“Build a .NET Business Application in 60 Minutes with xRM and SharePoint” in 502A on Thursday at 12:45 PM

“Managing the Solution Lifecycle for xRM Applications” in 515A on Tuesday at 12:30 PM

For those are not in PDC09, all keynotes will be streamed live and all sessions will be delivered on demand here.

However, there are certain requirements in order to impersonate the current windows user into SQL server. Here is a quick checklist of the required infrastructure:

1)      First of all we have to ensure that our ASP .NET application is configured properly to perform its tasks impersonating each time the windows user that makes the request. Therefore, ensure that you have the following parameters in web.config (under <system.web> element):

<authentication mode="Windows" />
<identity impersonate="true" />

2)    Modify your virtual directory settings in IIS to require windows authentication. In order to do this, you will have to disable anonymous authentication and enable Integrated Windows Authentication, as shown below:

Virtual Directory Security on IIS

2)  At the application level, ensure that the database connection is done using integrated windows authentication. Here is a sample connection string for SQL Server OLEDB  Provider:

PROVIDER=SQLOLEDB;Data Source=DBServerName;
Initial Catalog=Organization_MSCRM;Integrated Security=SSPI;

The key to the above is the “Integrated Security=SSPI” option which tells us that the connection with the SQL Server CRM Database will attempted using the windows user who is running the current thread. This, combined with the “impersonate=true” parameter in web.config ensures that the windows identity that is grabbed from the server will be running our sql queries. Note that for the data source name, it is necessary to use computer name, not IP address (see hints at the end of the article).

3)      Now the tricky part: the above would be enough in an environment that hosts the SQL Server CRM databases in the same machine with the application server (IIS). If this isn’t true, you will probably get authentication error messages upon DB connection. The most common one is: “Login failed for user ‘NT AUTHORITY\ANONYMOUS LOGON’”, which is typically “solved” once you add the NT AUTHORITY\ANONYMOUS LOGON” to the database logins. However, this workaround -apart from making your database extremely vulnerable- simply will not do in our case, since we need the queries to be executed by the windows domain users themselves.

This happens due to the “double hop” problem. For the lazy devs (like me) who do not wish to go into detailed problem analysis, let’s just say that your web server computer is not granted the required permissions from the domain controller’s active directory to pass the user’s domain credentials to the database server. That means that the authentication takes place well enough on IIS but the latter is unable to pass them correctly to the SQL Server machine. This process is known as “delegation”.

This is solved by the following steps:

a. Open the Active Directory management console on the domain controller

b. Find the computer that hosts MS CRM and IIS. Right click/Properties

c. Select delegation tab, and check the radio button that says “Trust this computer for delegation to specified services only”.

d. Click “Add”, and on the pop up form click “Users or Computers”. Select your Database server that hosts the SQL Server CRM DB.

e. You will then see a list of available services. Find the SQL Server’s service (MSSQLSvc)and add it to the list.

Note: if you cannot find such a service, then this probably means that your SQL server runs under a domain account, see here for details on manually adding an SPN.

f. Click “OK” and you should have the following settings:

Active Directory Delegation Configuration

Click OK and you are ready. You could always allow this computer to delegate credentials to any service (and therefore click on the second radio button) but this is generally not recommended due to security restrictions (when dealing with stuff from IT departments throughout large organizations, do NOT underestimate this factor).

5)      Finally, as delegation requires Kerberos protocol we must ensure that IIS treats windows authentication correctly, that is, it first negotiates with the client in order to accept and delegate credentials through Kerberos. IIS 7 (Win2008) supports Kerberos by default, in some IIS 6 installations you’ll have to add the appropriate headers manually. Here’s how (taken from the respective kb article):

a. Click Start, click Run, type cmd, and then press ENTER.

b. Locate the directory that contains the Adsutil.vbs file. By default, this directory is C:\Inetpub\Adminscripts.

c. Use the following command to retrieve the current values for theNTAuthenticationProviders metabase property:

cscript adsutil.vbs get w3svc/WebSite/root/NTAuthenticationProviders

In the above command, WebSite is a placeholder for the Web site ID number. The Web site ID number of the default Web site is 1.

d. If the Negotiate process is enabled, this command returns the following information:

NTAuthenticationProviders : (STRING) “Negotiate,NTLM”

e. If the command in step c does not return the string “Negotiate,NTLM,” use the following command to enable the Negotiate process:

cscript adsutil.vbs set w3svc/WebSite/root/NTAuthenticationProviders “Negotiate,NTLM”

f. Repeat step c to verify that the Negotiate process has been enabled.

That’s all! Some necessary hints:

• ALWAYS USE DOMAIN NAMES for the servers when applying credential delegation. This means that the database connection string in your application should contain the data source server with its computer domain name, NOT THE IP ADDRESS! If you use IP addresses, the SQL Server authentication will fail because delegation rights are granted at the level of the domain, thus active directory needs to know the source and target machine’s computer names.
• If your application contain queries to other views also (not filtered ones), then make sure that the users that are connected have the appropriate permissions to execute SELECT on these views/objects. By default, non-administrative users in CRM have access only to the filtered views of entities where user ownership is applied, so be careful with your joins!

Test it!

You are now all set to run any CRM filtered view through ASP .NET. In order to test it, create a new web page, and place the following code on Page_Load event (after modifying the connection string of course):

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        Dim conn As New OleDb.OleDbConnection
        Dim table As New System.Data.DataTable()
        Dim ConnectionString As String = _
        "PROVIDER=SQLOLEDB;Data Source=MyDBServer;Initial Catalog=MyOrganization_MSCRM;Integrated Security=SSPI"
        'first get logged in user
        Dim w As System.Security.Principal.WindowsPrincipal = Threading.Thread.CurrentPrincipal()
        Response.Write("<b>connected user is:</b>" & w.Identity.Name)
        Response.Write("<br /><br />")
        Response.Write("<b><u>CRM DB User details</u></b><br />")

        'now query for the details of the user in the CRM DB
        Dim cn As New System.Data.OleDb.OleDbConnection(ConnectionString)
        cn.Open()
        Dim da As New System.Data.OleDb.OleDbDataAdapter("select systemuserid as id, fullname, " & _
        "domainname as username from filteredsystemuser where systemuserid=dbo.fn_FindUserGuid()", cn)
        da.Fill(table)
        da.Dispose()
        cn.Close()
        If table.Rows.Count > 0 Then
            Response.Write("<b>User ID:</b>" & table.Rows(0)("id").ToString() & "<br>")
            Response.Write("<b>User Full Name:</b>" & table.Rows(0)("fullname").ToString() & "<br>")
            Response.Write("<b>User Domain Name:</b>" & table.Rows(0)("username").ToString() & "<br>")
        Else
            Response.Write("<i>User Not Found</i>")
        End If
        Response.End()
    End Sub

Functionality for end-user
Ribbon UI: The new Office like bar will be placed on the top of the page and it will be fully customizable. A gift for both users and developers.

Single page form: Tabs are replaced with navigation shortcuts in left navigation (outlook style) bar and all data is displayed in one page. I am afraid that users will scroll up and down more. On the other hand, common fields may be placed as header or footer to be visible in any time.

Data filtering: Excel like filtering in data grids supported by Save Filter As functionality.

Numeric Data visualization: Drilled down enabled charts based on Dundas charting solution. A feature that was missing from current version.

Additional ownership model:  The functionality that all Business Analysts were expecting. The Team ownership model is introduced supporting the creation of more complex security roles.

WSS integration: Document management including site & document library provisioning, meta-data and item security support, enriched with check-in/check-out functionality. Finally, Microsoft works on its competitive advantage and enters in a world that all MS products will be integrated (something like 360 application integration). This is a killer feature that competition cannot overcome easily.

Ad-hoc Relationships between any two entities: In case that new version support customization on relationship will give an enormous boost to establish MS Dynamics CRM as Enterprise Development platform.
Functionality for administrators
Flexible form layout: Form controls would be placed side-by side, on top, left or right to others and grids could be displayed inside a form without iframe and javascript. In case, that next version supports multiple role based forms, MS Dynamics CRM will be ready as an Enterprise Development platform.

Filtered lookups: Our requests will come true. A filter lookup property could be placed on all lookup controls. Till this moment, it will not support role based filtered lookups, hope that they will change their mind.

Solution Management: A set of entity customizations, workflows, e-mail templates, security roles, plug-ins etc. will apart a solution and it will be managed as a single unit.

Global Picklists: These global lists will be defined at the solution level, and will be available across multiple entities.

Drag & Drop Form Editor: New version will support drag and drop on all elements of a form, facilitating the design process.

Audit: There are some rumors that new version will provide auditing on attribute level. This feature is a “MUST HAVE” for all enterprise wide installations.

Functionality for Developers

Custom Code Sandbox: There will be available a new server role for running custom plug-in code and custom workflow activities without requiring full trust.

Plug-In Transaction Support: New version will provide transaction support between a CRM operation and a plug-in. The plug-in registration tool will be modified to support this.

Automatic Plug-In Profiling: New version will keep track of how a plug-in is executing, what resources it consumes, if it is causing unexpected exceptions and whether or not it is violating security constraints. If a particular plug-in fails a number of times it is automatically disabled from executing, helping to maintain system integrity.

In case that you want to suggest features to Microsoft Dynamics CRM team you may use Microsoft Connect Directory

at url:
https://connect.microsoft.com/dynamicssuggestions/feedback/CreateFeedbackForm.aspx?FeedbackFormConfigurationID=3392&FeedbackType=2

Steve Jobs received a liver transplant at Methodist University Hospital Transplant Institute in Memphis, Tennessee two months ago. Steve is recovering without implications and his prognosis is excelent.
You may read more details at http://online.wsj.com/article/SB124581022674545337.html

Our best wishes to Steve to get well soon.

Apple iPhone 3GS

Although it has the exact same design, the same size (4.5 x 2.4 x 0.48 inches) and almost the same weight (135 grams vs 133 grams) as iPhone 3G, it works (launching applications and rendering web pages) much faster and consumes less energy. There is a new processor, the ARM Cortex A8, running at 600 MHz, a PowerVR SGX graphics card (hardware 3d graphics support means better 3d games) and 256MB of RAM (http://www.engadget.com/2009/06/19/iphone-3g-s-gets-the-quick-and-dirty-tear-apart-treatment-alrea/).
The battery life is extended to 12 hours of talk time on 2G and 5 on 3G, with a up to 300 hour standby time. On the other hand you will get 5 hours of internet use (3G), 9 hours on wi-fi internet, 50 hours of audio and 10 hours of video playback.
Although it supports (as its predecessor) three band UMTS/HSDPA, four band GSM/EDGE, Wi-Fi 802.11b/g and Bluetooth 2.1 + EDR, it is also supports the 7.2Mbps 3G standard, which means that you will get data faster to your iPhone. As you probably know the “S” stands for Speed, and there are some benchmarks against competitors (http://www.engadget.com/2009/06/20/iphone-3g-s-and-pre-head-to-head-benchmarks-iphone-barely-wins/) that confirms it almost clearly.
In addition, there is a new camera, with increased resolution to 3 megapixels, autofocus, auto exposure and auto white balance — and just as expected, now supports 30fps VGA video recording with editing features. You will find also special macro and low light modes, and photo&video geotagging functionality.
Closing let’s talk about new features, such as the Magnetometer, which works with a Compass application, third parties, and it is integrated into the new Google maps app, showing your orientation with a small semitransparent cone. In addition, you will get voice control functionality which means that you can call people just saying their names and some accessibility features, like zooming on text, inverting video, and voice over when you touch whatever text is on screen.

This does not mean that Office integration will be left out, it just means that Microsoft decided that the “Office” brand name will now be only related to client side products (a wise decision that will reduce some of the confusion that was caused by the “Office Servers” product line). The beta or a partner preview will be available in the last quarter or 2009 but no features were confirmed. So all conversation was about the new acronym (no serious Microsoft Product has been left without an acronym for a long time). MS is out of the question, MSS is taken by Microsoft Search Server and as Thomas Rizzo wrote on his blog  (“SharePoint is SharePoint is SharePoint”) we are left with no acronym.

I have a real hard time accepting this, so what about …. MSPS ?

 
SharePoint is SharePoint is…

SharePoint provides the functionality to create folders within document libraries and so the most natural impulse when migrating from that dusty file server, is to just recreate the folder structure.
But to really get the most out of MOSS one must utilize metadata (custom columns). Metadata create a dynamic categorization system within document pools and allow for infinite personalization through views. Metadata use also turn search from guesswork to an intuitive task.

To be frank the folders we all use in file systems are metadata for the files they contain, just single dimensional. The “Projects” folder denotes that all documents contained in it are project related documents. Since this is not enough we rely on subfolders (client name or project type perhaps) and info in the filename (specific project name f.e.) to add more “metadata” to the document. This process that can quickly be chaotic and as the number of files grows it becomes unusable.

This can easily be alleviated by using a true metadata structure in SharePoint (two custom columns “Client” and “Type” in the ProjectFiles document library would be enough for the above example). So the document visibility is increased but also the structure can be “re-organized” (through views and filtering) without any manipulation of the documents files themselves. Teams working on the same file-set can also benefit from this approach. So the Sales department can view documents sliced per client or budget, but the IT department can view the documents per Product or Project type. Metadata is the way to keep everyone happy while at the same time avoiding multiple copies of files (and emails flying around trying to find the correct version).
Another thing against folders is that even if they are there, they cannot be used for filtering.

Just to add a technical limitation to all the business and design ones, the maximum document url length in SharePoint is 260 chars. This can be easily reached if the existing folder structure is big or really descriptive.

So it is obvious. No folders in document libraries, just metadata. Well … there is one single detail that folders have on their side, you can define access rights on them. So if you want to reduce the number of required document libraries or you have trouble dealing with access rights maybe a single layer of folders is ok. You will have to add metadata anyway probably just to get the views your users will desire (yes you can add metadata to a folder through customization, but it is not copied automatically to the documents that are placed inside it).

To conclude, in my opinion try to avoid folders at all cost unless access rights management makes them an unavoidable necessity.

·        Cleaner Page Rendering so that pages render faster, in more browsers and coding for MOSS is easier.

·        More “Polished” look for lists and especially for the forms that are produced automatically by the Workflow engine. It would make them a worthy offering for more solutions if f.e. silver light was utilized.

·        More flexibility in List functionality (it seems MS are working on something as was mentioned briefly by Bill Gates here http://www.microsoft.com/Presspass/exec/billg/speeches/2008/03-03SharePoint2008.mspx)

·        Better offline support, especially for mail archiving solutions but for simple document lists as well. Microsoft should get a lesson from the excellent Colligo addon on this.

·        Mobile client support, mobile browsers must be supported with a limited view of libraries at least. I would even be fine with a native Windows Mobile client, it is better than nothing.

·        Out of the box PDF support, yes I know it easy enough right now, but should be there by default!

·        Groove integration, just to get rid of the annoyance to explain to customers why on earth this is not already implemented <

·        More themes and master pages available out of the box.

·        Full site-collection backup/restore/migrate functionality (preferably with an UI) on a farm level. Really required for large scale installations or scenarios with different development and production systems.

·        Column (metadata) security filtering, it would be nice to be able to define which columns a specific security level can view.

·        Dynamic Update of related fields when a field changes in the form, for forms that are produced automatically by the Workflow engine.

·        Permissions on views, a real must have.

·        More customization possibilities for Search and search results, available without coding.

The big pain point of BI seems sure to be resolved now that a large segment of PerformancePoint will be integrated in SharePoint’s Enterprise version but this is a completely different rant! 

Here is the download link from MS: New MOSS Themes

A better way to get then (and the way MS should also have provided them) is through a single WSP. Daniel Brown did it for us! :