SharePointSharePointhttp://www.usingnat.net/sharepoint/2011-02-25T14:20:10ZSquarespaceLooking SharePoint Topologies as Patterns (MOSS 2007)http://www.usingnat.net/sharepoint/2011/2/25/looking-sharepoint-topologies-as-patterns-moss-2007.htmlNaT2011-02-25T14:04:10Z2011-02-25T14:04:10ZWhen I first had to deal with SharePoint 2007 server topologies I had to understand the different possible configurations so I can come up with a configuration that takes performance, availability, redundancy and flexibility in to account. So, I thought it would be cool to think of SharePoint server configurations as patterns and anti-patterns and be able to identify them quickly without going into details and be able to communicate it to others.

To start with, let me just define what design patterns in Software engineering are (got it from Wikipedia):

Pattern: a design pattern is a general reusable solution to commonly occurring problem in software design.

Anti-Pattern: an anti-pattern is a design pattern that may be commonly used but is ineffective and/or counterproductive in practice.

SharePoint Server Roles

Let me first describe the different server roles in SharePoint 2007.

Be aware: it's targeted for MOSS 2007 (not SharePoint 2010).

WFE   

Any server in SharePoint that has the “Windows SharePoint Services Web Application” service is a Web-Front-End. That means your Web Applications is configured on each one of the web-front-ends and can potentially receiver requests from end-users through IIS Web Sites.

Whether a WFE serves end-users or not matters on which one of the WFEs you load balance and expose it to end user requests. So that means just because a server has the “Windows SharePoint Services Web Application” service installed, it does not mean it is receiving requests from end-users (very important point).

 

QUERY

A server with a query role is a search server in SharePoint that has the “Office SharePoint Server Search” service running and configured for serving search queries.

SharePoint out-of-the-box can load balance the query role for you. That means you can have more than one server with the query role.

INDEX 

A server with a query role is a server in SharePoint that has the “Office SharePoint Server Search” service running and configured for indexing content.

SharePoint by design cannot load balance the index role. That means you can only have one server having the index role, unless you configure another SSP (you can only have one index per SSP).

 

EXCEL

A server with an excel role is a server in SharePoint that has the “Excel Calculation Service” running. It is basically used to do excel calculation and render excel content to SharePoint sites. And, this role can be load balanced easily by SharePoint.

CA

A server hosting the Central Administration Web Application

 

DB

A database server (or cluster) hosting the content databases, the configuration database and other SharePoint databases.

 

The Standalone Configuration

I will start with the standalone configuration, because that’s where all the anti-patterns arise. The standalone configuration is basically having all the roles on a single server and we will branch out patterns and anti-patterns from it.

 

The Anti-Patterns

Propagation Anti-Pattern

One of the common mistakes when configuring an application server is assigning the same server the Query and Index role. Don’t ask me why, but for some reason if the index finds the query role on the same box, the indexer assumes that there is no other server in the farm that has the query role, therefore does not propagate index to other query servers. So, don’t forget! Make sure you don’t assign the query and index role for the same server and assume other load balanced query servers to be functional.

 

Disk-I/O Anti-Pattern

Database Operations really depends a lot on the physical storage, and a lot of Disk I/O happens on a database server. Because of that, having the WFE role on the same server will affect the performance of the SharePoint site because the worker process will compete with the database server for resources. And this is actually the first thing you should avoid, as you will improve your SharePoint site performance significantly if you have the database role on a dedicated box.

Exposed-CA Anti-Pattern

A common mistake you can make, is hosting the central administration Web Application on a Web Front End (a web front end that actually serves requests). Say, the WFE box is compromised, that would expose the central administration for an attack (you wouldn’t want that, would you?). You need to take care of one thing though, the central administration web application located on a complicatedly separate box could still be vulnerable, and so you need to plan how to protect the central admin box from the WFEs (be it with some kind of firewall, or whatever).  

 

The Patterns

Database-Separation Pattern

Like I mentions on the Disk-IO anti-pattern, you can easily increase your SharePoint site performance by having a dedicated server. And, that’s the first thing you should consider, therefore the Database-separation pattern.

Request-Separation Pattern

This pattern separates the Web-Front-End from the Application server. Using this pattern, you solve 2 major issues:

  • By separating the WFE from the CA, you can have a chance to protect the Central Administration Web Application.
  • The indexing can consume server resources. So, separating the WFE from the indexer will be another performance boost after applying “The database separation pattern”.

Query-Separation Pattern

I mentioned earlier that if the index and query are on the same box, the index will not propagate index on to other query servers. So, by separating the query role into a different server, you avoid the propagation issue and at least you give yourself the flexibility to add more query servers as you need them (note that I have the WFE and the Query role on the same box, if you only have 3 boxes then that’s the best way to go, but if you anticipate a lot of query requests it might be a good idea to have a dedicated query server).

 

Target-Box Pattern

Didn’t we talk about “The exposed-CA anti-pattern” and “the competing-Indexer anti pattern” earlier? Then, WTF is the WFE role doing with the CA and Index role? The answer is simple: I am not really using the second WFE for end-user requests (the one with the CA and other roles), it’s not load balanced or does not get end-user requests at all. I can even hide it behind a firewall. The reason I have it: is to avoid the request load on the end-user WFEs that is coming from the indexer. You basically have a target box for the indexer. Target box pattern also avoids the extra hop on the network, because the calls from the indexer would be local.

 

Request-Load-Balancing Pattern

You have applied “The database separation pattern”, “The request separation pattern”, “The query separation pattern”, and you have avoided the exposure of the CA, you have increased the performance of the WFE, and you have given the query a chance for load balancing.

So, now it’s time to care for your Web-Front-Ends. By adding a second WFE not only you make your SharePoint more available (if one is down, you got the other still running) but you also increase performance by distributing request loads. Note that, your query request is also load balanced, this makes your farm more available (if one query is down, the other will take it).

 

Available-Database Pattern

When you first applied “The database-separation pattern”, you gained a significant performance. Now, you should plan how to make your server available. Pretty simple, you use SQL Server clustering. Take note here, that SharePoint doesn’t really know about the database cluster; SharePoint just refers to the database as if it was a single server. And, it’s pretty much the job of SQL server to manage the cluster. You pretty much have two options when clustering database servers: Active-Active or Active-Passive clustering. You either have both as active or you can have one active and the other passive where one of the database servers is active and the other stays inactive and waiting for the other to fail and take over, therefore “The available-Database pattern” (I am not an expert on this subject but you can use the technique of Database Mirroring to make your database redundant).

 

X5 Pattern

When you apply “The database-separation”, “The request-separation”, “The query-separation”, “The target-box”, “The available-database” and “the request-load-balancing” patterns, you end up with a minimum of 5 servers forming an X, therefore I call it the X5 pattern. Note that if you’re avoiding “The propagation anti-pattern” and trying to load balancing search then you pretty much end up assigning the query roles to both WFEs.

 

Web-X6 Pattern

This is pretty much the X5 pattern, with one additional server targeted for Web request. From applying the X-5 pattern we ended up load balancing the query role on both WFEs, and now you might need to plan to have an additional WFE not to over kill the 2 WFEs. That also gives you a chance to just leave the index alone and separate the Excel to the 3rd WFE or perhaps load balance the Excel role between the 3rd WFE and the application box. With this pattern, you can pretty much load balance WFE, Query and perhaps Excel services.

App-X6 Pattern

The Web-X6 pattern can perhaps fit for a farm where WFEs do a lot of user authentication for collaboration reasons (authentication could be expensive, so therefore an additional WFE would definitely help). On the other hand, The Application-X6 pattern targets the query role. If you are expecting a lot of search queries, then it might be a better idea to have a dedicated query server than having a 3rd WFE, for that reason you add a 2nd application server and that can primarily be used for query but you can also use it to host a second CA or separate the CA from the index server (btw if you are having the CA with Query server you can perhaps stop IIS, and start it back whenever you need it, that way you don’t have to worry about having using up the memory), and you can also use the same box to load balance the Excel Role if Excel services availability is very important.

 

Conclusion

This was more of an excercise to go through the process of identifying and understand the different topologies. Please make sure you research and plan before you configure your farm, and don’t take the patterns black-and-white, as you have to come up with your own topology that best fits your budget and your business.

Thanks,

using(NaT)

 

 

]]>How to programmatically authenticate to UAG protected SharePointhttp://www.usingnat.net/sharepoint/2011/2/23/how-to-programmatically-authenticate-to-uag-protected-sharep.htmlNaT2011-02-23T15:48:15Z2011-02-23T15:48:15Z

this post is not a how-to configure UAG and SharePoint for Authentication. It's about how to programmatically authenticate to UAG and use the SharePoint Client Object Model under the following scenario.

The scenario:

<!   Your SharePoint Site is behind a Forefront Unified Access Gateway (UAG) that’s configured to have a single login experience with SSO, by providing you a login page that redirects you to the appropriate ADFS protected SharePoint Content.

 


For the SSO to work, UAG has to issue cookie based security token to the user before the SharePoint content can be delivered. When you hit your public SharePoint URL for the first time, UAG responses back with an automatic redirection taking you to a form-based UAG login page. When the user submits their credentials, the cookie-based security token generated by UAG is submitted behind the scene. UAG will then validate the credentials and approves the cookie-based security token. At this point any request to the SharePoint URL with the approved cookie-based security token will be granted access to the SharePoint content.

Now, what happens when you connect to the SharePoint URL programmatically?

After UAG redirects you to a login Page, it sends you back cookie-based security tokens that you are supposed to submit along with your credentials. If you don’t use the cookies, you will be stuck in a loop where UAG will keep redirecting you till you provide a cookie container, and you would reach the maximum automatic redirection allowed by your http request. Therefore you get the following error: “Too many automatic redirections were attempted” (I talk about this, because that's the first issue I encountered, when dealing witht UAG and SharePoint authentication).

 

If you are creating a .NET client application connecting to SharePoint, you would either build proxies against the SharePoint Web Services or use the SharePoint Client Object Model. I choose to use the SharePoint Client Object Model because it’s simpler, especially because I don’t have to worry about passing canary value (X-Request Digest Information), because that is already taking care of behind the scene.

So the first thing you should figure out is how you can pass cookies to each HTTP requests that the SharePoint Client Object Model uses. The answer is simple: Create an event handler to Microsoft.SharePoint.Client.ClientContext ExecutingWebRequest event that initializes a cookie container for the underlying HTTP Request before doing anything. And add the UAG approved cookies to the cookie container.

 

How to get the UAG approved cookies:

<!   1.   Do a GET on https://SharePointURL

2.    2. Get the cookie from the Response

      3. Construct the UAG Login Page URL

      4. Do a POST to the UAG Login Page URL with the correct credentials along with the cookie

<!  5. Then pass the cookie to the ClientContext’s underlying HTTP Request using the event handler.

 

I have created a class called CookieAuthenticator that will do the first 4 steps for you and returns the cookies that you can add to the SharePoint client context underlying HTTP request.

 

CookieAthenticator:

 

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

using System.Net;

using System.IO;

 

namespace net.usingnat.SharePoint.Uag

{

    public class CookieAuthenticator

    {

        NetworkCredential Credential

        {

            get;

            set;

        }

        string Url

        {

            get;

            set;

        }

        string UserAgent

        {

            set;

            get;

        }

        private CookieCollection Cookies

        {

            get;

            set;

        }

        private string[] Queries

        {

            get;

            set;

        }

        private string ValidationUrl

        {

            get;

            set;

        }

 

        private void Connect()

        {

            HttpWebRequest request = (HttpWebRequest)WebRequest.Create(this.Url);

            request.CookieContainer = new CookieContainer();

            request.UserAgent = this.UserAgent;

 

            //Do a GET on the SharePoint URL

            using (HttpWebResponse response = (HttpWebResponse)request.GetResponse())

            {

                //Get the UAG generated cookies from the response

                this.Cookies = response.Cookies;

               

                //Get the query strings to construct login page URL

                this.Queries = response.ResponseUri.Query.Substring(1).Split(new string[] { "&" }, StringSplitOptions.RemoveEmptyEntries);

                this.ValidationUrl = this.Url;

 

                //Construct the login page URL

                for (int i = 0; i < response.ResponseUri.Segments.Length - 1; i++)

                {

                    this.ValidationUrl += response.ResponseUri.Segments[i];

                }

                this.ValidationUrl += "Validate.asp";

            }

        }

        private void ValidateCredentials()

        {

 

            //Construct the POST HTTP Request Data

            ASCIIEncoding encoding = new ASCIIEncoding();

            string postData = string.Empty;

            postData += string.Format("user_name={0}", this.Credential.UserName);

            postData += string.Format("&password={0}", this.Credential.Password);

            postData += string.Format("&repository={0}", "AD");

 

            foreach (var query in this.Queries)

            {

                if (query.Contains("site_name=")

                    || query.Contains("resource_id=")

                    || query.Contains("secure=")

                    || query.Contains("login_type="))

                postData += "&" + query;

            }

 

            byte[] data = encoding.GetBytes(postData);

 

 

            //Do a POST on the Login Page URL

            HttpWebRequest postRequest = (HttpWebRequest)WebRequest.Create(this.ValidationUrl);

            postRequest.ContentType = "application/x-www-form-urlencoded";

            postRequest.ContentLength = data.Length;

            postRequest.CookieContainer = new CookieContainer();

            foreach (Cookie cookie in this.Cookies)

            {

                postRequest.CookieContainer.Add(cookie);

            }

            postRequest.Method = "POST";

            postRequest.AllowAutoRedirect = true;

            using (Stream newStream = postRequest.GetRequestStream())

            {

                newStream.Write(data, 0, data.Length);

            }

 

            //get back the cookies

            using (HttpWebResponse response = (HttpWebResponse)postRequest.GetResponse())

            {

                this.Cookies = response.Cookies;

            }

 

        }

 

 

        public CookieAuthenticator(string url, string userAgent, NetworkCredential credentials)

        {

            this.Url = url;

            this.UserAgent = userAgent;

            this.Credential = credentials;

        }

 

        public CookieCollection Authenticate()

        {

            this.Connect();

            this.ValidateCredentials();

            return this.Cookies;

        }

    }

}

 

 

Sample Program (How to pass the cookie to the ClientContext):

 

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

using System.Web;

using System.IO;

using Microsoft.SharePoint.Client;

using System.ComponentModel;

using System.Data;

using System.Net;

 

namespace net.usingnat.SharePoint.Uag

{

    class Program

    {

        private CookieCollection cookies;

 

        static void Main(string[] args)

        {

            var program = new Program();

            program.Authenticate();

            program.GetData();

        }

 

        public void GetData()

        {

            using (ClientContext ctx = new ClientContext("https://SharePointURL"))

            {

                ctx.ExecutingWebRequest += new EventHandler<WebRequestEventArgs>(ctx_ExecutingWebRequest);

 

                ctx.AuthenticationMode = ClientAuthenticationMode.Default;

                var list = ctx.Web.Lists.GetByTitle("Documents");

 

                ctx.Load(list);

                ctx.ExecuteQuery();

 

                Console.WriteLine("Title: " + list.Title);

                Console.WriteLine("Description: " + list.Description);

                Console.WriteLine("Count: " + list.ItemCount);

 

                Console.ReadLine();

            }

        }

        public void Authenticate()

        {

            Console.WriteLine("Enter your username: ");

            var userName = Console.ReadLine();

            Console.WriteLine("Enter your password: ");

            var password = Console.ReadLine();

            var url = "https://SharePointURL";

            var userAgent = "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13";

            var credentials = new NetworkCredential(userName, password);

 

            var authenticator = new CookieAuthenticator(url, userAgent, credentials);

 

            this.cookies = authenticator.Authenticate();

       }

 

        private void ctx_ExecutingWebRequest(object sender, WebRequestEventArgs e)

        {

            e.WebRequestExecutor.WebRequest.CookieContainer = new CookieContainer();

            foreach (Cookie cookie in this.cookies)

            {

                e.WebRequestExecutor.WebRequest.CookieContainer.Add(cookie);

            }

        }

 

    }

}

 

 

The next step should be how to sign-out from UAG. Well, if you figure that out please let me know.

 

Thanks,

 

Using NaT

 

 

]]>Add-SPSolution : "Access Denied" Vicious Circle (SharePoint 2010)http://www.usingnat.net/sharepoint/2010/6/2/add-spsolution-access-denied-vicious-circle-sharepoint-2010.htmlNaT2010-06-02T14:37:53Z2010-06-02T14:37:53ZIf you get an "Access Denied" when trying to deploy a SharePoint solution using PowerShell in SharePoint 2010, then you probably did not run PowerShell as "Run as Administrator" or/and you are not a ShellAdmin.

So, just right-click PowerShell and click "Run as Administrator". If that does not work you then just run Get-SPShellAdmin and see if your account you are using is listed as a ShellAdmin. Initially, only the "Farm Admin" service account is a ShellAdmin (not the "Setup Admin" service account). If your account is listed, then I am sorry I wouldn't know what to say. But, if not then use the Add-SPhellAdmin to add your account. You might run here into a vicious circle where you would still get "Access Denied" when running Add-SPShellAdmin. In this case just login as the "Farm Admin" service account and then add your initial account as a Shell Admin.

At this point, you can login back with your initial account, "Run As Administrator", and then run Add-SPSolution, and hopefully it works for you (finger crossed).

using (NaT)

 

]]>Audio file support in a SharePoint Document Libraryhttp://www.usingnat.net/sharepoint/2009/9/15/audio-file-support-in-a-sharepoint-document-library.htmlNaT2009-09-15T20:08:22Z2009-09-15T20:08:22ZAdd an audio file into a SharePoint document library and try to open it. You will get the following message if you are using IE 8 (or previous version of IE):

 

If you upload audio files to a regular document library, SharePoint will sends back the file request as MIME Type of “text/html” (maybe text/plain) instead of “audio/wav” (or something similar audio type). For that reason, IE is not smart enough to detect the content is in fact an audio file to launch the appropriate application, perhaps Windows Media player (Google Chrome can actually detect it and play the audio file in-browser).

The solutions I can think of are the following:

Solution-1: Change your document library view to “Explorer View”, and it will basically detect any file type in your document library as if they were in your local machine. Keep note that it is actually running system commands and that might be unsafe.

Solution-2: Create an HttpModule to intercept requests to the SharePoint Web application, detect if an audio file has been request, then respond back with a MIME type “audio/wav” instead of “text/html”, and then let the browser detect the audio file and open its appropriate windows application.

Solution-3: Create a custom Field Type that uses a form-rendering control that figures out the URL of the audio and embeds a windows media player to play the audio when item is in “View Properties” mode. Then, make use of your new custom field type in your SharePoint document library.

Solution-4: Dynamically add “Play” Edit Control Block for audio items, and when clicked it navigates to a SharePoint application page that plays the audio in-browser Windows Media Player.

Solution-1 is slick and quick way of solving it, if users are willing to run system commands of course. Solution-2 is theoretically feasible. Effects are at the web application level, which makes it interesting, and worth looking at, as you can apply the same concept to other non-supported files in SharePoint Document libraries. Solution-3 sounds possible too. In fact I first started out this road, and realized it will need more effort and time than I expected it would (If possible I might give it a shot sometime, at least to explore the intrinsic involved in custom field types, RenderPattern elements and form-rendering controls). But, if you like the idea of having a “Play” ECB specifically added for audio files and let’s you play audios from your browser without opening other apps in your machine, then solution-4 is what you are looking for.

Here you find sample codes. Sample codes!!!! In other words, you have to clean it up on your own.

But anyways, the followings are the different components of solution-4:

  • Audio Library: A SharePoint document library containing audio files (ex: files with extension .wav)
  • Audio-Check Service: a SharePoint application Page used as a simple web service that can determine whether an item in SharePoint is an audio file or not. All it does is receive a SharePoint item URL, uses the Object Model to determine the extension of the file, then responses back a Boolean value in an XML format.
  • Content Editor Web Part: added on the same page as the List View Web Part of the audio library. It will contain JavaScript codes that uses SharePoint JavaScript Context object and XHR object to make Ajax calls to Audio-Check Service, determines whether or not a document is an audio file, and depending on the result decides to put the “Play” edit control block for only audio files.
  • Audio Player Page: a SharePoint application page that receives an audio file URL and plays audio on a page using embedded Windows Media Player.

Audio-Check Service

   1: using System;
   2: using System.Collections.Generic;
   3: using System.Linq;
   4: using System.Text;
   5: using System.Web;
   6: using Microsoft.SharePoint.WebControls;
   7: using Microsoft.SharePoint;
   8: namespace NaT.SharePoint.EditControlBlockAudioSupport.WebControls
   9: {
  10:     public class AudioCheckService : LayoutsPageBase
  11:     {
  12:         protected WindowsMediaPlayer _mediaPlayer;
  13:         protected override void OnLoad(EventArgs e)
  14:         {
  15:             base.OnLoad(e);
  16:  
  17:             string itemId = this.Request.QueryString["ItemID"];
  18:             string listId = this.Request.QueryString["ListID"];
  19:             string audioCheck = this.Request.QueryString["AudioCheck"];
  20:  
  21:             
  22:             if(audioCheck != null)
  23:             {
  24:                 SPList list = this.Web.Lists[new Guid(listId.Trim())];
  25:                 SPListItem item = list.GetItemById(Int32.Parse(itemId.Trim()));
  26:                 bool displayEditControlBlock = this.IsItemAnAudioFile(item);
  27:                 this.ResponseDecision(displayEditControlBlock);
  28:             }
  29:         }
  30:  
  31:         public bool IsItemAnAudioFile(SPListItem item)
  32:         {
  33:             return item.File != null && item.File.Name.EndsWith(".wav");
  34:         }
  35:  
  36:         public void ResponseDecision(bool decision)
  37:         {
  38:             this.Response.ClearHeaders();
  39:             this.Response.ClearContent();
  40:             this.Response.Cache.SetCacheability(HttpCacheability.NoCache);
  41:             this.Response.AddHeader("Content-type", "text/xml");
  42:             this.Response.Write(@"<?xml version=""1.0"" encoding=""UTF-8"" ?>");
  43:             const string cmdPattern = @"<Command>{0}</Command>";
  44:             this.Response.Write(string.Format(cmdPattern, decision.ToString().ToLower()));
  45:             this.Response.End();
  46:         }
  47:     }
  48:     
  49: }

 

Audio Player Page

For playing back audio you can use <OBJECT /> HTML Tag for embedding Windows Media Player in your browser, it let’s you pass a URL as a parameter and streams it back for you.

<OBJECT 
  id="{0}" 
  CLASSID="CLSID:22D6F312-B0F6-11D0-94AB-0080C74C7E95" 
  type="application/x-oleobject" height="500px" width="500px">
  <PARAM NAME="URL" VALUE="" />
  <PARAM NAME="SendPlayStateChangeEvents" VALUE="True" />
  <PARAM NAME="AutoStart" VALUE="true" />
  <PARAM NAME="AnimationAtStart" VALUE="true" />
  <PARAM NAME="ShowControls" VALUE="true" />
  <PARAM NAME="ShowAudioControls" VALUE="true" />
  <PARAM NAME="ShowTracker" VALUE="true" />
  <PARAM NAME="EnableTracker" VALUE="true" />
  <PARAM NAME="ShowStatusBar" VALUE="true" />
  <PARAM NAME="ShowDisplay" VALUE="true" />
  <PARAM NAME="AudioStream" VALUE="true" />
  <PARAM NAME="ShowPositionControls" VALUE="true" />
  <PARAM NAME="EnableFullScreenControls" VALUE="true" />
  <PARAM name="uiMode" value="none" />
   <PARAM name="PlayCount" value="1" />
   <PARAM name="FileName" value="{1}" />
</OBJECT>

Create a Web Control that uses the <OBJECT /> Tag. I would prefer putting the Object Tag format in a different embedded file have that loaded in your Window Media Player Web Control:

   1: using System;
   2: using System.Collections.Generic;
   3: using System.Linq;
   4: using System.Text;
   5: using System.Web;
   6: using System.Web.UI;
   7: using System.Web.UI.WebControls;
   8:  
   9: namespace NaT.SharePoint.EditControlBlockAudioSupport.WebControls
  10: {
  11:     
  12:     public class WindowsMediaPlayer : WebControl, INamingContainer
  13:     {
  14:         public string FileName{ get; set;}
  15:         protected override void Render(HtmlTextWriter writer)
  16:         {
  17:             base.Render(writer);
  18:             var template = this.GetResourceFileAsString("NaT.SharePoint.EditControlBlockAudioSupport.Properties.MediaPlayerObject.xml");
  19:             var outputMarkup = string.Format(template, "MediaPlayer_" + Guid.NewGuid().ToString(), FileName);
  20:             writer.Write(outputMarkup);
  21:         }
  22:         private static string GetResourceFileAsString(string fileName)
  23:         {
  24:             var assembly = Assembly.GetExecutingAssembly();
  25:             var stream = assembly.GetManifestResourceStream(fileName);
  26:             if (stream != null)
  27:             {
  28:                 var streamReader = new StreamReader(stream);
  29:                 var myText = streamReader.ReadToEnd();
  30:                 if (myText != null) return myText;
  31:             }
  32:             return string.Empty;
  33:         }
  34:     }
  35: }

Then, basically use the above WindowsMediaPlayer Web Control in your Media Player SharePoint application page.

 

Content Editor Web Part – JavaScript

   1: <script language="javascript">
   2: function IsAudioFile(m, ctx, itemId)
   3: { 
   4:    var request;
   5:    var url = ctx.HttpRoot + 
   6:     "/_layouts/NaT.SharePoint.EditControlBlockHandler/AudioCheckService.aspx?ListID=" + 
   7:     ctx.listName + "&ItemID=" + itemId+ "&AudioCheck=true";
   8:    
   9:    if ( window.XMLHttpRequest )
  10:    {
  11:       request = new XMLHttpRequest();
  12:       request.open("GET", url, false);
  13:       request.send(null);
  14:    }
  15:    else if ( window.ActiveXObject )
  16:    {
  17:       request = new ActiveXObject("Microsoft.XMLHTTP");
  18:       if ( request )
  19:       {
  20:          request.open("GET", url, false);
  21:          request.send(); 
  22:       }
  23:    }
  24:    if ( request )
  25:    {   
  26:       var commands = request.responseXML.getElementsByTagName("Command");
  27:       var cmdName = commands[0].firstChild.nodeValue;
  28:       if(cmdName == "true") return true;
  29:       else return false;
  30:    }
  31: }
  32:  
  33:  
  34: function Custom_AddDocLibMenuItems(m, ctx)
  35: {
  36:     if(IsAudioFile(m,ctx, currentItemID) == false) return false;
  37:     strAction="window.navigate(ctx.HttpRoot+;
  38:     '/_layouts/NaT.SharePoint.EditControlBlockHandler/AudioCheckService.aspx?ItemFileUrl='+
  39:     ctx.HttpRoot+currentItemFileUrl)"
  40:  
  41:     CAMOpt(m,"Play",strAction,"");
  42:     CAMSep(m);
  43:  
  44:     return false;
  45: }
  46:  
  47:  
  48: </script>

 

Your final out come should be something like this:

Play ECB

 

And, after clicking “Play”, you will be navigated to the media player application page.

 

Happy coding,

NaT

]]>SharePoint People Picker: Override Validation Logichttp://www.usingnat.net/sharepoint/2009/6/2/sharepoint-people-picker-override-validation-logic.htmlNaT2009-06-02T20:51:02Z2009-06-02T20:51:02Zusing SharePointControls = Microsoft.SharePoint.WebControls;

 

namespace NaT.SharePoint.WebControls

{

public class PeopleEditor : SharePointControls.PeopleEditor

{

//...........

}

}

]]>Cross-Application Membership Access Provider Modelhttp://www.usingnat.net/sharepoint/2009/2/24/cross-application-membership-access-provider-model.htmlNaT2009-02-24T04:49:00Z2009-02-24T04:49:00ZA while ago I came to a need to instantiate membership providers dispersed across a SharePoint farm where each membership provider is configured to work with separate web application, and recently I stripped the idea out to a component that you can easily reuse for different applications, therefore, Cross Application Membership Access Provider Model (The CAMAP Model, pronounced k-map), as the name depicts, it’s a model you can use to access membership providers across a farm. I will start brushing about Form-based authentication and membership providers in SharePoint as the CAMAP model relates to that, then I will explain the problem matter that lead me to design the model.

A SharePoint web application can use different kind of authentication mechanism (Windows, Forms and Web single sign on) each realized on their own separate zone and separate IIS web site. Membership providers comes in play when the authentication mechanism is of type Forms. FBA (form-Based authentication) is a widely used authentication mechanism for internet facing ASP.NET applications. As SharePoint is built on top of ASP.NET 2.0 it uses FBA to authenticate membership users. The ASP.NET authentication provider model enables SharePoint to store user membership data in different kind of repository (such as SQL Server, AD LDS or any other LDAP compliant store including AD) and authenticates users using the Microsoft Membership Provider interface that all membership providers should adhere to. Membership providers simply provide an interface between SharePoint and a membership user repository.

Under a typical requirement involving membership users, you would be required to refer to the current membership provider (MP) from your ASP.NET context, where that particular MP is configured with a particular zone (internet, intranet, or extranet zone be it) of your current web application. So in your ASP.NET context (which can be a Web Part context), you would get a reference of the default membership provider like this:

System.Web.Security.MembershipProvider provider = System.Web.Security.Membership.Provider;

And, if the provider is not the default one you get to it like this:

System.Web.Security.MembershipProvider provider =

System.Web.Security.Membership.Providers["providername"];

System.Web.Security.Membership class only holds references to providers that are already defined in the current application configuration file, but if for some reason the provider definition is dynamic or is from an external source, you can programmatically instantiate a provider object, by passing your provider settings to a factory method of ProvidersHelper class.

ProviderSettings ps = new ProviderSettings();

ps.Parameters.Add(“attribute name”, “attribute value”);

System.Web.Security.MembershipProvider p = (System.Web.Security.MembershipProvider)

System.Web.Configuration.ProvidersHelper.InstantiateProvider(ps, typeof(System.Web.Security.MembershipProvider));


You can possibly get to another Web Application configuration file, read provider definition, and using ProviderSettings and ProvidersHelper class to instantiate a provider and use it. That’s pretty much the idea behind how to use providers dispersed across a SharePoint farm, but, if your membership provider is using a connection string, you might be stack. From Provider Model Design Pattern and Specification, it states: “All providers that require a connection to a database or require the use of a connection string to locate their data store should use the <connectionStrings/> section of configuration. Additionally, the name of the property on the provider should beconnectionStringNamewith the value being the named value in <connectionStrings/>... An exception will be thrown when a provider attempts to use a connection string obtained from <connectionStrings/> that either does not exist or is invalid.”

Unfortunately, It is not possible to pass a connection string to ProvidersHelper; the instantiated provider will try to find its connection string by name, from the application configuration file. Even if I can programmatically set other provider settings, I have to have connection string information in my application configuration file.

Programs running in a .NET environment are executed in a CLR application domain, an isolated execution and security boundary within a process; and application configuration information is scoped to application domains not the application process itself. Your provider basically tries to find the configuration information (a.k.a. connection string) from the currently running application domain. Saying that, we can then create a new application domain in our process, make it point to the configuration file of our choice (A SharePoint Web Application Web.Config), instantiate the provider in its own application domain, then remotely call the instance (you can only call object in different application domain through .NET Remoting). Ok, don’t be sweating on me now, it’s quite straight forward and that’s what the CAMAP model simplifies.

The following is a diagram that depicts the important components of the CAMAP model:


 

The provider runtime is so to say, the center of gravity for the model, clients first interface to it to get a membership provider; it hides all the complexity behind creating application domains, finding farm wide membership provider definitions, creating remotable membership providers, routing calls to an actual concrete membership providers, and managing a runtime pool.

Clients just call a static method to get a membership runtime object to get a membership provider like this:

IMembershipRuntime runtime = MembershipRuntime.GetMembershipRuntime("http://SharePointSiteUrl", "providername");

System.Web.Security.MembershipProvider mp = runtime.MembershipProvider;

As you can see, the membership provider is of type System.Web.Security.MembershipProvider, a type all membership providers inherits from. You would call it the same way you would call any other membership provider; behind the scene though, it goes through a couple of proxies that hides the details of loading application domain, .NET remoting and resource pooling.

The first time you get a runtime object for a specific provider, the runtime creates a new application domain where the actual membership provider will eventually run; this operation is not as slow as creating a new process but it is indeed expensive operation, that’s why the runtime for each membership provider is resource pooled to improve performance. Ones they have been created they will remain in your application memory space, until its provider definition has been changed or the application itself has restarted. The runtime pool which is actually the entity that handles the resource pooling, makes sure the runtime objects are kept in memory and up-to-date.

Use the MembershipRuntime factory method to instantiate membership providers, and you will be unleashed to the ability to administer and manage membership data across a SharePoint farm from a central web application and ability to access membership data from non-web application contexts.

As it is an initial implementation, it has limitations. It only supports remoting for the MembershipProvider class, but not for the MembershipUser and MembershipUserCollection, but you can actually use the same principles used on the MembershipProvider class and apply it on MembershipUser and MembershipUserCollection classes. And, the model is not taking into consideration the possibility that configuration sections in the Web.Config can be encrypted. For this case, you are going to have to run each membership runtime under the security context of the application pool identity (assuming that the application pool identity is used to encrypt the configuration sections).

The following patterns are the most important design patterns used in the CAMAP model: Proxy Pattern, Singleton Pattern, Factory Method Pattern, and Adapter Pattern. Understanding of the design patterns is vital to understanding how the CAMAP model internally works and will help you out if you want to customize it for your own use. In future posts, I might explain the internal implementation in terms of the design patterns that helped me realize the model, till then you can start reading about the design patterns I used at Source Making - Design Patterns and then dive in the implementation on your own.

To k-map,

NaT

]]>Security Trimmed Custom Actionshttp://www.usingnat.net/sharepoint/2008/11/16/security-trimmed-custom-actions.htmlNaT2008-11-16T05:00:00Z2008-11-16T05:00:00ZIn my Securing SharePoint Application Pages post, I showed you how to check for SharePoint permissions, and custom permissions in a custom application page. But we did not deal with custom actions security.

Most of the time application pages are clicked-through from custom actions. You might be clicking a link from the site settings page or a menu item from the site actions menu and navigating to an application page, only to get an access denied error message if you are not authorized to use the application page. So, custom actions should also be security trimmed. Adding security to custom actions is quite simple, just add the “Rights” attribute and list all the SharePoint permissions you need to check in the element manifest file. Then your custom action user interface will only show up when user is authorized to hit the application page.

 

<?xml version="1.0" encoding="utf-8"?>
<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
  <CustomAction Id="AppPageNavigationMenu" 
                GroupId="SiteActions" 
                Location="Microsoft.SharePoint.StandardMenu" 
                Sequence="1001" 
                Title="AppPage"
                Description="Navigate to AppPage"
                Rights="BrowseUserInfo,CreateGroups,ManageLists">
    <UrlAction Url="~sitecollection/_layouts/ApplicationPageSecurity/AppPage.aspx"  />
  </CustomAction>
</Elements>
 

Don’t be too happy, what about the custom permissions we wanted to check? You cannot put that in the element manifest file! But you can actually use your own custom security trimmed web control that your custom action can use to render itself. In the SharePoint Object model there is one Web control we can take advantage of, that is SPSecurityTrimmedControl from Microsoft.SharePoint.WebControls namespace. As its name implies, the control has the ability to check for SharePoint permissions and hides itself when a user does not have enough permission to use the custom action.

The key property in the SPSecurityTrimmedControl that will do the trick is a Boolean internal property named “ShouldRender”. SPSecurityTrimmedControl checks for SharePoint permissions and if user does not meet them, it sets ShouldRender to false, then skips the rendering part and makes itself invisible. 

Render from SPSecurityTrimmedControl (Thanking Red Gate’s .NET Reflector):
protected override void Render(HtmlTextWriter output)    
{
        if (this.ShouldRender)
        {
            base.Render(output);
        }
}

In fact, it is the ShouldRender property itself that makes sure that the user is authorized. So it comes down to this: you inherit from SPSecurityTrimmedControl, assign Permissions property with your new SharePoint permissions before ShouldRender is called (on OnInit will do), and only render if user passes through the SharePoint Permissions and your custom access check logic by overriding Render. Finally, in the element manifest file, refer to the class and assembly the security trimmed control is defined in. And, this is what you should get:

Manifest File referring to a custom control
<?xml version="1.0" encoding="utf-8"?>
 
<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
  <CustomAction Id="AppPageNavigationMenu" 
                GroupId="SiteActions" 
                Location="Microsoft.SharePoint.StandardMenu" 
                ControlAssembly="Bamboo.ApplicationPageSecurity, Version=1.0.0.0, Culture=neutral, PublicKeyToken=8c72b2.."
                ControlClass="Bamboo.ApplicationPageSecurity.WebControls.AppPageActionControl"  />
</Elements>
Custom Security Trimmed Control
using System;
using System.Collections.Generic;
using System.Text;
using Microsoft.SharePoint.WebControls;
using Microsoft.SharePoint.Utilities;
using Microsoft.SharePoint;
using System.Reflection;
 
namespace Bamboo.ApplicationPageSecurity.WebControls
{
    public class AppPageActionControl : SPSecurityTrimmedControl
    {
        protected MenuItemTemplate menuItem;
        private bool shouldRender = false;
        protected bool CustomShouldRender
        {
            get
            {
                bool hasCustomRights = this.HasCustomRights();
 
                Type baseType = this.GetType().BaseType;
                object obj = baseType.InvokeMember(
                    "ShouldRender", 
                    BindingFlags.GetProperty | BindingFlags.NonPublic | BindingFlags.Instance,
                    null, this, new object [] {});
 
                if (obj != null)
                {
                    return (bool)obj && hasCustomRights;
                }
                else
                {
                    return false;
                }
            }
        }
 
        protected virtual SPBasePermissions AppPagePermissions
        {
            get
            {
                SPBasePermissions permissions = base.Permissions 
                | SPBasePermissions.ViewFormPages // Don't forget this, if custom action takes to an application page
                | SPBasePermissions.BrowseUserInfo
                | SPBasePermissions.CreateGroups
                | SPBasePermissions.ManageLists;
 
                return permissions;
            }
        }
 
        private bool HasCustomRights()
        {
            bool hasCustomRights = false;
 
            //write here a custom logic to check if user has enough rights to access application page
            //if yes, set userCheckedForCustomLogic to true;
 
            hasCustomRights = true;
            return hasCustomRights;
        }
 
        private void SetAppPagePermissionProperties()
        {
            base.Permissions = this.AppPagePermissions;
 
            // DoesUserHavePermission is called on the current SPWeb
            base.PermissionContext = PermissionContext.CurrentSite;
 
            // It make sure user have all permissions
            base.PermissionMode = PermissionMode.All;
 
            //By default any users (included AnonymousUsersOnly), but I only wanted to deal with Authenticated Users only
            base.AuthenticationRestrictions = AuthenticationRestrictions.AuthenticatedUsersOnly;
        }
 
        private void CreateAndAddMenuItem()
        {
            this.menuItem = new MenuItemTemplate();
            this.menuItem.Title = "AppPage";
            this.menuItem.Text = "AppPage";
            this.menuItem.Description = "AppPage Description";
            this.menuItem.Sequence = 1040;
            this.menuItem.ClientOnClickNavigateUrl = "~site/_layouts/Bamboo.ApplicationPageSecurity/AppPage.aspx";
            this.Controls.Add(menuItem);
        }
 
        protected override void OnInit(EventArgs e)
        { 
            this.SetAppPagePermissionProperties();
            base.OnInit(e);
        }
 
        protected override void OnLoad(EventArgs e)
        {
            base.EnsureChildControls();
            base.OnLoad(e);
        }
 
        protected override void CreateChildControls()
        {
            this.CreateAndAddMenuItem();
        }
 
        protected override void OnPreRender(EventArgs e)
        {
            base.OnPreRender(e);
            if (this.CustomShouldRender == true)
            {
                this.shouldRender = true;
            }
            else
            {
                this.shouldRender = false;
                base.Visible = false;
            }
        }
        protected override void Render(System.Web.UI.HtmlTextWriter output)
        {
            if (this.shouldRender == true)
            {
                base.Render(output);
            }
            else
            {
                base.Visible = false;
            }
        }
    }
}

 

Yes I know, am using reflection to read an internal property, and that breaks encapsulation. Unlikely that it will dissappear one day, but you can always write yourself a routine that checks for the SharePoint permissions and avoids calling ShouldRender but, then again, why the need to inherit from SPSecurityTrimmedControl in the first place? Mais Voila! You have a security trimmed custom action with SharePoint permissions and custom permissions checking ability (and that is what we want).

Sincerely your code,

NaT

]]>Multiple Event Receiver and The Single-Responsibility Principle (SRP)http://www.usingnat.net/sharepoint/2008/10/16/multiple-event-receiver-and-the-single-responsibility-princi.htmlNaT2008-10-16T04:13:00Z2008-10-16T04:13:00ZSharePoint OOTB deployment functionalities are quite limited, and as developers we always end up filling the gaps ourselves. You might need to write code to clean up Web Part galleries, deploy resource files, or update Web.Config files (perhaps to register an Http Module), basically do some extra stuff to have a complete solution deployment (or retraction), and most of the time you end up writing a Feature receiver class to undergo a taskon Feature installed, activated, deactivating or uninstalling event handlers.

When writing a Feature event receiver class, you might be tempted to write all your code in a single Feature eventreceiver, or assign additional responsibilities to your existing Feature event receiver class. Maybe it’s not even temptation; when you think about it, the only thing you have to change is the Feature event receiver assembly that the Feature manifest is pointing to, and doing so might seem to make sense. But it definitely violates one of the most important principles of software development (a.k.a. Computer Science), the Single-Responsibility Principle (SRP), which statesthat, “there should never be more than one reason for a class to change”. Tom DeMarco mentioned SRP in his book, Structured Analysis and Systems Specification, back in 1979, and till now I've tended to break it ;). Ok, I wasn’t even born then, but it says:

“...every object should have a single responsibility, and that all its services should be narrowly aligned with that responsibility.“

Why is it important to separate responsibilities into separate classes?

Extracts from http://www.objectmentor.com/resources/articles/srp.pdf, a chapter just about SRP:

“...Because each responsibility is an axis of change... If a class assumes more than one responsibility, then there will be more than one reason for it to change. If a class has more than one responsibility, then the responsibilities become coupled. Changes to one responsibility may impair or inhibit the class’ ability to meet the others. This kind of coupling leads to fragile designs that break in unexpected ways when changed...”

All right, taking SRP into consideration, I decided to have the different set of functions I needed to execute in different Feature receivers. But wait a minute! You cannot have multiple Feature eventreceivers for a single Feature. How about we have a main Feature manifest that is pointing to a main Feature event receiver, and list down all the other Feature event receiver classes as Feature properties. When the main Feature event receiver goes through its life cycle, it will instantiate and execute the other Feature eventreceiver classes, per event (you have to write custom code to instantiate and execute the other Features). It sounds like a feasible solution, but it also sounds bizarre to me tohave Feature eventreceiver classes with no actual Feature definition. Ok, instead, let me have a hidden Feature definition for each Feature event receiver class, and have activation dependencies on the main Feature. That way, there is no need for you to broadcast the main Feature’s life cycle events to the other ones yourself, because SharePoint will take care of that through Feature activation dependency (If you're undergoing tasks on Featureinstalled or Uninstalling then there is no need to have activation dependency; the feature definitionswouldjust need to be referred in the solution manifest file so they can just be installed and removed). Also, you will be able to have isolated test cases for the other Feature event receiver classes without really making a lot of changes because they have their own Feature manifest file that you can use (ok, it might not be a big deal).

It should look something like this:

Main Feature Manifest file

<?xml version="1.0" encoding="utf-8" ?>

<Feature Id=" 8B44F613-6040-4777-AE4F-16D56AB26D19"

Title="Main Feature"

Description="A visible Feature that the end-user going to activate and deactivate"

Version="1.0.0.0"

Scope="WebApplication"

Hidden="false"

xmlns="http://schemas.microsoft.com/sharepoint/">

<ActivationDependencies>

<ActivationDependency

FeatureId="528DD2D9-DC76-45a1-8E2F-DFC57B4CC226" />

<ActivationDependency

FeatureId="7C5BEB3F-2129-4e12-BADB-22763FBF6758" />

<ActivationDependency

FeatureId="E4E20B37-13EC-44cd-9BB1-6514F1AA311F" />

</ActivationDependencies>

</Feature>

Dependent Feature Manifest file

<?xml version="1.0" encoding="utf-8" ?>

<Feature Id="528DD2D9-DC76-45a1-8E2F-DFC57B4CC226"

Title="Dependent Feature"

Description="Hidden dependent Feature with its own Feature receiver, and activate/deactivated when the main Feature is"

Version="1.0.0.0"

Scope="WebApplication"

Hidden="true"

ReceiverAssembly="[Feature receiver assembly name here]"

ReceiverClass="[Feature receiver class here]"

xmlns="http://schemas.microsoft.com/sharepoint/">

</Feature>

I agree thatittakes a little extra work to have a separate Feature receiver class and Feature manifest file for each dependent Feature, but for the sake of SRP and Tom DeMarco, I think it is totally worth it. Even though the Single-Responsibility Principle is the simplest principle of all, in most situations it is kind of hard to identify SRP violations. Keeping in mind to work underthe circumstances which best suit your own needs, know that having a separate Feature event receiver class for each set of functions at least reduces complexity so that others know where to look into an organized complexity.

To SRP,

NaT

]]>Securing SharePoint Application Pageshttp://www.usingnat.net/sharepoint/2008/10/16/securing-sharepoint-application-pages.htmlNaT2008-10-16T03:53:00Z2008-10-16T03:53:00ZWhy inherit from LayoutsPageBase to write a custom application page?  It’s actually to take advantage of the security elements LayoutsPageBase adds on top of UnsecuredLayoutsPageBase. If only if we wanted to have an application page we would have just inherited UnsecuredLayoutsPageBase, and boom, we’ll have a custom ASP.NET page under the context of SharePoint.

The very reason we call inheritance, white box reuse, is because we assume that we understand how the base class (the white box) works and then we take advantage by reusing its inherit functionalities. So, I tried to understand how security is implemented in LayoutsPageBase so I can efficiently customize it.

Microsoft.SharePoint.WebControls.LayoutsPageBase

namespace Microsoft.SharePoint.WebControls
{
    public class LayoutsPageBase : UnsecuredLayoutsPageBase
    {
        public static readonly SPBasePermissions DefaultLayoutsRights;
        protected virtual bool RequireDefaultLayoutsRights { get; }
        protected virtual bool RequireSiteAdministrator { get; }
        protected LayoutsPageBase.RightsCheckModes RightsCheckMode { get; set; }
        protected virtual SPBasePermissions RightsRequired { get; }
        protected void CheckRights();
        protected override void OnLoad(EventArgs e);
        protected override void OnLoadComplete(EventArgs e);
        protected override void OnPreInit(EventArgs e);
 
        [Flags]
        protected enum RightsCheckModes
        {
            None = 0,
            OnPreInit = 1,
            OnLoadComplete = 2,
        }
    }
}

You have two options as to when to check users’ permission to access your application page: OnLoadComplete and on OnPreInit. By default, permissions are checked on OnLoadComplete, and the default permissions checked are EmptyMask, ViewPages,  Open and ViewFormPages site permissions, which I find to be the minimum permission set you need to access a SharePoint application page. If you don’t want the default permissions to be checked you just need to override RequireDefaultLayoutsRights and return false. Of course, checking the default permissions will not do you too much good, you might also want to check if user has enough rights to manage alerts, create groups or check any of the SharePoint permissions to accomplish a specific business use case. That is where overriding RightsRequired property comes in. Simply by overriding it and returning all the permissions you need to check, SharePoint will take care the rest for you by checking the permissions you listed including the default layouts permissions and authorize the user to access the custom application page and if checking fails SharePoint redirects the user to an access denied page and let the user login with a different account.

 

It sounds almost perfect now. But, what if you wanted to check if a user belongs to a certain security group in Active Directory or check if user belongs to a SharePoint Group before granting access? Well, there is no SharePoint permission (SPBasePermission) that directly corresponds to that, so there is no use in just using RightsRequired property. But then I could have overridden CheckRights and put my custom user access check logic in there if it was a virtual method, unfortunately it is not.

 

What about RequireSiteAdministrator? I assumed if supposedly it was returning true, then you would be required to be a site administrator to access the page. This was not actually the case. Whether or not you are a site administrator, it will not let you access it if it was returning true. So, what does that leave me with? I could perhaps put logic in there and return true every time my user does not pass through my custom permission check logic, right? But it still kind of bothered me that it my might be a little confusing to do so. So I kind of looked back and asked myself why don’t I just put my dumb custom logic on OnLoad (and redirect user to access denied page when they do not meet my custom permissions), and change RightsCheckMode to OnPreInit so that SharePoint permissions are checked before my custom checks are run (Didn’t know it was that simple), and this is what you should get:

 

public class AppPage : LayoutsPageBase
{     
    protected override SPBasePermissions RightsRequired
    {
        get
        {
            SPBasePermissions permissions = base.RightsRequired 
                | SPBasePermissions.BrowseUserInfo 
                | SPBasePermissions.CreateGroups
                | SPBasePermissions.ManageLists;
            return permissions;
        }
    }
 
    public AppPage()
    {
        this.RightsCheckMode = RightsCheckModes.OnPreInit;
    }
 
    protected virtual void CheckCustomRights()
    {
        bool userCheckedForCustomLogic = false;
        //write here a custom logic to check if user has enough rights to access application page
        //if yes, set userCheckedForCustomLogic to true;
 
        if (!userCheckedForCustomLogic)
        {
            SPUtility.HandleAccessDenied(new UnauthorizedAccessException());
        }
    }
 
    protected override void OnLoad(EventArgs e)
    {
        this.CheckCustomRights();   
    }
}

 

I admit that, I kind of exaggerated the process to getting to the solution. But, I wanted to make an important point that if you ask yourself why you are inheriting anything, at all times, then you will be able to efficiently reuse code (and you should get a tattoo just saying that).

 

using(NaT)

]]>