2012 © Trivadis BASEL BERN LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART WIEN WELCOME The SharePoint 2013 App Model Martin Loitzl SharePoint 2013 App Model 1

2012 © Trivadis Introduction 1.Martin Loitzl years in SharePoint Development 3.1 Trivadis AG 4.> 15 years Web Development 5.Studied Information TU Graz, Austria 6.MCTS, MCPD, MCT for SharePoint SharePoint 2013 App Model 2

Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up SharePoint 2013 App Model 3

2012 © Trivadis What cool and new in SharePoint 2013? 1.Yammer Integration (Corporate Social Web) 2.1 unified Search (FAST everywhere) 3.Branding Designer (can be used by Designers) 4.New Workflow Engine (Windows Azure Workflows) 5.SkyDrive Pro and many more SharePoint 2013 App Model 4

2012 © Trivadis The new SharePoint 2013 App Model SharePoint 2013 App Model 5

Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up SharePoint 2013 App Model 6

2012 © Trivadis SharePoint 2013 App Model 7 SharePoint Sandbox SharePoint Azure, IIS, LAMP, etc… iFrame

2012 © Trivadis App Model: End User Experience How does it feel for the End-User? Office Marketplace, like for Windows Phone and Windows 8 User installs and decides to trust Office SharePoint 2013 App Model 8

Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up SharePoint 2013 App Model 9

2012 © Trivadis SharePoint 2013 App Model 10 Deployment Options On-Premise Farm Installation Office 365 & SharePoint Online Hosted Installation Development Options Farm-Trust Solution SharePoint-Hosted App Provider-Hosted App Azure Auto-Hosted App Development Tools Web Browser SharePoint Designer 2013 Visual Studio 2012 Eclipse, LAMP, Etc. Sandboxed Solutions

2012 © Trivadis SharePoint 2013: The new App Package Structure SharePoint 2013 App Model 11 SiteCollection Host Web App Web App Package manifest.xml SharePoint Package.wsp Web Features App Installation Process New App Web External App Package App Installation Process

2012 © Trivadis Three Approaches for Hosting Apps SharePoint 2013 App Model 12 Cloud based apps Provider Hosted app SharePoint Host Web Your Hosted Site Auto Hosted App SharePoint Host Web Azure from WebDeploy, DacPac App Web from WSP SharePoint Hosted App Get remote events from SharePoint Use CSOM/REST + OAuth to work with SP “Bring your own server hosting infrastructure” Developers will need to isolate tenants Windows Azure + SQL Azure provisioned invisibly as apps are installed SharePoint Host Web Provision an isolated sub web on a parent web Reuse web elements (lists, files, out-of-box web parts) No server code allowed; use client JavaScript for logic, UX

Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up SharePoint 2013 App Model 13

2012 © Trivadis New App Model: User Experience SharePoint 2013 App Model 14 Full page app Implement complete app experiences to satisfy business scenarios App part app Create app widgets that can interact with the SharePoint experience Command extensions Extend existing functionality with new commands

Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up SharePoint 2013 App Model 15

2012 © Trivadis SharePoint 2010: Client Object Model SharePoint 2013 App Model 16 Client Server Custom Client Code JavaScript LibrarySilverlight Library.Net CLR Library _vti_bin/client.svc Execute Query SharePoint Foundation API Services SharePoint Foundation: List and Library interaction API surface Access via JavaScript, Silverlight, and.Net Drawbacks Still needs old asmx Services, what about iOS, PHP, Node.JS, …

2012 © Trivadis App Model: Apps have a new _api SharePoint 2013 App Model 17 Client Server Custom Client Code JavaScript LibrarySilverlight Library.Net CLR Library _api Execute Query REST/ ODATA SharePoint Foundation User ProfileSearch Taxonomy More… API Services Existing SharePoint Client Object Model, User Profiles, Search, Taxonomy, Feeds, Publishing, Sharing, Workflow, E-Discovery, IRM, Analytics Business Data Services, and more! Simplified API surface Focused on the most used API’s and removed redundancy/duplicate paths Symmetric Same object model on the server and all client object models

2012 © Trivadis _api: Access to SharePoint Services SharePoint 2013 App Model 18 APIREST URLScript.Net Namespace Webhttp://host/_api/WebSPMicrosoft.SharePoint.Client Searchhttp://host/_api/SearchSP.SearchMicrosoft.SharePoint.Client.Search Taxonomyhttp://host/_api/TaxonomySP.TaxonomyMicrosoft.SharePoint.Client.Taxonomy BCShttp://host/_api/BCSSP.BCSMicrosoft.SharePoint.Client.BCS REST/ODATA Managed Code clientContext.Load(clientContext.Web); clientContext.ExecuteQuery(); TextBox1.Text = clientContext.Web.Title; ctx.load(ctx.get_web()); ctx.executeQueryAsync(function () { ctx.get_web().get_title() }); JavaScript

2012 © Trivadis Demo: SharePoint Hosted App SharePoint 2013 App Model 19 Demo

Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up SharePoint 2013 App Model 20

2012 © Trivadis C#, PHP, JavaScript, … JavaScript App Web Host Web API access of a SharePoint 2013 App SharePoint 2013 App Model 21 JavaScript App may be hosted in IFrame! App Client Server xss Cloud App Host

2012 © Trivadis OpenAuth: Introduction SharePoint 2013 App Model 22 ?

2012 © Trivadis OAuth: AuthN and AuthZ flow SharePoint 2013 App Model 23 Browser SharePoint User navigates to page containing an app 1 Cloud AC S 2 2 SharePoint requests a context token 3 ACS returns signed context token SharePoint renders page with IFrame 5 Browser requests IFrame ACS validates signature of context token 7 7 ACS issues an access token 8 8 App Host accesses data with OAuth token 9 SharePoint returns data Rendered content delivered App iFrame App Host acme-apps.com

2012 © Trivadis Demo: Cloud Hosted SharePoint 2013 App SharePoint 2013 App Model 24 DEMO

2012 © Trivadis OAuth: on-premise? SharePoint 2013 App Model 25 Browser SharePoint Cloud AC S App iFrame App Host intranet-apps.com No Cloud ACS No Context Token No Access Token „Trusted Security Token Issuer“ Establish Trust-Relation with Certificate

2012 © Trivadis Demo: Provider Hosted SharePoint 2013 App on- prem SharePoint 2013 App Model 26 DEMO

2012 © Trivadis Introduction to Event Handling Event Handlers in SharePoint 2007 and 2010  Lists, Webs, etc. (ListItem Added, Web Provisioned, …) Possibility to capture User Interaction  e.g. new Task in Task List, document published, … Possibility to enforce business rules e.g. prevent document deletion based on meta-data, … SharePoint 2013 Apps: „Remote Event Receivers“ SharePoint events are forwarded to an App endpoint SharePoint 2013: Remote Event Receivers for Business Connectivity Services BCS: access to external Line-of-Business systems SharePoint 2013 App Model 27

2012 © Trivadis SharePoint 2013 Data Access: Remote Event Handler SharePoint 2013 App Model 28 Clou d AC S App Host acme-apps.com svc User adds Item to some List 2 SharePoint asks ACS for context Token 3 ACS returns token 4 SharePoint calls Remote Event Receiver 5 App does it‘s job 5 6 App send context Token 7 App gets access Token 8 App updates SharePoint

2012 © Trivadis Remote Event Receivers: Demo SharePoint 2013 App Model 29 Demo

Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up SharePoint 2013 App Model 30

2012 © Trivadis Choice, Control and Flexibility to acquire and deploy SharePoint 2013 App Model 31 Dev center submission Office.com Public Marketplace Integrated Marketplace Direct Negotiated deals/ IT projects Corporate Catalog TRIAL/ PURCHASE SharePoint and O365 Developer IT admin End users

2012 © Trivadis Recap: Three choices to make SharePoint 2013 App Model 32 SharePoint Auto- Provisioned on Azure Developer hosted Full Page App Part Extension.Net / Silverlight JavaScript REST / ODATA

2012 © Trivadis Links Office/SharePoint Tools for Visual Studio S2012GA.appids S2012GA.appids App Configuration on-prem App Auth Policy High Trust S2S on-prem Tips and FAQs: OAuth and remote apps for SharePoint Registering SharePoint 2013 High-Trust Apps Using S2S the Easy Way (Beta 2 only!) high-trust-apps-using-s2s-the-easy.aspx high-trust-apps-using-s2s-the-easy.aspx Can App Parts be used on SharePoint-Hosted pages? US/appsforsharepoint/thread/abb96582-e5b1-4fbd-9e63-2ffc / US/appsforsharepoint/thread/abb96582-e5b1-4fbd-9e63-2ffc / SharePoint 2013 App Model 33 For more exotic scenarios: Work with the cross-domain library across different Internet Explorer security zones in apps for SharePoint How to: Access SharePoint 2013 data from remote apps using the cross-domain library How to: Access SharePoint 2013 data from remote apps using the cross-domain library

2012 © Trivadis BASEL BERN LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART WIEN Thanks! Trivadis AG Dipl.-Ing. Martin Loitzl Europastrasse Glattbrugg Tel SharePoint 2013 App Model 34