1. Western Mass Microsoft Technology Users Group
Leveraging Microsoft Azure for SharePoint Solutions

2. About Me Developing Software (professionally) for over 17 years
Manager, BlumShapiro Technology Consulting
MCTS, MCPD SharePoint Development
Western Mass Bitcoin
@JosephMWerner

3. The TI99!

4. About BlumShapiro
Largest regional accounting, tax and business consulting firm based in New England
Offices in West Hartford CT, Shelton CT, Boston MA, Quincy MA, Newton MA and Providence RI
Over 400 professionals
Microsoft Partner – Gold Competencies for Collaboration and Content (SharePoint), and Business Intelligence

5. BlumShapiro Consulting Services
This is how we help, unlock your potential

6. SharePoint Content and collaboration platform Commonly used for:
Document Sharing
Internal/External Portals
Workflow
Custom Solutions for business productivity and collaboration
Dashboards, Analytics

7. The Cloud and SharePoint
Office365 - any size business can implement SharePoint
Latest version of SharePoint
Little or no server-side coding
The App Model – “If you can build a web application, you can build an app for SharePoint”
Apps are now principles that can be authorized
Office Store - you can build and sell apps
Office 365 Roadmap roadmap.office.com
Three purposes of App Model:
Get custom code out of SharePoint server
Allow anyone to build SharePoint apps with any web technology (.Net, LAMP, Knockout, jQuery)
Ecosystem of developers and consumers - the office store
Rumors of SP 2015 as last on-prem:
“The next release will be supported until at least 2025, while Microsoft asserts that it will continue to support on-premises SharePoint as long as the market demands it. That said, new features and enhancements will be mostly "cloud-first," and not all will be available to on-premises customers. ”
Biggest thing coming that I know of: tighter integration with Yammer

8. Microsoft Azure Microsoft's cloud computing platform
Websites, Web services, databases, virtual machines, and more
This is where you can put all your custom server side code for a SharePoint app

9. Key Takeaways for Tonight
“If you can build a web application, you can build an app for SharePoint”
Azure – implement any kind of functionality for SharePoint that you can imagine

10. Hosting Options
Used to be something called “Auto-hosted” but that has been dropped in favor of provider-hosted
When you install an App in SharePoint, an App Web is created. This is an isolated web on a different subdomain for security purposes. You can use it if you want but don’t have to.

11. App Patterns: Types
Go into demo after this slide

12. App Patterns: Exposing Your App

13. Data Access Client Object Model (CSOM) REST Services Managed .Net
JavaScript
REST Services

14. Remote Authorization: Cross-Domain Library
Good for when client-side code and the permissions of a user who is signed in to SharePoint are sufficient,
Uses iFrame and a proxy

15. Remote Authorization: OAuth
Open Source Framework for authorization
A token grants access to a specific resource provider, for specific resources, and for a defined duration
Must use if your remote app can’t use client side code (HTML + JavaScript) exclusively
A token grants access to a specific resource provider (such as a SharePoint website), for specific resources (for example, documents in a SharePoint document library), and for a defined duration (for example 12 hours)
Basically:
When browser invokes the App, SharePoint sends request to the trusted authority (which is Azure Access Control Services) for a context token. It includes the app ID or client ID
ACS creates a context token and signs it using the client secret
SharePoint then either renders the page and includes the context token in the request inside the iFrame OR redirects to the full page app and includes the context token in the request
The browser request to the remote server includes the context token
The remote server gets the context token and validates the signature using the client secret. This confirms the token came from ACS and not an imposter. (only ACS and the remote app know the secret)
The remote server extracts the refresh token from inside the context token and submits to ACS to get an access token
ACS validates the refresh token so it knows it issued it. Then returns an access token to the remote server.
The remote server can then use the access token to make calls to SharePoint. (passing the OAuth access token in the HTTP Authorization header)
SharePoint validates the token to be sure it came from ACS
If you have a SharePoint hosted app and using CSOM, you don’t need Cross-Domain or Oauth. You also don’t have to worry about cross domain because you make all requests to the app web context (same domain) but referencing host web context for data operations.

16. Remote Authorization: OAuth
Not Recommended
for Subway
A token grants access to a specific resource provider (such as a SharePoint website), for specific resources (for example, documents in a SharePoint document library), and for a defined duration (for example 12 hours)
If you have a SharePoint hosted app and using CSOM, you don’t need Cross-Domain or Oauth. You also don’t have to worry about cross domain because you make all requests to the app web context (same domain) but referencing host web context for data operations.

17. SharePoint Authorization Policies
When a user accesses SharePoint through the UI
User-Only
When an App makes a call into SharePoint
App-Only
User+App
SharePoint users three types of authorization policies. The user-only policy requires only that the call to SharePoint include an authenticated user identity. The app-only policy requires only that the call include only an authenticated app identity. Theuser+app policy requires that the call include both kinds of authenticated identities.
When a user accesses SharePoint resources through the SharePoint UI, instead of through an app, SharePoint uses the user-only policy. However, for calls from an app for SharePoint, SharePoint always uses either the app-only or the user+app policy. The app for SharePoint determines which policy is used by the type of access token that it includes in its request to SharePoint.
If a user+app request is made, SharePoint will require that both the app and the user have permission to the resource the app is accessing.
In the case of an app-only request, SharePoint requires that the app have permission to the resource, but it does not matter whether the user does or not. (An app for SharePoint can make app-only requests only if it has been given permission to do so in advance; typically, when it is installed.)

18. Seller Dashboard