1. 2012 © Trivadis BASEL BERN LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART WIEN WELCOME The SharePoint 2013 App Model Martin Loitzl 19.12.2012 SharePoint 2013 App Model 1

2. 2012 © Trivadis Introduction 1.Martin Loitzl 2.3.5 years in SharePoint Development 3.1 year @ Trivadis AG 4.> 15 years Web Development 5.Studied Information Systems @ TU Graz, Austria 6.MCTS, MCPD, MCT for SharePoint 2010 19.12.2012 SharePoint 2013 App Model 2

3. Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up 19.12.2012 SharePoint 2013 App Model 3

4. 2012 © Trivadis What cool and new in SharePoint 2013? 1.Yammer Integration (Corporate Social Web) 2.1 unified Search (FAST everywhere) 3.Branding Designer (can be used by Designers) 4.New Workflow Engine (Windows Azure Workflows) 5.SkyDrive Pro 6.... and many more 19.12.2012 SharePoint 2013 App Model 4

5. 2012 © Trivadis The new SharePoint 2013 App Model 19.12.2012 SharePoint 2013 App Model 5

6. Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up 19.12.2012 SharePoint 2013 App Model 6

7. 2012 © Trivadis 19.12.2012 SharePoint 2013 App Model 7 SharePoint Sandbox SharePoint Azure, IIS, LAMP, etc… iFrame

8. 2012 © Trivadis App Model: End User Experience How does it feel for the End-User? Office Marketplace, like for Windows Phone and Windows 8 User installs and decides to trust Demo @ Office 365 19.12.2012 SharePoint 2013 App Model 8

9. Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up 19.12.2012 SharePoint 2013 App Model 9

10. 2012 © Trivadis 19.12.2012 SharePoint 2013 App Model 10 Deployment Options On-Premise Farm Installation Office 365 & SharePoint Online Hosted Installation Development Options Farm-Trust Solution SharePoint-Hosted App Provider-Hosted App Azure Auto-Hosted App Development Tools Web Browser SharePoint Designer 2013 Visual Studio 2012 Eclipse, LAMP, Etc. Sandboxed Solutions

11. 2012 © Trivadis SharePoint 2013: The new App Package Structure 19.12.2012 SharePoint 2013 App Model 11 SiteCollection Host Web App Web App Package manifest.xml SharePoint Package.wsp Web Features App Installation Process New App Web External App Package App Installation Process http://sp.com http://abc-567adcca.sp.com http://acme-apps.com

12. 2012 © Trivadis Three Approaches for Hosting Apps 19.12.2012 SharePoint 2013 App Model 12 Cloud based apps Provider Hosted app SharePoint Host Web Your Hosted Site Auto Hosted App SharePoint Host Web Azure from WebDeploy, DacPac App Web from WSP SharePoint Hosted App Get remote events from SharePoint Use CSOM/REST + OAuth to work with SP “Bring your own server hosting infrastructure” Developers will need to isolate tenants Windows Azure + SQL Azure provisioned invisibly as apps are installed SharePoint Host Web Provision an isolated sub web on a parent web Reuse web elements (lists, files, out-of-box web parts) No server code allowed; use client JavaScript for logic, UX

13. Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up 19.12.2012 SharePoint 2013 App Model 13

14. 2012 © Trivadis New App Model: User Experience 19.12.2012 SharePoint 2013 App Model 14 Full page app Implement complete app experiences to satisfy business scenarios App part app Create app widgets that can interact with the SharePoint experience Command extensions Extend existing functionality with new commands

15. Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up 19.12.2012 SharePoint 2013 App Model 15

16. 2012 © Trivadis SharePoint 2010: Client Object Model 19.12.2012 SharePoint 2013 App Model 16 Client Server Custom Client Code JavaScript LibrarySilverlight Library.Net CLR Library _vti_bin/client.svc Execute Query SharePoint Foundation API Services SharePoint Foundation: List and Library interaction API surface Access via JavaScript, Silverlight, and.Net Drawbacks Still needs old asmx Services, what about iOS, PHP, Node.JS, …

17. 2012 © Trivadis App Model: Apps have a new _api 19.12.2012 SharePoint 2013 App Model 17 Client Server Custom Client Code JavaScript LibrarySilverlight Library.Net CLR Library _api Execute Query REST/ ODATA SharePoint Foundation User ProfileSearch Taxonomy More… API Services Existing SharePoint Client Object Model, User Profiles, Search, Taxonomy, Feeds, Publishing, Sharing, Workflow, E-Discovery, IRM, Analytics Business Data Services, and more! Simplified API surface Focused on the most used API’s and removed redundancy/duplicate paths Symmetric Same object model on the server and all client object models

18. 2012 © Trivadis _api: Access to SharePoint Services 19.12.2012 SharePoint 2013 App Model 18 APIREST URLScript.Net Namespace Webhttp://host/_api/WebSPMicrosoft.SharePoint.Client Searchhttp://host/_api/SearchSP.SearchMicrosoft.SharePoint.Client.Search Taxonomyhttp://host/_api/TaxonomySP.TaxonomyMicrosoft.SharePoint.Client.Taxonomy BCShttp://host/_api/BCSSP.BCSMicrosoft.SharePoint.Client.BCS REST/ODATA http://host/sites/test/_api/Web/Title Managed Code clientContext.Load(clientContext.Web); clientContext.ExecuteQuery(); TextBox1.Text = clientContext.Web.Title; ctx.load(ctx.get_web()); ctx.executeQueryAsync(function () { ctx.get_web().get_title() }); JavaScript

19. 2012 © Trivadis Demo: SharePoint Hosted App 19.12.2012 SharePoint 2013 App Model 19 Demo

20. Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up 19.12.2012 SharePoint 2013 App Model 20

21. 2012 © Trivadis C#, PHP, JavaScript, … JavaScript App Web Host Web API access of a SharePoint 2013 App 19.12.2012 SharePoint 2013 App Model 21 http://sp.comhttp://abc-567adcca.sp.com JavaScript http://acme-apps.com App may be hosted in IFrame! App Client Server xss Cloud App Host

22. 2012 © Trivadis OpenAuth: Introduction 19.12.2012 SharePoint 2013 App Model 22 ?

23. 2012 © Trivadis OAuth: AuthN and AuthZ flow 19.12.2012 SharePoint 2013 App Model 23 Browser SharePoint 2013 1 User navigates to page containing an app 1 Cloud AC S 2 2 SharePoint requests a context token 3 ACS returns signed context token 3 4 4 SharePoint renders page with IFrame 5 Browser requests IFrame 5 6 6 ACS validates signature of context token 7 7 ACS issues an access token 8 8 App Host accesses data with OAuth token 9 SharePoint returns data 9 10 10 Rendered content delivered App iFrame App Host acme-apps.com

24. 2012 © Trivadis Demo: Cloud Hosted SharePoint 2013 App 19.12.2012 SharePoint 2013 App Model 24 DEMO

25. 2012 © Trivadis OAuth: on-premise? 19.12.2012 SharePoint 2013 App Model 25 Browser SharePoint 2013 1 Cloud AC S 2 3 4 5 6 7 8 9 10 App iFrame App Host intranet-apps.com No Cloud ACS No Context Token No Access Token „Trusted Security Token Issuer“ Establish Trust-Relation with Certificate

26. 2012 © Trivadis Demo: Provider Hosted SharePoint 2013 App on- prem 19.12.2012 SharePoint 2013 App Model 26 DEMO

27. 2012 © Trivadis Introduction to Event Handling Event Handlers in SharePoint 2007 and 2010  Lists, Webs, etc. (ListItem Added, Web Provisioned, …) Possibility to capture User Interaction  e.g. new Task in Task List, document published, … Possibility to enforce business rules e.g. prevent document deletion based on meta-data, … SharePoint 2013 Apps: „Remote Event Receivers“ SharePoint events are forwarded to an App endpoint SharePoint 2013: Remote Event Receivers for Business Connectivity Services BCS: access to external Line-of-Business systems 19.12.2012 SharePoint 2013 App Model 27

28. 2012 © Trivadis SharePoint 2013 Data Access: Remote Event Handler 19.12.2012 SharePoint 2013 App Model 28 Clou d AC S App Host acme-apps.com 1 2 3 4.svc 6 7 8 1 User adds Item to some List 2 SharePoint asks ACS for context Token 3 ACS returns token 4 SharePoint calls Remote Event Receiver 5 App does it‘s job 5 6 App send context Token 7 App gets access Token 8 App updates SharePoint

29. 2012 © Trivadis Remote Event Receivers: Demo 19.12.2012 SharePoint 2013 App Model 29 Demo

30. Agenda Introduction A look back – Why a new App Model? Where do Apps run? The Shape of Apps The Application Programming Interface (API) Authentication and Authorization Wrap-up 19.12.2012 SharePoint 2013 App Model 30

31. 2012 © Trivadis Choice, Control and Flexibility to acquire and deploy 19.12.2012 SharePoint 2013 App Model 31 Dev center submission Office.com Public Marketplace Integrated Marketplace Direct Negotiated deals/ IT projects Corporate Catalog TRIAL/ PURCHASE SharePoint and O365 Developer IT admin End users

32. 2012 © Trivadis Recap: Three choices to make 19.12.2012 SharePoint 2013 App Model 32 SharePoint Auto- Provisioned on Azure Developer hosted Full Page App Part Extension.Net / Silverlight JavaScript REST / ODATA

33. 2012 © Trivadis Links Office/SharePoint Tools for Visual Studio 2012 https://www.microsoft.com/web/handlers/WebPI.ashx/getinstaller/OfficeToolsForV S2012GA.appids https://www.microsoft.com/web/handlers/WebPI.ashx/getinstaller/OfficeToolsForV S2012GA.appids App Configuration on-prem http://technet.microsoft.com/en-us/library/fp161236 http://technet.microsoft.com/en-us/library/fp161236 App Auth Policy http://msdn.microsoft.com/en-us/library/office/apps/fp179892.aspxttp://msdn.microsoft.com/en-us/library/office/apps/fp179892.aspx High Trust S2S on-prem http://msdn.microsoft.com/en-us/library/office/apps/fp179901.aspx http://blog.loitzl.com/?p=229 http://msdn.microsoft.com/en-us/library/office/apps/fp179901.aspx http://blog.loitzl.com/?p=229 Tips and FAQs: OAuth and remote apps for SharePoint 2013 http://msdn.microsoft.com/en-us/library/fp179932.aspx http://msdn.microsoft.com/en-us/library/fp179932.aspx Registering SharePoint 2013 High-Trust Apps Using S2S the Easy Way (Beta 2 only!) http://www.andrewconnell.com/blog/archive/2012/08/07/registering-sharepoint- 2013-high-trust-apps-using-s2s-the-easy.aspx http://www.andrewconnell.com/blog/archive/2012/08/07/registering-sharepoint- 2013-high-trust-apps-using-s2s-the-easy.aspx Can App Parts be used on SharePoint-Hosted pages? http://social.msdn.microsoft.com/Forums/en- US/appsforsharepoint/thread/abb96582-e5b1-4fbd-9e63-2ffc01780835/ http://social.msdn.microsoft.com/Forums/en- US/appsforsharepoint/thread/abb96582-e5b1-4fbd-9e63-2ffc01780835/ 19.12.2012 SharePoint 2013 App Model 33 For more exotic scenarios: Work with the cross-domain library across different Internet Explorer security zones in apps for SharePoint http://msdn.microsoft.com/en-us/library/jj612823.aspx http://msdn.microsoft.com/en-us/library/jj612823.aspx How to: Access SharePoint 2013 data from remote apps using the cross-domain library http://msdn.microsoft.com/en-us/library/fp179927.aspx http://msdn.microsoft.com/en-us/library/fp179927.aspx How to: Access SharePoint 2013 data from remote apps using the cross-domain library http://msdn.microsoft.com/en-us/library/fp179927.aspx http://msdn.microsoft.com/en-us/library/fp179927.aspx

34. 2012 © Trivadis BASEL BERN LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART WIEN Thanks! Trivadis AG Dipl.-Ing. Martin Loitzl Europastrasse 5 8152 Glattbrugg Tel.+41 79 909 7242 Martin.Loitzl@trivadis.com www.trivadis.com 19.12.2012 SharePoint 2013 App Model 34