Sharepoint Assembly

What if my assemblies are installed in the GAC?

By default, assemblies installed in the global assembly cache (GAC) run with Full trust. Although, installing your Web Part assembly in the GAC is a viable option, it is recommended that you install Web Part assemblies in the BIN directory for a more secure deployment.

How can I raise the trust level for assemblies installed in the BIN directory?

Windows SharePoint Services can use any of the following three options from ASP.NET and the CLR to provide assemblies installed in the BIN directory with sufficient permissions. The following table outlines the implications and requirements for each option.

Option	Pros	Cons
Increase the trust level for the entire virtual server. For more information, see "Setting the trust level for a virtual server"	Easy to implement. In a development environment, increasing the trust level allows you to test an assembly with increased permissions while allowing you to recompile assemblies directly into the BIN directory without resetting IIS.	This option is least secure. This option affects all assemblies used by the virtual server. There is no guarantee the destination server has the required trust level. Therefore, Web Parts may not work once installed on the destination server.
Create a custom policy file for your assemblies. For more information, see "How do I create a custom policy file?"	Recommended approach. This option is most secure. An assembly can operate with a unique policy that meets the minimum permission requirements for the assembly. By creating a custom security policy, you can ensure the destination server can run your Web Parts.	Requires the most configuration of all three options.
Install your assemblies in the GAC	Easy to implement. This grants Full trust to your assembly without affecting the trust level of assemblies installed in the BIN directory.	This option is less secure. Assemblies installed in the GAC are available to all virtual servers and applications on a server running Windows SharePoint Services. This could represent a potential security risk as it potentially grants a higher level of permission to your assembly across a larger scope than necessary In a development environment, you must reset IIS every time you recompile assemblies. Licensing issues may arise due to the global availability of your assembly.

I changed the trust level in the web.config file—now my entire site fails to render. What should I do?

If you change the trust level in the web.config file, Windows SharePoint Services may fail to render on subsequent requests. The following is an example of a typical error:

Assembly  security permission grant set is incompatible 

  between appdomains.

To resolve the conflicting trust setting, reset Internet Information Services (IIS) such as by using iisreset.

Note   This is a known issue related to the architecture of ASP.NET and the .NET Framework.

How do I create a custom policy file?

To customize one of the built-in policy files, it is recommended that you make a copy of it and make changes to the copy to ensure that you can reuse the original file if necessary.

The following procedure describes how to give access to the Microsoft SharePoint object model to a specific assembly.

To give access to an assembly

1.     Copy the wss_minimaltrust.config file.

2.     Rename the file new_file_name.config.

3.     Using a text editor such as NotePad, open new_file_name.config

4.     Under the element, add a reference to the SharePointPermission class as follows:

5.     

6.       

7.       

8.       Description="Microsoft.SharePoint.Security.SharePointPermission, 

9.       Microsoft.SharePoint.Security, Version=11.0.0.0, Culture=neutral, 

10.     PublicKeyToken=71e9bce111e9429c" /> 

11.   

12.   Search for the tag where the name attribute equals ASP.Net.

13.   Copy this entire tag and all of its children, and paste a copy of it immediately below the one you copied.

14.   Change the name of the new PermissionSet element from ASP.Net to New_File_Name:

Example (Before)

Example (After)

  Name="New_File_Name">

15.   Add the following node to the element where the name attribute equals New_File_Name:

16.   

17.                version="1" 

18.                ObjectModel="True" />

Therefore, the resulting customized will look as follows:

  New_File_Name">

    Level="Minimal" /> 

    /> 

    /> 

    ObjectModel="True" /> 

19.   Once you define the customized element, you must create a code group to specify when the CLR should apply the permission set.

Important   By default, the AllCode code group is a FirstMatchCodeGroup in ASP.NET policy files. Therefore, the CLR stops assigning permissions to an assembly after the first match to a specific code group. To apply the custom permissions, you must declare the specific code group assigning the custom permissions to your assembly as the first code group within the AllCode group. This ensures that the CLR assigns the MyCustomPermissions permission set and stops without proceeding to the default $AppDirUrl$/* code group that is used to assign permissions based on whether the assembly is located in BIN directory.

In the following example, the membership condition for the new code group is based on strong name membership:

           version="1" 

           PermissionSetName="MyCustomPermissions">

                        version="1" 

                        PublicKeyBlob="... see note below ..." 

                        Name="MyAssemblyName" /> 

Note   To retrieve the public key blob for an assembly, use the secutil.exe tool as follows:

secutil.exe -hex -s MyAssemblyName.dll

For more information about secutil.exe, see Secutil Tool.

20.   Save and close the file. The policy file is ready to use.

21.   Open the web.config file for the virtual server extended with Windows SharePoint Services and add the following tag to the SecurityPolicy element:

22.     

23.                 policyFile="new_file_name.config" /> 

In the web.config file, change the tag so that it refers to the newly defined trust level.

24.   Save and close the web.config file.

25.   Reset IIS, such as by using iisreset, to apply the custom policy to the specified virtual server.

What if my assembly is not strongly named? How does my code group change?

You can specify membership conditions for a code group in several ways. You can use the UrlMembershipCondition to specify conditions as follows:

           version="1" 

           PermissionSetName="MyCustomPermissions">

                        version="1" 

                        Url="$AppDirUrl$/bin/MyAssemblyName.dll" />

My assembly refers to a library assembly. Everything works when the assembly is installed in the GAC, but fails once the assembly is placed in the BIN directory. What is going on?

Assuming you granted the required permissions to an assembly, the reason your assembly cannot run may be related to how the library assembly was built. By default, strongly named assemblies allow only callers who are granted Full Trust. Therefore, the CLR blocks a partially trusted assembly from calling into a Full Trust-only assembly.

You have several possible solutions, both of which have security implications that you must consider:

1.     When compiling the assembly, you can add the AllowPartiallyTrustedCallersAttribute attribute to the specified library assembly.

Important   You can only add this attribute to the source code. If you are using a third-party assembly and do not have access to the source, you cannot choose this option. If you choose this option, you are allowing partially trusted callers to execute code from within the library. This could represent a potential security risk as it opens the specified library assembly for use by other callers with partial trust.

2.     You can give your assembly Full trust by installing it to the GAC.

Important   Assemblies installed in the GAC are available to all virtual servers and applications on the server running Windows SharePoint Services. This could represent a potential security risk as it potentially grants a higher level of permission to your assembly across a larger scope than necessary.

3.     You can give your assembly Full trust by creating a custom policy file as outlined in the previous section.

Important   It is recommended that you choose this option as it allows you to explicitly grant the required minimum level of permission to your assembly without increasing the scope of access to a larger number of callers.

Sharepoint Customization

Can I post any kind of document?

You can post documents in many formats, including .pdf, .htm and .doc. In addition, if you are using Microsoft Office XP, you can save documents directly to your Windows SharePoint Services site.

Can I download information directly from a SharePoint site to a personal digital assistant (PDA)?

No you cannot. However, you can exchange contact information lists with Microsoft Outlook.

How long does it take to set up the initial team Web site?

It only takes a few minutes to create a complete Web site. Preformatted forms let you and your team members contribute to the site by filling out lists. Standard forms include announcements, events, contacts, tasks, surveys, discussions and links.

Can I create custom templates?

Yes you can. You can have templates for business plans, doctor's office, lawyer's office etc.

How can I make my site public? By default, all sites are created private.

If you want your site to be a public Web site, enable anonymous access for the entire site. Then you can give out your URL to anybody in your business card, e-mail or any other marketing material. The URL for your Web site will be: http:// yoursitename.wss.bcentral.com

Hence, please take special care to name your site. These Web sites are ideal for information and knowledge intensive sites and/or sites where you need to have shared Web workspace. Remember: Under each parent Web site, you can create up to 10 sub-sites each with unique permissions, settings and security rights.

How do the sub sites work?

You can create a sub site for various categories. For example:

Departments - finance, marketing, IT

Products - electrical, mechanical, hydraulics

Projects - Trey Research, Department of Transportation, FDA

Team - Retention team, BPR team

Clients - new clients, old clients

Suppliers - Supplier 1, Supplier 2, Supplier 3

Customers - Customer A, Customer B, Customer C

Real estate - property A, property B

The URLs for each will be, for example:

http://yoursitename.wss.bcentral.com/finance

http://yoursitename.wss.bcentral.com/marketing

You can keep track of permissions for each team separately so that access is restricted while maintaining global access to the parent site.

How do I make my site non-restricted?

If you want your site to have anonymous access enabled (i.e., you want to treat it like any site on the Internet that does not ask you to provide a user name and password to see the content of the site), follow these simple steps:

1. Login as an administrator

2. Click on site settings

3. Click on Go to Site Administration

4. Click on Manage anonymous access

5. Choose one of the three conditions on what Anonymous users can access:

Entire Web site

Lists and libraries

Nothing

Default condition is nothing; your site has restricted access. The default conditions allow you to create a secure site for your Web site.

Can I get domain name for my Web site?

Unfortunately, no. At this point, we don't offer domain names for SharePoint sites. But very soon we will be making this available for all our SharePoint site customers. Please keep checking this page for further update on this. Meanwhile, we suggest you go ahead and set up your site and create content for it.

What are picture libraries?

Picture libraries allow you to access a photo album and view it as a slide show or thumbnails or a film strip. You can have separate folder for each event, category, etc

Can each user have access to their own calendar?

Yes there are two ways to do this,

by creating a calendar for each user, or

by creating a calendar with a view for each user

How many files can I upload?

There is no restriction in place except that any storage consumed beyond that provided by the base offering may have an additional monthly charge associated with them. 

What types of files can I upload / post to the site?

The only files restricted are those ending with the following extensions: .asa, .asp, .ida, .idc, .idq. Microsoft reserves the right to add additional file types to this listing at any time. Also, no content that violates the terms of service may be uploaded or posted to the site.

Can SharePoint be linked to an external data source?

SharePoint data can be opened with Access and Excel as an external data source. Thus, SharePoint can be referenced as an external data source. SharePoint itself cannot reference an external data source.

Can SharePoint be linked to a SQL database?

This is possible via a custom application, but it not natively supported by SharePoint or SQL Server.

How do I open an older version of a document?

Normally, all previous versions are located in the shadow, so if you right click a published document from within the web folders, go to properties and then the third tab, versions you can view older versions.

If you want to do this in code:

strURL = "url of the last published version"

Set oVersion = New PKMCDO.KnowledgeVersion

Set prmRs = oVersion.VersionHistory(strURL)

Set oVersion = Nothing

prmRS will contain a recordset, which contains the url to the old versions in the shadow.

Why do the workspace virtual directories show the error "stop sign" symbol in the IIS snap-in?

If World Wide Web Publishing Service (W3SVC) starts before Microsoft Exchange Information Store (MSExchangeIS), "stop sign" symbols appear under the Default Web Site folder of the Internet Information Services console in Microsoft Management Console (MMC).

There is a dependency between the local paths of the SharePoint Portal Server virtual directories and the MSExchangeIS. You must start MSExchangeIS first, followed by W3SVC.

Complete the following steps to prevent the stop signs from appearing each time you restart:

1. Change the Startup type for W3SVC to Manual.

2. Restart the server. The MSExchangeIS service starts automatically.

3. Start W3SVC.

What newsgroups are available?

There are two,

microsoft.public.sharepoint.portalserver and

microsoft.public.sharepoint.portalserver.development.