the correlation ID, I got the same message thrown as an exception from Microsoft.SharePoint.ApplicationPages.OfficialFileAdminPage.AddorUpdateConnection() but no real detail. In the Event Viewer at the same time that I tried to add the site I got the following entry:

Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Date:          8/17/2010 11:13:51 PM
Event ID:      8311
Task Category: Topology
Level:         Error
Keywords:
User:          FOURTHCOFFEE\fc.spfarm.svc
Computer:      FCMSS01.fourthcoffee.com
Description:
An operation failed because the following certificate has validation errors:\n\nSubject Name: CN=my.fourthcoffee.com, OU=IT, O=Fourth Coffee, L=Charlotte, S=NC, C=US\nIssuer Name: CN=fourthcoffee-FCDC01-CA, DC=fourthcoffee, DC=com\nThumbprint: 57D85F3BCFE16B4735ED51AF1E3C2CF1A9126F02\n\nErrors:\n\n The root of the certificate chain is not a trusted root authority

This threw me for a bit since I had checked the certificate on the local store and in IIS and the cert and its issuing authority both showed up as OK/Trusted. I extended the Web Application to another zone with a different FQDN but no SSL and the verification succeeded so I knew the validation error and the SSL error were related. Since I’ve set up publishing for SharePoint 2010 Service Applications between Farms and ADFS 2.0 a few times I know SharePoint has its own certificate store and wondered if that might be the problem?

Using Inetmgr I copied the CA’s certificate to a .CER file (C:\rootca.cer.) I then opened Windows PowerShell (as admin) and ran the following commands, each command is one line – sorry about the wrapping:

Add-PSSnapin Microsoft.SharePoint.PowerShell

$rootca = New-Object System.Security.Cryptography.x509Certificates.x509Certificate2(“c:\rootca.cer”)

New-SPTrustedRootAuthority –Name “FC Root CA” –Certificate $rootca

I did an IISRESET and then tested verification again – bingo.

Patching SharePoint 2010 on Windows 7

BlairBMSFT — Sat, 17 Jul 2010 03:38:53 GMT

On July 13, 2010 we released a patch for Microsoft SharePoint Foundation 2010 running on Windows 7 and Windows Vista. The guidance in the KB article directs you to run PSCONFIG after the patch to complete the installation. If your workstation is set to allow Windows Update to automatically install updates you might already have this update and not even know about it!

Look in your Windows Update history:

If you haven’t run PSCONFIG yet – this gives you a good opportunity to see what the new SharePoint 2010 patching process feels before the release of the first SharePoint 2010 CU. Open Central Administration on your developer workstation and select Upgrade and Migration. Click Check Product and Patch Installation Status. If you scroll down the list you should see an update listed under Microsoft SharePoint Foundation 2010 Core for KB 2032588. Clicking the link takes you to the KB article for the update – nice.

Now go back to the Upgrade and Migration page and choose Review Database Status. This page lists all the SharePoint databases, for services and content, and their respective patch status. On my workstation I had two Content Databases – one from a site and one from CA that have a status of:
”Database is in compatibility range and upgrade is recommended.” My Configuration database and the WSS Logging database also have the same status. This status means the content database isn’t at the same level as the bits of the farm – in this case the files that were updated in SharePoint Foundation 2010 Core. However the Farm and this content are available to end users.

If I open the SharePoint Management Shell I can use the Get-SPDatabase cmdlet to find the same information:

Get-SPDatabase | ?{$_.NeedsUpgrade –eq $true} | Select Name

Now to upgrade the Content Databases I need to run Upgrade-SPContentDatabase against the Content Database:

Get-SPContentDatabase | ?{$_.NeedsUpgrade –eq $true} | Upgrade-SPContentDatabase

Note: this command line would run the Upgrade for every Content Database in the Farm that needs Upgrade, however this will do this one at a time through the PowerShell pipeline and not in parallel. Also the Central Admin Content Database will get updated by PSCONFIG. You don’t (and can’t) touch it with Upgrade-SPContentDatabase.

Get-SPContentDatabase –Identity WSS_Content | Upgrade-SPContentDatabase

Since this could be quite a long-running operation for a Content Database with lots of Site Collections – you are prompted to confirm proceeding with the process:

After you are finished with all your content databases – run PSCONFIG to finish updating the farm. When this completes, if you run this line again:

Get-SPDatabase | ?{$_.NeedsUpgrade –eq $true}

it will return no results since all databases have been upgraded. Services in on a Server in Central Administration will now show the farm is at 2010 build 14.0.5050.5001. If you didn’t get all the Content Databases with the Upgrade-SPContentDatabase cmdlet – the PSCONFIG run will upgrade them during it’s run.

This new patching process definitely adds some much needed flexibility to the SharePoint patching story. The process allows administrators to patch pieces of the Farm’s services and content with out having in incur all of the downtime in the same maintenance window. You could potentially install the update bits on the box during the week in a short maintenance window (AFTER you’ve tested it first!) and then schedule a weekend outage to upgrade the content.

New Document ID Feature in SharePoint 2010

BlairBMSFT — Tue, 20 Oct 2009 16:39:00 GMT

Tired of broken links when someone moves a document within a site collection? Tired of nasty URL’s for a document buried deep in a doclib?

SharePoint 2010 includes a new Site Collection scoped Feature called the Document ID Service.

To enable this feature you can go the old and tired route of Site Settings -> Site Collection Features (under Site Collection Administration) or you can launch the SharePoint 2010 Management Shell and run the following:

PS C:\Users\blairb> Enable-SPFeature -id docid -url <site collection url>

Viewing the properties of a document in the document you will see your document now has a field called Document ID:

Note that for existing documents some action has to be taken on the document to cause a Document ID to be generated (like check-in/check-out.) Any new documents will have a Document ID generated on upload... Or you can go into Site Collection Administrator and force a timer job to stamp all the documents.

If you grab the link off the Document ID field you will have a URL that looks something like this:

http://<sitecollectionurl>/_layouts/DocIdRedir.aspx?ID=MFSHF5F7ZUF5-1-1

As you can see from this URL we have a new ASPX page in the layouts directory called DocIdRedir.aspx that takes a Doc ID as a querystring parameter. You can use this link to provide others with a consistent link to your documents. Even if I take the document and move it to another folder in the doclib or another doclib in the site collection the same Doc ID will still find the document.

UPDATE: A colleague asked me about Document Sets (another bad ass new feature in 2010 that lets you work with a set of files as one entity) and Document ID’s. The Document ID Service Features tags an ID on the Document Set AND on each individual file in the set. Fantastic.

Setting the Recovery Model of all SharePoint Databases

BlairBMSFT — Wed, 27 Aug 2008 16:30:12 GMT

Since my customer is using Data Protection Manager 2007 to protect their SharePoint Farm workloads - they decided they wanted to set all the SharePoint databases to use the Simple Recovery Model. They have 30+ Farms so they needed a way to do this quickly per each Farm.

The following SQL script creates a Stored Procedure that will loop through all the Databases in the SQL instance, skipping the system databases, and setting the rest of the databases returned to use the Simple model:

USE [master]
GO
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO

CREATE procedure [dbo].[SetSharePointRecoveryModel]
as

/* variables */
declare @dbname varchar(80)
declare @dbmodel varchar(80)
declare @msg varchar(120)

/* create a cursor for all the databases */
declare system_databases cursor for
select Name, Recovery_Model_Desc from Sys.Databases

open system_databases
fetch system_databases into @dbname, @dbmodel

if (@@fetch_status = 2)
begin
print 'No databases found.'
close system_databases
return
end

while (@@fetch_status = 0)
begin
if (@dbname = 'tempdb' or @dbname = 'master' or @dbname = 'model' or @dbname = 'msdb')
begin
select @msg = @dbname + ' -- Not updating recovery model of system databases.'
print @msg
end
else
if (@dbmodel = 'FULL')
begin
EXECUTE ('ALTER DATABASE [' + @dbname + '] SET RECOVERY SIMPLE WITH NO_WAIT;');
select @msg = @dbname + ' -- Set to SIMPLE.'
print @msg
end
else
begin
select @msg = @dbname + ' -- Already set to SIMPLE.'
print @msg
end
fetch system_databases into @dbname, @dbmodel
end

close system_databases
deallocate system_databases

This creates the sproc in the Master database. Using it then is simply:

USE Master
EXEC dbo.SetSharePointRecoveryModel

More information on SQL Recovery Models:

Overview of the Recovery Models
http://technet.microsoft.com/en-us/library/ms189275(SQL.90).aspx

Unable to send e-mail alerts to users with an external e-mail address

BlairBMSFT — Thu, 08 May 2008 16:51:00 GMT

This one is short and sweet. My customer has federated partners so we use ADFS to allow these partners the ability to access and collaborate with our SharePoint portal. One of our amazing developers wrote code to create user profiles in the ADFS enabled SSP (an extension of the normal Windows auth'ed SSP.) Part of this new process pulls in their email address from the claim and inserts it in the Work E-mail profile property which enables alerts to function properly. Unfortunately alert e-mails, including the initial alert setup e-mail were not being delivered to these new users. We verified that the e-mail address was correct in the profile and that normal e-mail could flow to the users. Off to the ULS logs we went, after turning up E-mail and Timer Jobs to Verbose. We found the Immediate Alerts job was logging the following:

The e-mail address '<email address>' is unknown.
Where <email address> is a valid address in the ADFS account partner.

I found this KB – which has to be the most confusing KB I think I've seen to date:

"The email address '<EmailAddress>' is unknown" error message when you add a user to a Windows SharePoint Services 3.0 or Windows SharePoint Services 2.0 Web site

http://support.microsoft.com/kb/838109
… ok same error message although not related at all. Message tracking on the Exchange Server that the SharePoint farm was configured to relay through did not show any messages arriving there bound for the ADFS Partner organization (expected – just verifying.)

Exchange 2003 SMTP Virtual Server was set to "Only the List below" with an empty list and the "Allow all computers which successfully authenticate to relay, regardless of the list above.

Unfortunately there is not a way for SharePoint to send credentials when sending alert/notification e-mails. So just to verify this is a relay issue - telnet time…

From a command prompt:

telnet

set localecho

open ex01.contoso.com 25

where ex01.contoso.com is the server specified in Outgoing E-mail Settings.

ehlo litware.com

where litware.com is the server domain of the SharePoint user to whom the alert is being sent.

mail from: johndoe@litware.com

where johndoe@litware.com is the e-mail address of the external user

250 2.1.0 email….Sender OK

rcpt to:sharepoint@contoso.com

where sharepoint@contoso.com is the from address specified in Outgoing E-mail Settings.

If you get this:

550 5.7.1 Unable to relay for sharepoint@contoso.com

If you get this:

250 sharepoint@contoso.com… recipient ok

Then your e-mail will be sent successfully.

In Exchange 2003 we could add the IP address of the SharePoint servers to the Relay list in the SMTP virtual server. In Exchange 2007 - check out this article: http://msexchangeteam.com/archive/2006/12/28/432013.aspx

How to use SSL Certificates with Multiple Subject Alternative Names in MOSS

BlairBMSFT — Fri, 11 Jan 2008 19:44:03 GMT

Some companies do not allow wildcard * SSL certificates – but do allow certificates with multiple subject alternative names. Unfortunately there is not a way to easily implement this in MOSS via the GUI. I had a customer that required this – so I figured I'd share what I found…

First:
Verify all host names are in DNS and correct
Verify you have an SSL cert with the SAN's you need and that certificate is available on each WFE.
Verify all sites are created/extended and currently NOT using SSL.

MOSS is the main site - Default Zone
MOSSANON is the site Anonymous Access enabled - Internet Zone
MOSSEXTRANET is the site that would be FBA or some other auth mechanism - Extranet Zone

Change the AAM's for each zone through Central Administration:

From:

To:

From:

To:

From:

To:

Assign the certificate to all 3 websites - only the first one applied will start - this is to be expected.

One each WFE navigate via command prompt to <System Drive>:\Inetpub\AdminScripts

Type the following command at the command prompt for each host header in this format :

cscript.exe adsutil.vbs set /w3svc/<site identifier>/SecureBindings ":443:<host header>"

NOTE: Site Identifier can be obtained in the IIS MMC:

So in our example:

cscript.exe adsutil.vbs set /w3svc/<site identifier>/SecureBindings ":443:moss.litware.com"
cscript.exe adsutil.vbs set /w3svc/<site identifier>/SecureBindings ":443:mossanon.litware.com"
cscript.exe adsutil.vbs set /w3svc/<site identifier>/SecureBindings ":443:mossextranet.litware.com"

Run IISRESET

Repeat this on the other WFE's

Verify all sites are responding:

Troubleshooting:

Follow sequence of steps in specified order – very important!
Verify all sites are started in IIS and no errors reported.
Verify by Viewing the SSL cert on each website that the SSL cert has a matching private key.

Help I've renamed a Hidden MOSS Site Column!

BlairBMSFT — Fri, 11 Jan 2008 00:35:35 GMT

One of my customers recently found that someone in the process of working with SharePoint Content Types had renamed one of the built-in Site Columns - Title - to something else… If you attempt to change the Site Column back to "Title" you get this error message:

"The column name that you entered is already in use or reserved."

This is discussed in the following KB Article:

Error message when you try to change the name of a site column back to its original name in Windows SharePoint Services 3.0: "The column name that you entered is already in use or reserved." http://support.microsoft.com/kb/923589

In the article there is an example of C# code to programmatically access the Field object in question and change the name back to the correct/desired name. Let's see if we can make this short and sweet with PowerShell…

I've got PowerShell installed on one of the members of my Farm so that I have easy access to the SharePoint object model.

# First we need to tell PowerShell how to use SharePoint objects:
[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint")

# Next we create a site object by created a variable and providing the URL of the site in question.
$site=[Microsoft.Sharepoint.SPSite]("http://<your site>")

# Next we create a web object and open it from the site.openweb method
$web=$site.openWeb()

# Next we create a field object and site it to the name of the field that we want to correct - in this case: Title
$fld = $web.Fields.getFieldByInternalName("Title")

# Next we set the Field object's Title attribute to the name we want to be displayed, again in this case: Title
$fld.Title = "Title"

# Next we tell SharePoint that we want this change to apply to all Lists
$fld.PushChangesToLists = $true

# Finally we make the change official.
$fld.Update()

PowerShell for Windows 2003 SP1 can be downloaded from here:

X86 - http://go.microsoft.com/fwlink/?LinkID=75790&clcid=0x09
X64 - http://go.microsoft.com/fwlink/?LinkID=75791&clcid=0x09

If you've gotten daring and are playing around with MOSS SP1 on top of Windows 2008 - PowerShell is simply a one-line command from the Windows 2008 Command Prompt:

ServerManagerCmd -i PowerShell

Hope this helps!