Category: Tips and Tricks

There are a lot of articles related to this error message, typically seen when trying to run an on-premise SharePoint provider-hosted add-in in a high trust configuration.  I know because I read all of them.

For me, there was no (visible) evidence that the IssuerId in my web.config was different than the RegisteredIssuerName value of my Trusted Security Token Issuer entry.  I checked and rechecked it dozens of times.

Finally I put some tracing in the the code to see what was actually being sent to the SharePoint.  The creation of the authentication token is in the TokenHelper.cs class in the IssueToken method (about line 778).  Line 796 is where it gets the issuer id value.

Here’s the screenshot of our trace log file reporting out the value being read from the web.config.  Notice anything unusual?

There are some warnings related to cutting-and-pasting the Certificate Serial number picking up hidden characters – but somehow our entry in the web.config for the IssuerId also got a hidden character inserted in.  The “??” is passed along as part of the issuer ID value and causes the mismatch.

I manually retyped the line in the web.config, saved, and reran the app.  This time it came through clean with no errors simply because the values exactly matched.

By all appearances the values were the same, but the hidden character caused them to be different.

Add this to your checklist of things to review if you hit this error – hopefully it won’t take you several days like it too me and my team.

 

 

Update: I’ve added a video walkthrough of this technique.

In my last post, I talked about using a Powershell script to import user profile photos from a SharePoint Picture Library in to the MySites users profile.

That works great to sync up the photos from the library as a batch.  But what happens when you add a new employee photo to the library?  We need something to automatically update the MySite user profile, and a custom workflow will do just that.

Here’s the general logic for our workflow:

When an item is added or updated,

1. Check if a User Name has been set.  If so, 
2. Retrieve the User’s Profile
3. Set the ‘PictureUrl’ value to the Url of the item in the picture library.
4. Save the Profile record.
5. Regenerate the Thumbnail sizes used by MySites.

Unfortunately, out of the box, SharePoint Designer workflows will not allow you to manipulate the User Profile.  I made an attempt to use the Virto Software Workflow Activities add-on, but was not able to get it working as I expected.  (UPDATE: This may have been a permissions issue. YMMV)

So, we need to use a Visual Studio Sequential Workflow in order to get full access to the User Profile.  Here are the steps.

First, create a new Sequential Workflow project in Visual Studio and go through the wizard

Next, with the Workflow Designer open, select a ‘Code’ element from the Toolbox and drag it on to the workflow after the onWorkflowActivated1 event.

View the Properties for the Code element, and set the ExecuteCode property to “UpdateUserProfilePhoto”.  This will stub out a new method for you in the code file.

Now, add the following references to your project:

• Microsoft.Office.Server (14.0.0.0)
• Microsoft.Office.Server.UserProfiles (14.0.0.0)
• System.Web (2.0.0.0)

In your workflow code file, add the following using statements

using Microsoft.Office.Server.UserProfiles;
using Microsoft.SharePoint.Administration;
using System.Web;

And then add this code to the UpdateUserProfilePhoto method to implement our workflow sequence.

private void UpdateUserProfilePhoto(object sender, EventArgs e)
{
  try
  {

    //get username
    Microsoft.SharePoint.SPFieldUser fieldUser =
     (Microsoft.SharePoint.SPFieldUser)workflowProperties.Item.Fields.GetField("User Name");

    Microsoft.SharePoint.SPFieldUserValue fieldUserValue =
      (Microsoft.SharePoint.SPFieldUserValue)fieldUser.GetFieldValue(workflowProperties.Item["User Name"].ToString());

    if (fieldUserValue != null)
    {
      string username = fieldUserValue.User.LoginName.ToString();

      if (!string.IsNullOrEmpty(username))
      {

        //get profile record
        using (SPSite site = new SPSite(workflowProperties.SiteId))
        {
          SPServiceContext context = SPServiceContext.GetContext(site);

          UserProfileManager profileManager = new UserProfileManager(context);

          UserProfile profile = profileManager.GetUserProfile(username);

          //Updates values
          profile[PropertyConstants.PictureUrl].Value = workflowProperties.Item["EncodedAbsUrl"].ToString();

          //commits changes
          profile.Commit();

        }
      }
    }
  }
  catch (Exception ex)
  {
    //write to ULS
    SPDiagnosticsService diagSvc = SPDiagnosticsService.Local;

    diagSvc.WriteTrace(0, new SPDiagnosticsCategory("Workflow", TraceSeverity.Monitorable, EventSeverity.Error), TraceSeverity.Monitorable,
      "Error in Save User Profile Photo workflow: {0}", new object[] { ex.Message.ToString() });
    diagSvc.WriteTrace(0, new SPDiagnosticsCategory("Workflow", TraceSeverity.Monitorable, EventSeverity.Error), TraceSeverity.Monitorable, 
      "Error in Save User Profile Photo workflow: {0}", new object[] { ex.StackTrace.ToString() });
  }
}

Note that there are some slight variations between this code and the Powershell script, namely in the Encoded Absolute Url property name, and the property used to get the username value.

The workflow is now ready to be deployed, so you can update the Feature and Package to your liking.

There is one more crucial task in order to make this work, and that is to grant permissions for modifying the User Profile to the Application Pool service account for the web application in which this workflow will run. If you do not do this, you will receive the following exception when the workflow attempts to modify the profile record.

Attempted to perform an unauthorized operation.
 at Microsoft.Office.Server.UserProfiles.UserProfileValueCollection.CheckUpdatePermissions()    
 at Microsoft.Office.Server.UserProfiles.ProfileValueCollectionBase.set_Value(Object value)    
 at SaveUserProfilePhoto.Workflow1.Workflow1.UpdateUserProfile(Object sender, EventArgs e)

To grant this permission, go to the Manage Service Applications page in the Central Administration site. Select the entry for the User Profile Service Application, and click the Administrators button shown in the Ribbon.

Add the application pool service account, then check ‘Full Control’, and save the changes.

Running the Workflow

To test the workflow out, we’ll add a new image to our Photo Library, being sure to select a person in the User Name field.  We also need to make sure we Check In the record, since workflow will not run on a checked out item.

Clicking on the item and viewing its Workflow status will let us see if the Workflow ran successfully.

Finally we can go to the user’s MySites profile page and confirm that the image is in place.

If the workflow code encounters any exceptions, they will be logged to the ULS file, so you can check there to see what happened.

The SharePoint 2010 ribbon control provides various toolbars used by content authors and contributors, particularly when creating and editing Publishing pages.

But what if your organization doesn’t want to allow certain user groups to change formatting, or select different fonts, in order to maintain a standardized style.  In this case, dynamically changing the ribbon control based on the user’s permissions or group membership allows an organization to determine what and how a user may do while editing content.

The default Edit Ribbon displays as follows when the user selects an HTML content area:

Here are the revisions to the ribbon we will make.  Some buttons will be removed altogether, and others will be security trimmed.

Creating a custom Ribbon Trimming Control

To apply the changes to the ribbon, we’ll create a basic control that can be added to the Master Page.  Start by creating a new Empty SharePoint Project in Visual Studio 2010.

Add references to System.Web and Microsoft.Web.CommandUI.

Add a class to the project as follows:

using System;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using Microsoft.SharePoint.WebControls;
using Microsoft.SharePoint;

namespace MyApp.TrimRibbon
{
  public partial class RibbonSecurityTrimmer: UserControl
  {
    protected void Page_Load(Object sender, EventArgs e)
    {
      SPRibbon ribbon = SPRibbon.GetCurrent(this.Page);
      if (ribbon != null)
      {
        //remove following controls for all users
        ribbon.TrimById("Ribbon.EditingTools.CPEditTab.Font.Fonts");
        ribbon.TrimById("Ribbon.EditingTools.CPEditTab.Font.FontSize");
        ribbon.TrimById("Ribbon.EditingTools.CPEditTab.Font.FontColor");
        ribbon.TrimById("Ribbon.EditingTools.CPEditTab.Font.FontBackgroundColor");
        ribbon.TrimById("Ribbon.EditingTools.CPEditTab.Markup.LanguagesLabel");
        ribbon.TrimById("Ribbon.EditingTools.CPEditTab.Markup.Languages");

        //remove View HTML markup control for anyone who does not have Full Control rights to the site.
        if (!SPContext.Current.Web.DoesUserHavePermissions(SPBasePermissions.FullMask))
        {
          ribbon.TrimById("Ribbon.EditingTools.CPEditTab.Markup.Html");
        }
      }
    }
  }
}

Create a Feature to deploy this project’s assembly in to the GAC.

Be sure to set the Scope to WebApplication so the assembly is globally available.

Set up the deployment package to include the Feature you just set up.  Keep in mind you’ll need to ensure that a Safe Controls entry is added to the web.config file for the web application during deployment.  

Deploy to the SharePoint farm and activate the Farm solution.  The assembly should be provisioned in to the GAC (which you can confirm by opening Windows Explorer to c:\windows\assembly.)

Updating the Master Page

Open Master Page (either in a branding solution, or using SharePoint Designer)

Add Register tag before the <html> tag to pull in Assembly.

<!-- Ribbon Trimming Control -->
<%@ Register TagPrefix="MyApp" Namespace="MyApp.TrimRibbon" Assembly="MyApp.TrimRibbon, Version=1.0.0.0, Culture=neutral, PublicKeyToken=bda84fa329198d63" %>

Add the control tag in Body section of Master Page.

<!-- control to trim ribbon -->
<MyApp:RibbonSecurityTrimmer id="RibbonTrim1" runat="server"/>

Save and deploy master page.  If you’re using SharePoint Designed, check in and publish your changes.

To confirm the security trimming is applied, load a page that uses the Master Page you modified, go in to edit mode, and view the revised ribbon.

Here it is for a user without Full Control rights

Here it is for a user with Full Control rights (notice the return of the HTML drop down near the right side.)

MSDN has a full list of the enumerated SharePoint Permissions and a list of the button control ID values.

This blog post maps those permissions to the Permission levels typically associated to SharePoint groups.

Using this approach, you can easily create different variations of the Ribbon for each group of authors, contributors or editors, just by applying different checks using the SPContext.Current.Web.DoesUserHavePermissions method.

If you need to add additional parameters to control the trimming, you can do that by exposing public properties in your class and setting them in the control tag when you place it on the Master Page.