SharePoint Apps for the IT Pro

1. Thomas Vochten SharePoint Apps for the IT Pro #spsnl 2014

2. ABOUT ME Thomas VochtenSharePoint MVP. Platform architect. Speaker. Trainer. Involuntary DBA. Consultant at Xylos. V-TSP at Microsoft. @thomasvochtenhttp://thomasvochten.com

3. AGENDA • Introduction to Apps • Preparing the infrastructure • Apps Management • Apps Security

4. INTRODUCTION TO APPS

6. THE PROBLEM WITH FULL TRUST CODE (FTC) • Performance • Maintenance • Security • Upgrades • Supportability • …

7. PREVIOUS ATTEMPTS TO FIX THE PROBLEM Custom code in Sandboxed Solutions is deprecated with SharePoint 2013

8. MORE FRUSTRATIONS SharePoint developers felt, well… a bit left behind

9. WELCOME TO THE CLOUD APP MODEL (CAM) • Apps don’t run on the SharePoint server • Can still interact with SharePoint • On-Premises and in the cloud • Free choice of tools, languages & platforms

10. EVERYTHING IS AN APP

11. THE NEW MICROSOFT ? http://officespdev.uservoice.com/ https://officeams.codeplex.com/

12. TYPES OF APPS

13. SHAREPOINT HOSTED APPS • Run in the browser • Use client side technologies only • Relatively easy • Can interact with the host web • Use an app web with a funky URL • On-Premises and in the cloud • AuthZ with user privileges

14. PROVIDER HOSTED APPS • Bring your own hosting • Use any language or platform • Greater flexibility • Greater responsibility • Can interact with the host web

15. PROVIDER HOSTED APPS

16. AUTO HOSTED APPS • Web & Azure components are provisioned automatically • Can interact with the host web • Automagically provisioned provider-hosted apps

17. APPS POSITIONING

18. APPS USER EXPERIENCE

19. SHAREPOINT STORE

20. WHO DO YOU TRUST ?

21. APP PROVISIONING • Timer job kicks in • App web is provisioned • Permissions are configured

22. FULL PAGE Mimics SharePoint look and feel

23. APPS UI COMPONENTS Ribbon extensions App Parts

24. PREPARING THE INFRASTRUCTURE

25. DEMO ENVIRONMENT • Single farm • Single content application pool • Single services application pool • Single content web application • Host named site collections • No host headers • SSL Everywhere

26. “Host-named site collections are the preferred method to deploy sites in SharePoint 2013” From: TechNet

27. Exploring the demo environment

28. DNS PREREQUISITES • Choose your app domain • Request a wildcard or SAN certificate • Configure DNS with a wildcard record • Setup SharePoint & IIS to accommodate requests for your app domain

29. CHOOSE AN APP DOMAIN • Unique domain • No subdomains please • You need one… perfarm!

30. CERTIFICATES Wildcard Certificate *.contoso.com Wildcard Certificate *.contosoapps.com SAN Certificate *.contoso.com *.contosoapps.com Single web application Host named site collections No IIS host headers Multiple web applications IIS Host headers Routing web application for apps

31. ROUTING WEB APPLICATION https://app-bdf2016ea7dacb.contosoapps.com/... DNS Lookup app-bdf2016ea7dacb.contosoapps.com Web App Host header: intranet.contoso.com Certificate Default Website No host header Default Website No host header Web App Host header: teams.contoso.com Certificate Routing Web App No host header WC Certificate

32. ROUTING WEB APPLICATION https://app-bdf2016ea7dacb.contosoapps.com/... DNS Lookup app-bdf2016ea7dacb.contosoapps.com Web App No host header SAN Certificate

33. ROUTING WEB APPLICATION • When you need to use IIS host headers • Web application without a host header • Contains no site collections • Delete/disable the Default Website in IIS • Consider multiple IP addresses • Use the same application pool identity as your content application pool

34. SHAREPOINT PREREQUISITES Claims based authentication only Subscription Settings Service Application • Generates & manages App ID’s App Management Service Application • General settings • App licensing

35. SHAREPOINT CONFIGURATION • Configure App domain • Configure App prefix • Configure App Catalog • Configure SharePoint Store settings

36. CONSIDERATIONS • You can use multiple zones for your app domain (needs March 2013 PU)$contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService$contentService.SupportMultipleAppDomains= $true $contentService.Update() iisresetNew-SPWebApplicationAppDomain-AppDomain <AppDomain> -WebApplication <WebApplicationID> -Zone <Zone> -Port <Port> -SecureSocketsLayer • Use SSL… everywhere!

37. Configuring infrastructure for Apps

38. SIMPLE, RIGHT? • Your environment is now ready to host SharePoint Hosted Apps • Office365 can use provider hosted apps without extra configuration • Connecting on-premises farms to provider hosted apps requires additional configuration!

39. APPS SECURITY

40. SECURITY BASICS • User principals vs App principals • Authentication vs Authorization SharePoint 2013 can authenticate Apps!

41. APP AUTHENTICATION • Internal AuthenticationIt just works • External Authentication using S2S Trusts • External Authentication using OAuth

42. AUTHENTICATION FLOW

43. APP PERMISSIONS • Granted by user approval • All or nothing • Default permissions (like app web control)

44. LOW TRUST VS HIGH TRUST • Low trust apps need ACS as trust broker (via Office365) • High trust apps need Server To Server trust (no need for Office365)

45. LOW TRUST VS HIGH TRUST You might need to open firewall ports towards ACS

46. KERBEROS? Sorry, something went wrong

47. SAML AUTHENTICATION Identity provider should support: • Wildcard return URL • Wreply parameter ADFS 2.0 does not, ADFS 3.0 does

48. SUMMARY • Apps are good for you • Don’t underestimate infrastructure impact • Understand the security model of apps • Strongly consider using host named site collections • Use SSL - Everywhere!

49. QUESTIONS ?

50. #spsnl @thomasvochten