sharepoint anonymous users: what they can do?

When a web application is anonymous enabled, each site collection can define whether anonymous users can access whole site or just lists/libraries or nothing. Anonymous users will assume "limited access" permission role. This special permission role  is not configurable, but  it does have 2 flavors: with or without LockDown mode. The most significant difference is the lockdown mode takes away the following 2 permissions from anonymous users:

• Site permissions: Use Remote Interfaces. It will prevent web service (SOAP), WebDav and SPD connection to sharepoint sites;
• List permissions: View Application Pages. It will prevent anonymous users from view list form pages such as allitems.aspx, edititem.aspx etc

The lockdown mode is automatically turned on when a publishing portal site template is used or it can be turned on by stsadm command. see here for details.

Anonymous users will be challenged or prompted when they try to access resources which are not granted by the "limited access" role. Anonymous users can access sharepoint resource only by server object model, not by web service (either asmx or wcf) regardless whether site is anonymous enabled or whether lockdown mode is turned on. The only workaround is for readonly web service as described in the following 2 posts:

exception: for readonly and SOAP version 1.1(asmx): modify SOAPAction Header:
http://mdasblog.wordpress.com/2010/03/18/allowing-anonymous-access-with-sharepoint-web-services-and-spservices/
http://weblogs.asp.net/jan/archive/2009/05/25/quot-the-security-validation-for-this-page-is-invalid-quot-when-calling-the-sharepoint-web-services.aspx

Otherwise web service call must carry a valid credential. However if web services doesn't involve any object model, anonymous users can call those kinds of web service even if those web services are hosted inside sharepoint.

WCF services add another level of security with security binding configurations for each endpoint. WCF endpoint security along with hosting IIS authentication setup together will determine if anonymous users can invoke WCF services. See here for details.

If the web service is custom web service and using sharepoint object model, the web service need to be in viti_bin, or sharepoint CAS policy need to change. As any web service with sharepoint object model involved, they are not open to anonymous users any way.

In sharepoint 2010, at web application level, there are 2 new policies: Users Policy and Anonymous Policy, which can deny individual uses or all anonymous user's access to an anonymous web application.


Anonymous users can't access to sharepoint application pages under _layouts folder as most sharepoint application pages inherit from LayoutPageBase which is a secure page, nevertheless some application pages inherit from UnsecuredLayoutPageBase such as searchresults.aspx, login.aspx etc, which are open to anonymous users.

sharepoint 2010 WCF service error

if your sharepoint 2010 have multiple IIS headers, you will get the following error when programming client OM (client.svc) or invoking any other WCF service such as listdata.svc:

This collection already contains an address with scheme http. There can be at most one address per scheme in this collection.

By design, WCF can't have multiple bindings for the same schema (HTTP).

Extending web application certainly is a workaround, but modifying web.config should be considered a better solution:

< system.servicemodel >
<servicehostingenvironment aspnetcompatibilityenabled="true">
<baseaddressprefixfilters>
<add prefix="http://sharepoint2010.yourDomain.com/_vti_bin">
</baseaddressprefixfilters>
</servicehostingenvironment>
</system.servicemodel>

How to Expose WCF Service Meta Data Exchange EndPoint

In a previous post, I use Factory in .svc to host custom WCF service in SharePoint 2010 without any configuration in web.config. This approach is simple, but you might get the followings:

Metadata publishing for this service is currently disabled.

The reason is, the service meta data is not exposed, and for the same reason, when you try to use Visual Studio to add "service reference", you won't be able to find the service.

The solution is, obviously, to define MetaData Exchange endpoint. But that can not be done with Factory, we have to use comfiguration approach.

In the service subfolder under ISAPI mapped folder, add a web.config with configuration like this:

This will work fine only for anonymous enabled IIS site, you will otherwise get the error:

Security settings for this service require 'Anonymous' Authentication but it is not enabled for the IIS application that hosts this service.

The workaround is to define a secure binding configuration for both endpoints:

WCF and SharePoint (index)

Recently I have posted a serial blogs on WCF services and their integration with SharePoint 2010. They are not step by step type "How to", but instead they assume at least some basic understandings on WCF and SharePoint as well as Visual Studio 2010.

• How to Create WCF (RESTful) Service;
• How to Create WCF Data Service and Host it in SharePoint 2010;
• How to Host WCF (RESTtful) Services in SharePoint 2010;
• How to Expose WCF Service MetaData Exchange EndPoint
• How to Consume WCF RESTful service from Silverlight;
• How to Consume WCF RESTful service from Ajax Javascript;
• How to Consume Ajax-enabled WCF Services;
• How to Enable WCF services consumable for Ajax Javascript;

Consuming SharePoint 2010 RESTful service in Silverlight and Data Binding

SharePoint 2010 now provide SOAP based web service, REST, and Client OM, and all of them are out of box. REST is becoming very popular, but not in SharePoint world yet for whatever reasons. One of them I think is, now that Client OM can do it all, why bother REST? Learning curve for client OM will be much shorter for sharepoint developers who are already familiar with server side OM. That has been my thought ever since I first time heard of REST from Paul Stubbs's PDC presentation on using SharePoint RESTful service. Lately I read a blog from Andrew Cornell where he posted a "small challenge" of binding sharepoint list items to Silverlight application. The problem is, Client OM is weakly typed, it doesn't provide properties for list columns. The solution could be to create a converter, or write a wrap class, either way you need to write a quite lot of code and/or learn WPF's converter. My intuition is, using REST can do data binding natively since it is strongly typed.

To prove this concept, i wrote a small Silverlight application which binds data from SharePoint list called AdventureEmployee. xaml looks like this:

Then in Code behind, first add service reference, and define DataService Query:

and then in the AsynCallback:

Those are all code I wrote.(the code can be even simpler: splist.ItemSource=query.EndExecute(result) VStudio created the whole datacontext class. So if you don't like typing, use REST for data binding.

Related post: Consuming SharePoint 2010 RESTful service from Ajax Javascript

Host WCF Services in SharePoint 2010

As a completion of my post, how to Host WCF Data Service in SharePoint 2010  I am here to show how to host WCF services and WCF RESTful services inside SharePonit 2010.

Create a empty SharePoint project and add an ISAPI mapped folder

Add "new item" and select "WCF Service"
when creating WCF service inside a SharePoint Project, you won't get .svc file, only one interface and one class file:

• Add this attribute to implemntation class:
• [AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]
• specify Namespace in the interface, otherwise your proxy script class will get a namespace like org.ui
• [ServiceContract(Namespace="")]

Create a service.svc file under ISAPI folder

• As it is hosted in SharePoint, we have to use non-configuation approach (Factory) to define endpoint (see here for details). In other word, no web.config modification, in stead use Factory in .svc file as follows:
• <%@ServiceHost Language="C#" Debug="true" Service="SharePointHostWCF.WCFService, SharePointHostWCF, Version=1.0.0.0, Culture=neutral, PublicKeyToken=d82e2e229c90dd3e" Factory="System.ServiceModel.Activation.WebScriptServiceHostFactory"% >
• WebScriptServiceHostFactory will define a endpoint callable from Javascript.

create a sharepoint ajax enabled application page to test your WCF service

• see my other post on how to make ajax enabled sharepoint page;
• use asp:servicereference to load a service proxy class in runtime;
• in javascript,you should be able to get a IWCFService object and use it to call service methods;
• you can't call it from another iis web application, since it is treated as a cross site scripting (CSS);

What if you want to implement a RESTful Service?

• add this attribute to interface method:
• [WebGet(UriTemplate = "Hello", ResponseFormat = WebMessageFormat.Xml)]
• change Factory in service.svc to WebServiceHostFactory. otherwise you get the following errors:

  Endpoints using 'UriTemplate' cannot be used with 'System.ServiceModel.Description.WebScriptEnablingBehavior'.

• you can now test service from browser in a RESTful way;
• if you choose Json for ResponseFormat instead, browser won;t be able to display, instead asking you to download. You should test it in Fiddler;
• still want to consume this RESTful service from script, see my other post for detail;

Enable WCF services consumable for Ajax JavaScript

In the previous post, I show how to call ajax-enabled WCF from Javascript, and how to consume WCF RESTful service from Ajax JavaScript. What if you already created a WCF service using WCF Service template, and want it to be consumed in a JavaScript? It turns out the only change is in web.config:

When you create a WCF service in Visual Studio, its endpoint in web.config is defined as:

<endpoint address="" binding="wsHttpBinding" contract="AjaxWcFService.IWCFSoapService" >
<identity > <dns value="localhost" > </identity >
</endpoint >

replace it with the followings:

< endpoint address="" binding="webHttpBinding"
behaviorConfiguration="ScriptFriendly"
contract="AjaxWcFService.IWCFSoapService" >
< /endpoint >

and define endpoint behavior as follows:

<behavior name="ScriptFriendly" >
<enableWebScript / >
</behavior >

This WCF service now becomes ajax-enabled.

Call Ajax-enabled WCF Services from Ajax JavaScript

After Creating an Ajax-enabled WCF service in Visual Studio 2010, the following endpoint behavior is specified for this service:

<behavior name="AjaxWcFService.AjaxWCFSVCAspNetAjaxBehavior"><enableWebScript/>
</behavior >

which will allow ajax library (see here to register ajax library)  to inject a proxy at runtime for script client to use and call this service once it is referred in an ASP:Service:
<Services > <asp:ServiceReference Path="~/AjaxWCFSVC.svc" / >
</Services >



So the script can just make a call like the follwoings.
                  var svc = new AjaxWCFSVC();
                  svc.DoWork(onSuccess, onFail, null)

Related Post: Call WCF RESTful service from Ajax JavaScript
                     Call WCF service from Ajax JavaScript

Host WCF Data Service in SharePoint 2010

Creating a WCF data service based on Entity Framework is fairly easy in Visual Studio 2010 (see here for step by step), but two Major steps are:

• Add Entity Framework Model:

• Add WCF data service

A couple notices:

• In web.config, the following connection string is added:

• if you right click on .svc file in Visual Studio and View Markup, you will see something like the followings. The point is, it is not strongly named!

<%@ ServiceHost Language="C#" Factory="System.Data.Services.DataServiceHostFactory, System.Data.Services, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Service=" EntityDataService.AWDataService" %>

Now let's host this WCF data service in SharePoint _vti_bin folder, just like listdata.svc:

• Sign this project:

• Strong Name AWDataService.svc Markup:

<%@ ServiceHost Language="C#" Factory="System.Data.Services.DataServiceHostFactory, System.Data.Services, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Service=" EntityDataService.AWDataService, EntityDataService,Version=1.0.0.0,Culture=neutral,PublicKeyToken=d71e6a94584bc776" % >

• Add an empty SharePoint project and add a sharepont mapping folder- ISAPI with following items:
• an existing item: AWDataService.svc
• a new item: web.config with the above connection string included

• Add service dll into sharepoint package to be deployed into GAC:

• Optimize by not including sharepoint project assembly in the package since it will be an empty dll otherwise

After deploy the sharepoint project, you should be able to browse this WCF dataservice as: http://yoursharePointserver/_vti_bin/DataServiceHost/AWDataService.svc

Consume SharePoint 2010 RESTful service from Ajax JavaScript

I ever post on how to Consume REST in SilverLight to bind SharePoint 2010 List Data. In this post, I will show how to consume SharePoint RESTful service in AJAX Javascript for databinding in a sharepoint application page (no authenticaion needed in this scenario).

First create an application page:

this should be easy to do by using Visual Studio 2010 sharepoint template, or you can simple manually creat one (see here).

Add AJAX library support into the application page:

This should be done simply by linking AJAX library from CDN. But as AJAX libray currently still in beta, you have to download MicrosoftAjax.js (this is needed only for dataview control used in the code) from here , add this file into your project file and then use ScriptManagerProxy to load it to the page (I think this should be a bug in beta). You can't use ScriptManger since sharepoint master page already has one.

The script should look like:

Invoke Ajax Call by using WebRequest, a traditional way

by default, RESTful service response with ATOM feed (XML formated). In order for AJAX to work, the request header should be specified as accepting application/json. This is important otherwise deserialization will fail.

In Callback, bind data with control:

with HTML makeup looks like this:

A even more elegant way, but not working yet... and it works!

In PDC 2009, a very elegant way was demoed by Stephen Walther to achieve this data binding with WCF service, but I can't make it work with listdata.svc. I think the fact that listdata.svc returns by default XML data rather than JSON might be the reason behind. I don;t know how to change it when create a dataview in the following code: Actually Ajax dataview Call use Json format as I discover this from Fiddler.

In fiddler, I can see listdata.svc get called, but it returns code 400, implying bad data format?
The problem was, url for fetchOperation in the code above ws illegal, and unfortunately this illegal url is tolerated in IE broswer.  Fiddle gave a misleading error code 400 due to whitespace.See Lessons learned from using Fiddler.

With this approach, http markup is clean without custom elements, and this is achieved by a custom item render as follow:

Related Posts:

Call Ajax-enabled WCF Service from Ajax JavaScript
Call WCF Service from Ajax JavaScript


Great Resources:

http://blogs.pointbridge.com/Blogs/monnette_jeff/Pages/Post.aspx?_ID=24

http://blogs.visoftinc.com/archive/2009/04/28/ASP.NET-4.0-AJAX-Preview-4-Client-Templates.aspx

REST Service, Json and XML

REST support 2 native data formats: Json and XML. XML is default and is browser friendly with Atom feed. Json is programming friendly, particularly Ajax friendly because of its small dataload and easy deseralization. Either way, REST is very web friendly as it uses http like syntax which is easy for script to make call or for user to browse.

A common misconcept is Json is required for Ajax. Ajax can work with any format, but Json has significant advantage over XML. When making an Ajax call to a REST service, the request header can be specified with an "Accept:" format, but it is just a "wish", and will be granted only when the service has a capability for the requested format. So the following code will return error when the service doesn't response with Json data:

var data = response.get_responseData();
data = eval("(" + data + ")")

Also keep in mind, Visual Studio (2010 RC) doesn't provide java script intellisense for REST response data. In contrast, Ajax-enabled WCF service can emit a script proxy (via asp:serviceRefernce), so it has full intellisense support, and has built-in serialization/deserialization support with default Json format.

Create a WCF RESTful service in Visual Studio 2010

Visual Studio 2010 (RC) doesn't have a template specifically for RESTful service. The WCF service template will create a WCF SOAP service, but it can be converted into REST service as follow:



Edit web.config:



The web.config entities for REST is quite different from those for SOAP, but very similar to those for Ajax-enabled WCF Service, the only difference is, Ajax-enabled WCF has "enableWebScript":

Add WebGet attribute to all methods in contract interface, like:


[WebGet(UriTemplate = "Hello", ResponseFormat = WebMessageFormat.Json)]



Add this attribute for REST implementation class:


[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)]


Test in Fiddler:

By now, it is a functioning WCF RESTful service, and response json format data. You can test it in Fiddler.

Great References:
http://www.ajaxlines.com/ajax/stuff/article/return_json_from_ajaxenabled_wcf_service.php
http://www.robbagby.com/rest/rest-in-wcf-blog-series-index/