Murmur of a webmaster

Tuesday, July 2, 2013

WSS_KeepSessionAuthenticated

As becoming the de-fact, when asking users to authenticate, we change i.e. redirect to SSL. But then, if he/she opens another browser window and comes to us on http, to view two pages from our site simultaneously, on the second windows, he/she goes back anonymous. He/She has authenticated on the SSL i.e. https session, but not on http.

We first implemented this mechanism on SharePoint 2007. We may have wanted to redirect the second session to SSL so that the user finds himself logged-in on both windows. But due to some technical constraint not really of SharePoint, it was not that straightforward.

Anyway, this is how we started.

Then, when upgraded to 2010, we saw that the user is asked for username/password on the second session, even though the page that he is trying to open is anonymously accessible. After some research, we found out that this seems due to the WSS_KeepSessionAuthenticated cookie, that is sent. SharePoint forces the user to authenticate when it finds the cookie in the request.

To overcome, we created and hooked up a HttpModule to clear it at the beginning of the request made on http. It is an acceptable workaround for us, because we do not ask users to send their passwords as clear text.

Today, I found out that it is no longer needed with SharePoint 2013. The problem was that with SP2010, the cookie was set as non-secure. It is set when the user authenticates, and sent back to the server whether the session is secure or not. While with SP2013, it is set as secure when authenticated on https, and is sent back only when the communication is secured i.e. on SSL.

Wednesday, April 24, 2013

SharePoint2013 migration resetting master page references

If I am not wrong, it does, isn’t it?

Actually, it is not new. It did so when migrating to 2010 also. It changed master page reference of all sites to v4.master. I wrote a code to reset them back to our custom master. Needless to say that, before doing that, the custom master needed to be adapted. I needed the code to do this, because, even with sites where you see the master page reference is inherited from its parent, the effective master page became to v4.master.

I did not think it a big flaw at that time, but now think it is. What if for a legitimate reason, an organization employs several masters for their public facing web site, say for instance, employing different brandings for different products, champagnes etc.? Once upgraded, you do not know any more which site was on which master.

If SharePoint does not allow such an arrangement i.e. employing different master page for different sites, then OK. We would not complain. But it does allow, even encourages you, and says NO you cannot, all the sudden, when a new version comes out.

I did some googling, to find out that not so many seem concerned. Is this the sign that it has never gained enough popularity in the public facing web sites market? Where obviously branding is one of the most important aspects.

Monday, November 5, 2012

'premature end of script headers' in Apache

This is just a good-to-remember for myself.

When Apache reports this error with your CGI program, a script most of the case, you need to understand, or to know what the error message means, or what Apache complains about. Which I found many posts that I came across talking about the error do not really explain.

As you know, output of any CGI program must take the following form.

HEADERs
e.g. Content-type: text/html

A blank line

The payload. Normally a <HTML> element.

Apache complains with the message that the output fails to take the form.

Luckily, for the Perl script that I had the problem with, it was rather easy to locate and eventually remove the issue.

This was the good reference. http://www.linuxjournal.com/article/1367 It explains how to run a Perl CGI script from the command-line.

The point is that when you run it, it waits for input, for any possible POST payload. You indicate the end of the input with a control+D. Then it runs and you can see the output on your terminal. Once you get it, locating the issue should be (normally) straightforward.

In my case, the issue turned out that an external executable called from the script ends abnormally, and therefore corrupts the output.

Horizontal scroll bar does not appear

This is about an issue that we had with our public facing web site master page. That the horizontal scroll bar does not show, when it should, that is, when the page width is bigger than that of the browser window displaying it. Interestingly, it comes when you scroll down to the bottom of the page.

I did not know that SharePoint 2010 implements the scroll bars with some JavaScript so they enclose the s4-workspace div, not the body element, including the “ribbon”. And we had the above issue because I did the master page in such a way that it does not have the ribbon when the pages are viewed by the visitors.

I am sure that it is a requirement for everybody who do their public facing sites on SharePoint 2010. We need to get rid of the ribbon when the pages are consumed, while we do need it when we prepare them.

At the very early stage (with SP2007), I achieved it by denying any write on the internet zone. The Sites Action menu was not presented, if I remember well. Then soon enough, I needed to come up a different mechanism, because the site does need to be writable in certain cases such as a feedback form. I wrote a control, and with which I enclose the ribbon so that the ribbon is not rendered on the internet zone. This “not rendered” was the cause of the issue.

It appears that when SharePoint JavaScript displays the horizontal scroll bar at the bottom of the window, it positions it vertically from the ribbon. Therefore, when it does not find the ribbon, the starting point, it displays it only at the very bottom of the page, where s4-workspace div ends.

I have overcome it by hiding the ribbon i.e. style="display:none;" rather than being not rendered.

Hope it helps.

References:
- Starter Master Page: http://archive.msdn.microsoft.com/odcSP14StarterMaster
- A useful JavaScript trick: http://blog.pixelmill.com/944/sharepoint-2010-%E2%80%93-adding-a-fixed-footer-to-your-sharepoint-master-page/

Monday, October 15, 2012

variationsfixuptool

I got this error message.

The attempted operation is prohibited because it exceeds the list view threshold enforced by the administrator.

Luckily, I was able to identify the issue.

I knew the Variation uses the “Relationships List” List at the (variation or web app?) root. I looked at the list settings. It shows:

We could increase the threshold for the Web Application in Central Administration, Web Applications Management, Manage Web Applications, General Settings, Resource Throttling.

But what does the variationsfixuptool try to do with this list and reports the error due to this threshold?

With the –scan switch, after scanning the integrity of the specified subsite and reporting the result, it displays the entire “Relationships List”, which seems useless to me.

For the moment, I have not yet tried the –fix switch, thus do not know whether hitting the threshold prevents it from functioning properly when it tries to correct the integrity. Will see and write here again.

Friday, June 29, 2012

Java Versioning

I am not a Java programmer, at least for last five or so years. So when I find the system requirement of some software that I need to install say it requires JRE version XX or higher, I am not so existed.

Their versioning, and naming as well, are confusing.

I think I did a bit of research on it before, but find what I learnt back then nowhere now. So this time again, did some Googling and found this http://www.ehow.com/about_6574616_java-jre-1_6_.html. This clears things out to a certain extent.

Another possibly very useful pointer would be http://java.sun.com/products/archive/.

For instance, today, I was looking for JRE 1.6 update 17. According to the explanation, I should find what I am looking for under “Java SE 6”. And the “Java SE Runtime Environment 6u17” found on the next page opened must be the one.

But again, what is this “6u17”? “Update 17 for Java (1.)6”? OK... But I believe they are trying to confuse us deliberately...

Tuesday, June 19, 2012

Embedded resource

I have the feeling that I faced this difficulty already in the past. But obviously did not write about it here. And so this time again, it took some time to figure out. Now I should keep it here.

It is to have some “resource files” embedded in the assembly and accessible from clients. Not about the other type of “resource files” where you have key/value pairs.

I used this technique in the past with a web part, and remember it was rather straightforward.

But then, this time, tried to do the same in a web application project and ran across a few points that required some Googling to overcome.

First of all, the project's AssemblyInfo file needs to modified. With hands? I did. http://aspnet.4guysfromrolla.com/articles/080906-1.aspx explains it.

Secondly, the “this.GetType()” in the following code does not work, with a web application project.

Page.ClientScript.RegisterClientScriptInclude("hoge", Page.ClientScript.GetWebResourceUrl(this.GetType(), "hoge.js"));

Correct me if I am wrong. I did not bother digging it further to confirm, but in a web app project, embedded resource files such as a javascript file are included into the project’s assembly together with the code behind classes etc. But the “this” does not point to it. Rather, it points to the temporal assembly the framework generates from the .aspx file accessed.

But GetWebResourceUrl method succeeds nevertheless. This makes its debugging difficult. The method succeeds and return a seemingly valid WebResource.axd path. It is then included into the response html. Client requests it and Bomb. The requested file is not found.

http://stackoverflow.com/questions/320484/webresource-hell-resource-cannot-be-found told me the fix.

Page.ClientScript.RegisterClientScriptInclude("hoge", Page.ClientScript.GetWebResourceUrl(typeof(whatever class that I am sure cohabit with the js), "hoge.js"));

I do not know how framework maps the long parameter of WebResource.axd request to my javascript. But it is certainly not in the temporal assembly the framework generates, represented by “this”, but in my project’s assembly. I have to specify it precisely.