Embed Office 365 Video

I still remember in year 2012, building our own Video portal in on-premises when Microsoft Media services was on beta, when Microsoft allowed it to be used to build your own video steaming service. Later Microsoft released Office 365 Video, but it had its own limitation at the release. User voice was helpful enough to make it a better product for an enterprise (still not a fully fledged product though).

Embedding video published to Office 365 video portal on other sites and pages was a limitation till today. With the release of new features, you can embed videos in your SharePoint Online and also in your SharePoint On-Premises environment.

Edit an existing (or new) page, go to the insert tab and click on Office 365 Video.

Select the video from the Office 365 Video portal.

Once added, you can still change the look & feel by amending the html. Select the Edit snippet and do the necessary changes.

Apart from the above method, if you want to add a video from Office 365 portal in to a page in your on-premises environment, you add the code to embed. Go to your video portal and below the video you can find the embed button to get the html.
 

Selecting the embed code will allow you to add the code.

Simple as that.

Value of SharePoint Add-Ins

I was privileged to conduct a session for ISVs in Sri Lanka which was organized by Microsoft. The whole purpose of the session was to promote the value of SharePoint Add-Ins (formerly Apps).

Value of share point add ins from Prabath Fonseka

Create a Provider Hosted App (High-trust) for SharePoint

SharePoint 2013 introduced the SharePoint App model for developers. Out of the three app models, SharePoint Hosted, Auto Hosted and Provider Hosted I’m creating and explaining the step by step approach to develop a simple Provider Hosted (High-trust) app in this post. This is not an introduction to SharePoint App model but an introduction to Provider Hosted (PH) Apps.

Diagram below denote my dev environment.
 

One VM for AD and DNS and the second VM hosts SharePoint 2013 and SQL 2012.

There are two types of PH Apps. Apps that can be hosted in Office 365 environments and the PH Apps that can be only hosted in On-Premises environments which are also called as High-trust apps.

Provider Hosted app consists of an App deployed in to SharePoint and a separately deployed web application. In a production environment the web application is normally deployed in a separate server or a separate server farm.

The reason why high-trust apps are only compatible with On-Premises environments is, it uses a certificate instead of a context token (OAuth) to make the trust between the two servers. So these apps require some sort of configuration on the SharePoint server as well as the remote server hosting the web application. SharePoint includes server-to-server security token service (STS) which provides access tokens for server-to-server authentication. The server-to-server STS enables temporary access tokens to access other application services including apps for SharePoint 2013. To establish a trust relationship between the SP Server and App we use a X.509 certificate and a few PowerShell cmdlets.

We need to create a .pfx file and a corresponding .cer file. First file which is the pfx, contains the private key which will be used by the remote web application to encrypt it’s communication to SharePoint server. The .cer file contains the public key which will be used by SharePoint server to decrypt the messages and to verify those messages come from the same remote web application. Also to verify that the remote web application has an access token from a token issuer that SharePoint trusts which in this case the certificate.

For the demonstration purposes I will use a self signed certificate instead of a certificate issued by a certificate authority.

Create and export a Test Certificate

Open IIS Manager in the SharePoint server and select server certificates.  
 

Click Create a self-signed certificate.

Name the certificate. Mine is ProviderHostedHighTrust.

As the next step, right click the certificate created, export it to a folder providing a password. It will create a file with a pfx extension.

If your dev environment is not similar to mine and if you have a separate server to host the remote web application, please move the pfx file to the same.

Create the .cer file

Go to IIS Manager and open Server Certificates.

On the details tab, click Copy to file, where it opens the certificate export wizard. Click next and move forward with the default option, “No, Do not export the private key”.

Click next with default options and save the certificate.
Now we are done with certification creation & exporting part. But we have to make sure STS application pool identity as well as SharePoint Web Application; application pool identity have read permission to the location of the .cer file.

Configure SharePoint 2013 Server to use the Certificate and trust the App hosted in Remote Server.

What I have explained below is suited for a dev environment and NOT for a Production nor a staging server.
In the SharePoint Server, open the SharePoint 2013 Management Shell with Run as Administrator. Execute the cmdlets below.

Create a certificate Object

$publickeyPath = “C:\Certificates\ProviderHostedHighTrust.cer”

$certificate = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($publickeyPath)

Ensure that SharePoint treats the certificate as a root authority

New-SPTrustedRootAuthority -Name "ProviderHostedHighTrust" -Certificate $certificate

 
Get the ID of the authorization realm.

$realm = Get-SPAuthenticationRealm

To access data in SharePoint, my remote web application needs a access token, which is issued by a token issuer that SharePoint trusts.  As I’ve mentioned above the certificate is the token issuer.

Next step is a very important. If we look in to a production environment, each certificate is issued by a unique issuer which is represented by a GUID. A limitation of SharePoint, make sure any letters in GUID must be lower case.  But in my dev environment I’m using the same certificate for all Provider hosted high-trust app.

$specificIssuerId = "d250d0bc-d44e-4d8b-9e36-567817943628"

$fullIssuerIdentifier = $specificIssuerId + '@' + $realm

Now is the time to make the certificate a trusted token issuer.

New-SPTrustedSecurityTokenIssuer -Name "High Trust Demo Certificate" -Certificate $certificate -RegisteredIssuerName $fullIssuerIdentifier –IsTrustBroker

In the above cmdlet I have used a friendly name which is not a common scenario in a production environment. The reason is, name parameter must be unique, so its better to add a GUID as part of the name. You will see an output similar to below screen.

Next do an iisreset command to register the token issuer immediately.


In a dev environment we have another issue to be solved. SharePoint does NOT accept self-signed certificates. So we need to turn off SharePoint's normal requirement that HTTPS be used when remote web applications call into SharePoint or else you will see a 403(forbidden) message. Turning off HTTPS is not recommended as form there onwards all traffic from the Remote Web Application to SharePoint wont be encrypted. But with a self-signed certificate that’s the only option for now.

Allowing OAuth over HTTP

$serviceConfig = Get-SPSecurityTokenServiceConfig

$serviceConfig.AllowOAuthOverHttp = $true

$serviceConfig.Update()

OK, Lets build the App in Visual Studio. I’m on VS 2013. You can use VS 2012 as well.

Select “provider hosted” and provide a URL for debug purposes. For the remote web application I have selected Web Forms, if your prefer MVC, feel free to go ahead. Next comes the “Configure Authentication” screen. Select “use a certificate”. Values you provide here will be written to the Web.Config of the remote web application.

For the certificate location, browse and select the .pfx file you created in a previous step. Provide the password. And the issuer id is the GUID with lowercase letters. Mine is d250d0bc-d44e-4d8b-9e36-567817943628.

Click finish and VS creates two projects for you. One, the App which will deployed to SharePoint and the second, the remote web application. You do not have to write any code, as the template have some code already in the Default.aspx.cs. But I added one more line. :)

Good luck. Hit F5. It' asks you to Trust the app. Go ahead and trust it. Hurray!! If you followed me properly, you should get a screen similar to below.

As you can see, below are the information written to the Web.Config file.

  <appSettings>

    <add key="ClientId" value="307490ca-d53b-4dcf-81d4-e7c4bdffb384" />

    <add key="ClientSigningCertificatePath" value="C:\Certificates\ProviderHostedHighTrust.pfx" />

    <add key="ClientSigningCertificatePassword" value="password" />

    <add key="IssuerId" value="d250d0bc-d44e-4d8b-9e36-567817943628" />

  </appSettings>

What you need to remember at this point is, still we are on a self-signed certificate and HTTP instead of HTTPS. So still you test your app with a domain signed or commercial certificate on HTTPS, your app is not ready for release. I’ll discuss more on domain signed certificates on another blog post.

Workflows for SharePoint 2013

Given below is the slide-deck from my session on Workflow which was held on 12th February. Your comments and feedback is much appreciated.

SharePoint Sri Lanka User Group – Workflow for SharePoint 2013

I’ll be speaking at SharePoint Sri Lanka User Group on Wednesday the 12th February 2014.

The session title is “Workflow for SharePoint 2013”. This is NOT a just another session on how to create simple workflows :) .Agenda is given below.

• History of Workflows
• Overview
• New Workflow Architecture
• Workflow Manager 1.0
• Visio 2013 & SharePoint Designer 2013
• Visual Studio Workflow
• Workflow Types
• Workflow Manager 1.0 in Depth

All are welcome. https://www.facebook.com/events/274981052658717/

Installing and configuring Workflow for SharePoint Server 2013

When you open SharePoint Designer 2013 connected to a site to build a workflow, you will notice a new option called platform type. If it’s only “SharePoint 2010 Workflow” that you see, you need to install and configure “workflow manager”.

As MSDN recommends, you need to consider the following two key factors before configuring Workflow Manager to work with SharePoint Server 2013.

• Is Workflow Manager installed on a server that is part of the SharePoint farm?
• Will communication between Workflow Manager and SharePoint Server 2013 use HTTP or HTTPS?

These factors translate into four scenarios. Each scenario configures a SharePoint Server 2013 farm to communicate and function with the Workflow Manager farm. Follow the scenario that matches your circumstance.

1. Workflow Manager is installed on a server that is part of the SharePoint 2013 farm. Communication takes place by using HTTP.
2. Workflow Manager is installed on a server that is part of the SharePoint 2013 farm. Communication takes place by using HTTPS.
3. Workflow Manager is installed on a server that is NOT part of the SharePoint 2013 farm. Communication takes place by using HTTP.
4. Workflow Manager is installed on a server that is NOT part of the SharePoint 2013 farm. Communication takes place by using HTTPS.

Mine is the 1st scenario. Workflow Manager can be downloaded from here. Workflow Manager installation uses Web Platform Installer as shown in the below screen.

 
Then you need to install the prerequisites. 



Clicking continue will bring the configuration options.
 
I prefer to go with the custom setting as I can get to know what’s going on behind scene. If you select the “Configure Workflow Manager with Default Settings (Recommended)”, it will install a Workflow Manager farm. So let’s move with custom :)
In the below screen you need to specify the database server, where it will create the DBs needed for WM(Workflow Manager).

Make sure you remember or keep safe the Certificate Generation Key, as it’s needed when you want to add more servers to the WM farm.

Service account will be used to run the Application pool of the WM Website.
 
Below screen looks nice so added that too :D




Three screens below show the full configuration summary.



You can even see the full PowerShell script for the configuration.




Great!! You are done with the installation and the configuration of Workflow Manager. Yet one more step left for the Workflows to work in 2013 Platform. Open IIS Manager to see the WM Site and the port you configured.

Open SharePoint Management Shell with Admin rights and execute the below cmdlet (replacing the site and the Workflow Manager host site).

Register-SPWorkflowService –SPSite "http://www.whiteknight.com/Hr" –WorkflowHostUri "http://workflow.whiteknight.com:12291" –AllowOAuthHttp

Finally to check whether everything works fine… Open the above site (registered with workflow host uri) in SharePoint Designer 2013 and check the Platform type in workflow.

When you install Workflow Manager on a WFE it automatically installs the Workflow Manager Client on that WFE. You will still need to install the Workflow Manager Client on any additional WFE servers.

SQL Does Not Have the Required MaxDegree of Parallelism Setting of 1

I was installing SharePoint 2013 and while running the SharePoint Products Configuration Wizard it failed suddenly displaying the error "This SQL Service instance does not have the required maxdegree of parallelism setting of 1. Database provisioning operations will continue to fail if maxdegree of parallelism is not set 1 or the current account does not have permissions to change the setting..."

Before solving the issue, let see what this "maxdegree of parallelism".

"When SQL Server runs on a computer with more than one microprocessor or CPU, it detects the best degree of parallelism, that is, the number of processors employed to run a single statement, for each parallel plan execution. You can use the max degree of parallelism option to limit the number of processors to use in parallel plan execution. To enable the server to determine the maximum degree of parallelism, set this option to 0, the default value. Setting maximum degree of parallelism to 0 allows SQL Server to use all the available processors up to 64 processors. To suppress parallel plan generation, set max degree of parallelism to 1. Set the value to a number greater than 1 to restrict the maximum number of processors used by a single query execution. The maximum value for thedegree of parallelism setting is controlled by the edition of SQL Server, CPU type, and operating system. If a value greater than the number of available processors is specified, the actual number of available processors is used. If the computer has only one processor, the max degree of parallelism value is ignored."
Source


You have two options to fix the issue...
1st Option

Open SQL Server Management Studio and execute the below command
sp_configure 'show advanced options', 1;
GO
RECONFIGURE WITH OVERRIDE;
GO
sp_configure 'max degree of parallelism', 1;
GO
RECONFIGURE WITH OVERRIDE;
GO

2nd Option
Open SQL Server Management Studio right click the SQL Server instance and click properties. Change the "Max Degree of Parallelism" value from 0 to 1.

 You are not done yet :)

As the SharePoint Products Configuration Wizard ran half way, the configuration database is already created. So make sure to delete the database before you run the Products Configuration Wizard again.

This problem occurs only if you execute the wizard with least privileges. If you ran the wizard with a high privileged account (If SharePoint Setup admin has sysadmin rights to the DB Server), it will automatically do the changes and continue the wizard for you.

Read more

Configure Excel Services in SharePoint 2013

Finally I got some time to configure my SharePoint 2013 farm. So I thought of using the chance to update my blog too. "Two birds with one stone".
Central Administration > System Settings > Manage services on server
Start "Excel Calculations Services"

Once it's started the next step is to create a new instance of "Excel Service Application" (in one doesnt exist already).
Central Administration > Application Management > Manage service applications and create  a new "Excel Service Application"

You are done with configuring Excel Servcies. As the next step you need to configure the tusted locations where Excel Service will only load Excel Workbooks from.

Central Administration > Application Management > Manage service applications > Excel Servce Application (This will change based on how you named the servcie instance on the previous step) > Trusted File Locations

Fill the Address with a Document Library location. I have created a document library called "Excel Documents" in a site called "Team".

In the External Data section you have "Allow External Data", select the Trusted data connection libraries and embedded option.

Set both the Automatic refresh and Manual refresh values to 0 (But this is not recommend as it will consume more resources by refreshing workbook results immediately).

Now as we have a trusted file location, we can now publish data-connected workbooks with embedded data connections. But for Excel Services to correctly render data-connected workbooks with external data connections, we must configure a trusted data connection library.

Central Administration > Application Management > Manage service applications > Excel Servcie Application > Trusted Data Connection Libraris
Make sure you have a "Data Connection Library" type library. Name of my data connection library is "Data Connections" which is created in a site called "Team".

Now you have successfully completed with Excel service configuration.