Unable to browse sharepoint from within the server itself

If you ever have problem browsing your SharePoint portal from within the WFEs itself, and running on Windows Server 2003 SP1 or above, it could be due to a loopback check security. I noticed that this does not happen to site that does not use host header (e.g. does not happen to http://servername:port, but happen to http://host.header.name.com/).

Take a look at http://support.microsoft.com/kb/896861. By modifying some registry, you can either exclude your specific URL from this security check, or disable the feature. The following is a direct copy from the KB article for reference.

Method 1: Specify host names

Note We recommend that you use this method. To specify the host names that are mapped to the loopback address and can connect to Web sites on your computer, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

3. Right-click MSV1_0, point to New, and then click Multi-String Value.

4. Type BackConnectionHostNames, and then press ENTER.

5. Right-click BackConnectionHostNames, and then click Modify.

6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.

7. Quit Registry Editor, and then restart the IISAdmin service.

Method 2: Disable the loopback check

Follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

3. Right-click Lsa, point to New, and then click DWORD Value.

4. Type DisableLoopbackCheck, and then press ENTER.

5. Right-click DisableLoopbackCheck, and then click Modify.

6. In the Value data box, type 1, and then click OK.

7. Quit Registry Editor, and then restart your computer.

Resources on Configuring SharePoint Form Authentication

Here’s some of the best resource for setting up form based authentication.

 

From the SharePoint Team Blog (Configuring Multiple Authentication Providers for SharePoint 2007):

http://blogs.msdn.com/sharepoint/archive/2006/08/16/702010.aspx

 

From the TechNet (Configure forms-based authentication for WSSv3):

http://technet.microsoft.com/en-us/library/cc288043.aspx

 

From Andrew Connell’s blog (very detailed step by step):

http://www.andrewconnell.com/blog/articles/HowToConfigPublishingSiteWithDualAuthProvidersAndAnonAccess.aspx

Cause of Audience Targeting Error Log

The following error was logged on the MOSS WFE servers intermittently without any pattern in the sense of frequency. It happens once in a blue moon.

Event Type: Error Event Source: Office SharePoint Server Event Category: Office Server General Event ID: 7888 Date: 2/11/2009 Time: 5:56:21 PM User: N/A Computer: MOSSPROD01 Description: A runtime exception was detected. Details follow. Message: Thread was being aborted. Techinal Details: System.Threading.ThreadAbortException: Thread was being aborted. at Microsoft.Office.Server.WebControls.AudienceLoader.UpdateAudienceRunTimeCheckHashs(Boolean loadAudiences, Boolean loadMemberships, Boolean loadSharePointGroups) at Microsoft.Office.Server.WebControls.AudienceLoader.EnsureCurrentUserAudienceIDs(Boolean loadAudiences, Boolean loadMemberships, Boolean loadSharePointGroups) at Microsoft.Office.Server.Audience.AudienceManager.IsCurrentUserInAudienceOf(AudienceLoader audienceLoader, String audienceTextRepresentation, Boolean showUntargetedAudience)

There were other logs with similar detail, all has something to do with Audience methods throwing errors. A check on the SharePoint log files provided a little bit of clue, but nothing that lights the bulb. Here's the snippet of the error logged under the category of User Profiles in MOSS log:

GetUserAudienceIDs::GetUserAudienceIDs() failed in SharePoint Group membership resolution (Exception Message : Accessor is invalid. StackTrace at Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(Exception ex) at Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex) at Microsoft.SharePoint.Library.SPRequest.GetGroupsDataAsSafeArray(String bstrUrl, UInt32 dwGroupsScope, String bstrValue, UInt32 dwValue, UInt32& pdwColCount, UInt32& pdwRowCount, Object& pvarDataSet) at Microsoft.SharePoint.SPGroupCollection.InitGroups(Boolean fCustomUsers, String[] strNames, Int32[] groupIds) at Microsoft.SharePoint.SPGroupCollection.InitGroups() at Microsoft.SharePoint.SPGroupCollection.Undirty() at Microsoft.SharePoint.SPBaseCollection.System.Collections.IEnumerable.GetEnumerator() at Microsoft.Office.Server.Audience.AudienceManager.GetUserAudienceIDs(String accountName, SPWeb web, Boolean loadAudiences, Boolean loadSharePointGroups, Boolean loadMemberships). No SharePoint Group IDs will be returned.

Then I moved on to the IIS log files, and found that at the time of the error, a user is accessing the homepage. Immediately after that homepage request, several lines of log shows the user was being redirected to the /layouts/AccessDenied.aspx page. This pattern can be seen in several other occasions as well in other copy of the IIS log files.

2008-12-17 07:36:24 W3SVC45547621 172.25.67.84 GET /default.aspx - 443 PROD-AD01\uTester01 58.213.113.254 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 302 0 0 2008-12-17 07:36:27 W3SVC45547621 172.25.67.84 GET /_layouts/AccessDenied.aspx Source=https%3A%2F%2Fportal%2Eportal%2Ecom%2Fdefault%2Easpx 443 PROD-AD01\uTester01 58.213.113.254 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 200 0 0

After further investigation and testing, I found that the homepage is the only page that the portal has audience targeting configured. Several testing and monitoring was conducted and the conclusion is that this error will always be thrown whenever an unauthorized user attempts to load a MOSS page that has audience targeting configured. Since the error was thrown when the method IsCurrentUserInAudienceOf is invoked, this indicates that somehow MOSS will still perform audience checking even though the user doesn't have the privilege to access the portal.

I have not found any workaround to remove the error. If you found any without suppressing the logs from central admin do let me know :).

Performance Counters to trace for troubleshooting performance issue

I've been involve in some performance testing for a typical MOSS implementation lately. Although I have done these test many times on different projects, but I find that each performance test is unique, depending on the test objective, environment, the test subject (portal pages and components). Still, one thing that remain quite consistent is the performance counter to monitor. The following performance counter were used for the most recent performance test. I've included additional ASP.NET Application cache counters, as I want to verify whether the MOSS cache profile is working properly.

Counter Object	Counter	WFE	Index	SQL	Client	Remark
Processor (_Total)	% Processor Time	Y	Y	Y	Y	Not more than 70%
Memory	Available Bytes Pages/Sec	Y	Y	Y	Y
Physical Disk	% Disk Time Avg. Disk Queue Length	Y		Y
Network	Bytes Sent/Sec Bytes Received/Sec Bytes Total/Sec	Y	Y	Y	Y	http://technet.microsoft.com/en-us/library/aa996224.aspx Bytes Total/Sec for 1000mbps NIC should not go over 70MB/s Bytes Total/Sec for 100mbps NIC should not go over 7MB/s
ASP.NET Applications	Request Total Requests/sec Request Execution Time Requests Succeeded Request Rejected Requests Timed Out Requests Not Found Requests Not Authorized Output Cache Hits Output Cache Misses	Y				Refer to http://msdn.microsoft.com/en-us/library/fxk122b4.aspx for description of ASP.NET performance counters.

I will include the SQL server performance counters later, as I do not have the information now (it was determined by my SQL-expert colleague)

Recommended SharePoint application pool settings

Joel Oleson has a great blog regarding the best practice when comes to application pool performance settings: http://blogs.msdn.com/joelo/archive/2007/10/29/sharepoint-app-pool-settings.aspx. Do refer the comments left by other readers as well.

PDF iFilter Updates

It’s been a while since I’ve last configure the PDF iFilter for SharePoint. The last one I’ve done was for SPS 2003. For MOSS 2007, the process is pretty much the same, except for file path difference and configuration page changes. Here’s the steps taken from MS KB http://support.microsoft.com/kb/832809/en-us.

1.	Download Adobe PDF IFilter 5.0 from the following Adobe Web site: http://www.adobe.com/support/downloads/detail.jsp?ftpID=2611 (or search Google for latest installer from Adobe).(http://www.adobe.com/support/downloads/detail.jsp?ftpID=1276)
2.	Stop the IIS Admin service. To do this, follow these steps: a. Click Start, point to Administrative Tools, and then click Services. b. Right-click IIS Admin Service, and then click Stop.
3.	Run the Adobe PDF IFilter 5.0 Setup program to install the filter on the server. • For WSS 2.0, install the PDF iFilter on the SQL and WSS servers. • For SPS 2003, install the PDF iFilter on the SQL and Index servers. • For WSS 3.0, install the PDF iFilter on servers running the WSS [spsearch] search service. • For MOSS 2007, install the PDF iFilter on the Index servers. After installing the iFilter, perform Steps 5, 6, and 7 on all the Web Front End servers in the farm.
4.	Register the Adobe PDF IFilter. To do this, follow these steps: a. Click Start, and then click Run. b. In the Open box, type cmd, and then click OK. c. Switch to the folder that contains the Adobe PDF Filter 5.0 files. For example, switch to the following folder: Drive:\Program Files\Adobe\PDF IFilter 5.0 d. Type regsvr32.exe pdffilt.dll, and then press ENTER. e. If you receive a message that states that the operation was successful, click OK . f. Type exit, and then press ENTER to exit the command prompt.
5.	Copy the .gif file that you want to use for the icon to the following folder on the server, as appropriate for your situation: SharePoint Portal Server 2003 - Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\60\Template\Images SharePoint Server 2007- Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Template\Images
6.	Edit the Docicon.xml file to include the .pdf extension. To do this, follow these steps: a. Start Notepad, and then open the Docicon.xml file. The Docicon.xml file is located in one of the following folders on the server: SharePoint Portal Server 2003 - Drive:\Program Files\Common Files\Microsoft Shared\Web server extensions\60\Template\Xml SharePoint Server 2007- Drive:\Program Files\Common Files\Microsoft Shared\Web server extensions\12\Template\Xml b. Add an entry for the .pdf extension. For example, add a line that is similar to the following to the Docicon.xml file, where NameofIconFile is the name of the .gif file: <Mapping Key="pdf" Value="NameofIconFile.gif"/> c. On the File menu, click Save, and then quit Notepad.
7.	Restart the server.
8.	Add the .pdf file type to the content index. To do this, follow these steps: (these steps are for SPS2003. MOSS2007’s steps are to go to SSP configuration) a. Connect to the portal site, and then click Site Settings. b. On the Site Settings page, click Configure search and indexing under Search Settings and Indexed Content. c. On the Configure Search and Indexing page, click Include file types under General Content Settings and Indexing Status. d. On the Specify File Types to Include page, click New File Type. e. On the Add File Type page, type pdf in the File extension box, and then click OK.
9.	Update the context indexes for portal content and for non-portal content. To do this, follow these steps: (these steps are for SPS2003. MOSS2007’s steps are to go to SSP configuration) a. On the Site Settings page of the portal site, click Configure search and indexing under Search Settings and Indexed Content. b. On the Configure search and indexing page, click Manage content indexes under Content Indexes. c. On the Manage Content Indexes page, click the down arrow next to the name of the index that you want to update, and then click Start Full Update.

For the image icon. Search for a pdf16.gif file using Google Image search, or download from Adobe at here.

References:

http://weblogs.asp.net/jan/archive/2004/05/19/135273.aspx

http://support.microsoft.com/kb/832809/en-us

http://www.ifiltershop.com/

http://www.foxitsoftware.com/pdf/ifilter/

Default MOSS IFilters: http://technet.microsoft.com/en-us/library/cc261754.aspx

SharePoint publishing timer jobs woes

I hit a problem where the content management’s scheduling feature were not working. I am able to set the start and end publishing dates, but there’s no changes when the time comes to publish/unpublish the pages. Apparently this is due to missing timer job definition for the particular web application that is hosting the particular site collection.

The job does not exist in the first place because the web application were created without creating the publishing/collaboration site collection from the GUI. Instead, I’ve added the restored content DB that was build on another SharePoint box and added it directly into the web application. If I were to create a publishing/collaboration site collection, the site provisioning process would have added the missing three jobs for content scheduling, and two more jobs for handling variations.

Therefore, to get the jobs back on the web application, I have to:

1. Create a new web application

2. Create a new site collection, choosing the correct site collection template (either publishing or collaboration)

3. Ensure the jobs are created by checking it from Central Admin à Operations à Timer jobs definitions. Also check whether it runs every minute.

4. Remove the content db of the newly created site collection

5. Add the restored content db

Additional observations: If the existing web application with the restored content database already missing the job definitions, removing the content database and creating a new publishing/collaboration site collection on top of it WOULD NOT solve the problem. Strangely, the job definitions are created, but it just wouldn’t execute as defined by the minute frequency. Thus, best bet is to delete the web application and start all over again.

Janne Mattila’s blog has more detail on this issue.

Update: I tried to make the same steps as mentioned above on another enviornment, and it didn't work. I even tried to schedule a publishing start date for a new content page on the brand new blank collaboration site template, just to be sure. The page on the blank collaboration site works, but it just wouldn't work once I restore my deployment content DB. I've inspected the timer job status and discovered that the timer job last run date/time was stopped at the instance when I change the web application's content DB to the deployment content DB.

Long story short, I found MS KB942989 mentioning the problem of missing timer jobs, but not on timer job stop executing. However, it indicates that a post-SP1 hot fix could fix the problem. I've downloaded, applied to all WFE and index server, and that solves the problem magically!

More information on the hot fix at MS KB942989.

SharePoint Current Number of Sites 0 after SQL Restore of Content DB

I was planning to restore a content DB backup into a SharePoint box. So I’ve created the web application, removes the default content database and add the restored content DB into the web application. Once this is done, the value “Current Number of Sites” is showing up as 0.

Apparently, when adding a content DB into a web application, the SiteIDs (GUIDs) in the content DB are added into the [SharePoint_Config].[SiteMap] table. If a site with the same SiteID already exist in the SharePoint box, the add process will fail without much feedback from the Central Admin page. The logs from the 12 hive doesn’t give much indication either. The only clue you get is from the application event log. An inspection on the event log shows the following error:

Therefore, must take note that no two identical site can reside within the same SharePoint box. There might be possible to patch the SiteID for the restored content DB to another GUID value, provided you know where to patch J.

SharePoint security cache AD Group?

There seem to be a funny problem where AD group names are cached by SharePoint. So far I've observed two scenarios

Scenario 1: Unable to set AD group into MOSS security

I’ve created my own AD group and added the some users into the AD group. Then I add the AD group directly into some SharePoint subsite and granting them some permissions. This works out fine. Then I remove the AD group from SharePoint , delete the group from AD, and repeat the process again. I use back the exact same AD group name. This time, the user will not have access, as though the AD group is not added into SharePoint at all.

This problem can be fixed by performing an iisreset before re-adding the newly created AD group (with identical name as the previously deleted one) back into SharePoint. I’ll be performing “iisreset”s in the future when I’m setting up user permissions.

Scenario 2: People picker does not have the AD group

The scenario is like this: from a web part properties page, under Advnaced section, click on the browse button to bring up the people picker. Switch to find under Distribution/Security groups and perform a search. The AD groups that suppose to be around are not.

To fix this problem, just perform a full user profile import from the Shared Service Provider administration. But, there's a catch: you MUST delete all existing user profile, by viewing all existing user profile, and select all to perform the delete. Yes, painful process as there's no option to delete all existing user profile data, and it didn't work if you just perform a full user profile import directly.

Update: I've written a small console application to quickly delete all user profiles:

/*Include the following namespaces*/ using Microsoft.SharePoint; using Microsoft.SharePoint.Administration; using Microsoft.Office.Server.UserProfiles; using Microsoft.Office.Server; /*Here's the quick and dirty method*/ public void PurgeUserProfile(string url_) { using (SPSite site = new SPSite(url_)) { ServerContext context = ServerContext.GetContext(site); UserProfileManager profileManager = new UserProfileManager(context); foreach (UserProfile profile in profileManager) { System.Console.WriteLine("Deleting " + (String)profile[PropertyConstants.AccountName].Value); profileManager.RemoveUserProfile(profile.ID); } } }

SharePoint Tool Pane, where are you?

A colleague of mine are creating a new master page for an ECM site. Once all SharePoint controls were included into the new master page, we found that the tool pane (the one that shows web part properties) went off the grid, not restricted by the boundary of HTML tables etc.

After some research, it is concluded that the mater page need to include a PlaceHolder tag with an ID of “MSO_ContentDiv”. Followed by the PlaceHolder is a HTML table tag with an id of “MSO_ContentTable”. Both of these tags can be found in OOB SharePoint master pages. Once these two tags are in place, the tool pane attaches itself to the left side of this HTML table when it is summoned.

Extending SharePoint Page Layout

Found this blog entry from Janne Mattila's regarding extending page layout to include your own funky stuff. The example given are for custom language change, dynamic master page change and dynamic page layout swapping. For my case, I needed to do this to capture statistics of page hits for specific pages. Refer to here for more details.