Western Mass Microsoft Technology Users Group Leveraging Microsoft Azure for SharePoint Solutions

About Me Developing Software (professionally) for over 17 years Manager, BlumShapiro Technology Consulting MCTS, MCPD SharePoint Development Western Mass Bitcoin @JosephMWerner jwerner@blumshapiro.com

The TI99!

About BlumShapiro Largest regional accounting, tax and business consulting firm based in New England Offices in West Hartford CT, Shelton CT, Boston MA, Quincy MA, Newton MA and Providence RI Over 400 professionals Microsoft Partner – Gold Competencies for Collaboration and Content (SharePoint), and Business Intelligence

BlumShapiro Consulting Services This is how we help, unlock your potential

SharePoint Content and collaboration platform Commonly used for: Document Sharing Internal/External Portals Workflow Custom Solutions for business productivity and collaboration Dashboards, Analytics

The Cloud and SharePoint Office365 - any size business can implement SharePoint Latest version of SharePoint Little or no server-side coding The App Model – “If you can build a web application, you can build an app for SharePoint” Apps are now principles that can be authorized Office Store - you can build and sell apps Office 365 Roadmap roadmap.office.com Three purposes of App Model: Get custom code out of SharePoint server Allow anyone to build SharePoint apps with any web technology (.Net, LAMP, Knockout, jQuery) Ecosystem of developers and consumers - the office store Rumors of SP 2015 as last on-prem: “The next release will be supported until at least 2025, while Microsoft asserts that it will continue to support on-premises SharePoint as long as the market demands it. That said, new features and enhancements will be mostly "cloud-first," and not all will be available to on-premises customers. ” Biggest thing coming that I know of: tighter integration with Yammer

Microsoft Azure Microsoft's cloud computing platform Websites, Web services, databases, virtual machines, and more This is where you can put all your custom server side code for a SharePoint app

Key Takeaways for Tonight “If you can build a web application, you can build an app for SharePoint” Azure – implement any kind of functionality for SharePoint that you can imagine

Hosting Options Used to be something called “Auto-hosted” but that has been dropped in favor of provider-hosted When you install an App in SharePoint, an App Web is created. This is an isolated web on a different subdomain for security purposes. You can use it if you want but don’t have to.

App Patterns: Types Go into demo after this slide

App Patterns: Exposing Your App

Data Access Client Object Model (CSOM) REST Services Managed .Net JavaScript REST Services

Remote Authorization: Cross-Domain Library Good for when client-side code and the permissions of a user who is signed in to SharePoint are sufficient, Uses iFrame and a proxy

Remote Authorization: OAuth Open Source Framework for authorization A token grants access to a specific resource provider, for specific resources, and for a defined duration Must use if your remote app can’t use client side code (HTML + JavaScript) exclusively A token grants access to a specific resource provider (such as a SharePoint website), for specific resources (for example, documents in a SharePoint document library), and for a defined duration (for example 12 hours) Basically: When browser invokes the App, SharePoint sends request to the trusted authority (which is Azure Access Control Services) for a context token. It includes the app ID or client ID ACS creates a context token and signs it using the client secret SharePoint then either renders the page and includes the context token in the request inside the iFrame OR redirects to the full page app and includes the context token in the request The browser request to the remote server includes the context token The remote server gets the context token and validates the signature using the client secret. This confirms the token came from ACS and not an imposter. (only ACS and the remote app know the secret) The remote server extracts the refresh token from inside the context token and submits to ACS to get an access token ACS validates the refresh token so it knows it issued it. Then returns an access token to the remote server. The remote server can then use the access token to make calls to SharePoint. (passing the OAuth access token in the HTTP Authorization header) SharePoint validates the token to be sure it came from ACS If you have a SharePoint hosted app and using CSOM, you don’t need Cross-Domain or Oauth. You also don’t have to worry about cross domain because you make all requests to the app web context (same domain) but referencing host web context for data operations.

Remote Authorization: OAuth Not Recommended for Subway A token grants access to a specific resource provider (such as a SharePoint website), for specific resources (for example, documents in a SharePoint document library), and for a defined duration (for example 12 hours) If you have a SharePoint hosted app and using CSOM, you don’t need Cross-Domain or Oauth. You also don’t have to worry about cross domain because you make all requests to the app web context (same domain) but referencing host web context for data operations.

SharePoint Authorization Policies When a user accesses SharePoint through the UI User-Only When an App makes a call into SharePoint App-Only User+App SharePoint users three types of authorization policies. The user-only policy requires only that the call to SharePoint include an authenticated user identity. The app-only policy requires only that the call include only an authenticated app identity. Theuser+app policy requires that the call include both kinds of authenticated identities. When a user accesses SharePoint resources through the SharePoint UI, instead of through an app, SharePoint uses the user-only policy. However, for calls from an app for SharePoint, SharePoint always uses either the app-only or the user+app policy. The app for SharePoint determines which policy is used by the type of access token that it includes in its request to SharePoint. If a user+app request is made, SharePoint will require that both the app and the user have permission to the resource the app is accessing. In the case of an app-only request, SharePoint requires that the app have permission to the resource, but it does not matter whether the user does or not. (An app for SharePoint can make app-only requests only if it has been given permission to do so in advance; typically, when it is installed.)

Seller Dashboard