WF Error When Missing Assigned To

The Error

I recently came across some strange errors which caused me to lose a lot of time on and could not find anything on. I had a Publishing with a WF Workflow and I was getting errors like this whenever I would access my page after initiating the workflow.

Application error when access /_layouts/Workflow.aspx, Error=Object reference not set to an instance of an object. at Microsoft.SharePoint.Publishing.Internal.WorkflowUtilities.GetIsTaskAssignedToUserOrGroup(CachedWorkflowTask task, Int32 userId) at Microsoft.SharePoint.Publishing.Internal.WorkflowUtilities.GetCurrentUserApprovalTask(CachedListItem listItem) at Microsoft.SharePoint.Publishing.Internal.WorkflowUtilities.IsApprovalWorkflowTaskActiveForUser(CachedListItem listItem) at Microsoft.SharePoint.Publishing.WebControls.ConsoleNode.CurrentState(Page currentPage, Boolean cacheResult) at Microsoft.SharePoint.Publishing.WebControls.ConsoleNode.CurrentState(Page currentPage) at Microsoft.SharePoint.Publishing.WebControls.ConsoleDataSource.PopulateDataSource() atMicrosoft.SharePoint.Publishing.WebControls.XmlConsoleDataSource.PopulateDataSource() at Microsoft.SharePoint.Publishing.WebControls.ConsoleDataSource.GetHierarchicalView(String viewPath) at Microsoft.SharePoint.Publishing.WebControls.PublishingSiteActionsMenuCustomizer.OnPreRender(EventArgs e) at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

I was also seeing "unexpected" errors on SharePoint and in the logs I would find the following:

ERROR: request not found in the TrackedRequests. We might be creating and closing webs on different threads. ThreadId = 13, Free call stack = at Microsoft.SharePoint.SPRequestManager.Release(SPRequest request) at Microsoft.SharePoint.SPWeb.Invalidate() at Microsoft.SharePoint.SPWeb.Close() at Microsoft.SharePoint.SPSite.Close() at SourceCode.SharePoint.Common.SPObject.System.IDisposable.Dispose() at SourceCode.SharePoint.Workflow.Proxy.Common.GetK2IntegrationListItem(SPWorkflowActivationProperties properties) at SourceCode.SharePoint.Workflow.Proxy.MultipleTasksAndUsers.ActionK2WorkListItem(SPUser user, Boolean isFinished, String actionResult, String serialNr, String actionResponse, SPWorkflowTaskProperties afterProperties) at SourceCode.SharePoint.Workflow.Proxy.MultipleTasksAndUsers.OnTaskChanged_Event(Object sender, TaskEventArgs e) at System.Workflow.ComponentModel.Activity.RaiseGenericEvent[T](DependencyProperty dependencyEvent, Object sender, T e) at SourceCode.SharePoint.Workflow.ActivityLibrary.TaskActivity.onTaskChanged_Invoked(Object sender, ExternalDataEventArgs e) at System.Workflow.ComponentModel.Activity.RaiseGenericEvent[T](DependencyProperty dependencyEvent, Object sender, T e) at System.Workflow.Activities.HandleExternalEventActivity.RaiseEvent(Object[] args) at System.Workflow.Activities.HandleExternalEventActivity.Execute(ActivityExecutionContext executionContext) at System.Workflow.ComponentModel.ActivityExecutor`1.Execute(T activity, ActivityExecutionContext executionContext) at System.WorkflowComponentModel.ActivityExecutor`1.Execute(Activity activity, ActivityExecutionContext executionContext) at System.Workflow.ComponentModel.ActivityExecutorOperation.Run(IWorkflowCoreRuntime workflowCoreRuntime) at System.Workflow.Runtime.Scheduler.Run() at System.Workflow.Runtime.WorkflowExecutor.RunScheduler() at System.Workflow.Runtime.WorkflowExecutor.RunSome(Object ignored) at System.Workflow.Runtime.Hosting.DefaultWorkflowSchedulerService.WorkItem.Invoke(WorkflowSchedulerService service) at System.Workflow.Runtime.Hosting.DefaultWorkflowSchedulerService.QueueWorkerProcess(Object state) at System.Threading._ThreadPoolWaitCallback.WaitCallback_Context(Object state) at System.Threading.ExecutionContext.runTryCode(Object userData) at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData) at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state) at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state) at System.Threading._ThreadPoolWaitCallback.PerformWaitCallbackInternal(_ThreadPoolWaitCallback tpWaitCallBack) at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback(Object state) , Allocation call stack (if present) null

This was pretty frustrating because every time I would go to the publishing page I would get this error. However the minute that I cancel the workflow or finish by completing the tasks in the task list the error would go away and I could access the publishing page.

The Issue

I was able to narrow down the issue to the following scenario:

• I had a Site with the Publishing Feature Turned on.
• In the Pages Library I had it configured such that all content had to be approved.
• I had configured a custom WF Workflow on Pages Library configured to "Start this workflow to approve publishing a major version of an item".

The issue was that even though the workflow could be started I would only get this error if I had it configured to "Start this workflow to approve publishing a major version of an item". I manually initiated the workflow I would not get the error.

What I found out is the Assigned To field in the task was missing! Now if you have an OOB Approval workflow or do something in SharePoint Designer it is impossible to create this error. However if you are writing a custom workflow in Visual Studio and do not set the Assigned To field in the task you will get this error.

This error will ONLY occur if you are using it for a Publishing Page too. I was able to run this same workflow with the exact configuration on a MS Word document and would not receive the error. I do not know exactly what to call this menu system (below) but you will see it when using publishing pages.

Basically when you have a workflow started when a major version is published, the WF workflow will be "daisy chained" into the approve/deny workflow that is turned on when you require content approval. This menu system is validating against the Assigned To field in the Task that is associated to the running workflow instance. If the Assigned To is blank, you will get the errors above when trying to access the page.

The Resolution

Make sure to set the Assigned To field of tasks being created for your workflows.

Deploy Publishing Page and IgnoreIfAlreadyExists

For a project I was working on, I wanted to do a deployment of a SharePoint publishing page through a WSP and a Feature. I found a few blogs that assisted with me getting this started. Creating the actual Feature was not too hard but I run into a few issues.

The following is the Feature that I created.

<Feature xmlns="http://schemas.microsoft.com/sharepoint/"
         Id="64A687A4-B4DD-4742-8FE9-66191929D8BD"
         Title="ML Demo KB Publishing Page Template"
         Description="This feature will load the KB Publishing Page Template."
         Version="1.0.0.0"
         Scope="Site">
    <ElementManifests>
        <ElementManifest Location="Elements.xml"/>
        <ElementFile Location="KBArticle.aspx"/>
    </ElementManifests>
    <ActivationDependencies>
        <!--ML.Demo.KBMgt.WSS.CTypes-->
        <ActivationDependency FeatureId="15A053C6-59DB-4a14-9CB6-3DB667634493" />
    </ActivationDependencies>
</Feature>


<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
    <Module Name="KBPageLayoutsModule" Url="_catalogs/masterpage" RootWebOnly="True" Path="">
        <File Url="KBArticle.aspx" Name="KBArticle.aspx" IgnoreIfAlreadyExists="TRUE" Type="GhostableInLibrary">
            <Property Name="Title" Value="KB Article"></Property>
            <Property Name="ContentType" Value="KB Article"></Property>
            <Property Name="PublishingAssociatedContentType" Value=";#KB Article;#0x010100C568DB52D9D0A14D9B2FDCC96666E9F200
7948130EC3DB064584E219954237AF3900
242457EFB8B24247815D688C526CD44D00
DECC999E401842A08C5F380CB73E0191;#"></Property>
        </File>
    </Module>
</Elements>

In this feature I am doing several things:

• I am deploying to the Master Page Gallery because the Feature has Site scope, the Module Url is set to _catalogs/masterpage, File Type is set to GhostableInLibrary.
  
• I have a Feature dependency on another Feature that is responsible for deploying a custom content type. I could have combined these all into one Feature however I like keeping them separate.
  
• When creating the publishing page I simply created it through SharePoint Designer, I then viewed the code and copy and pasted it into an aspx within my solution in Visual Studio. I really do not want to rely on SharePoint Designer over the long term.
  
• In the File element I specify Properties which are used to set values into the columns within the Master Page Gallery library. For instance I set the title and content type association for the publishing page.
  

Remember that if you cannot use Features to do a production deployment, you should really rethink your deployment and configuration management procedures for your SharePoint environment over the long run. Otherwise your environment will become a mess of one-off solutions with no way to redeploy solutions across development, quality assurance, staging and production. In this case I know I could have simply gone into the SharePoint user interface, manually create the content type and then associate a publishing page to the content type via SharePoint Designer – however that is not really that repeatable from a deployment perspective.

The first challenge I ran into was trying to understand how the IgnoreIfAlreadyExists attributed actually worked. According to the documentation on MSDN, if IgnoreIfAlreadyExists is set to TRUE, it will suppress any errors if the file has already been loaded into the Master Page Gallery and continue uploading. I found several blogs providing incorrect information claiming that the IgnoreIfAlreadyExists does not work as intended. My experience was it works. When I did the deployment the new Publishing page does get pushed up. I say this because I would look at pages that were referencing the publishing page and the changes would be reflected. HOWEVER the deceiving thing is if you look at the entry in the Master Page Gallery, neither the time date stamp nor version will be updated making you think that the change was not applied.

Another interesting thing was if you deactivate this Feature the publishing aspx page will remain in the Master Page Gallery even if the publishing page is not being referenced anywhere. I had initially assumed SharePoint was keeping the publishing page there because it is not possible to delete a publishing page it is referenced. The only way you remove the publishing page is to create a Feature event handler for ondeactivation to delete it manually from the Master Page Gallery. Remember if you do this you can get an exception saying "This item cannot be deleted because it is still referenced by other pages" if the publishing page is being used anywhere.

Another issue I ran into was trying to update the properties of the publishing page in the Master Page Gallery. No matter what I do, if I change the file properties in the Feature, the changes would not take be visible in the Master Page Gallery. This is some related to the first issue I had. Anyways, I determined the only way to update the entry the Master Page Gallery is to put an onactivation event handlers onto the Feature.

References:

• Custom SharePoint Publishing Library
• Deploying master pages and page layouts as a feature
• IgnoreIfAlreadyExists blog
  

Publishing Site Provisioning

I recently ran into an issue with creating a site template that where I wanted to use the Publishing Feature. My end goal was to create a real site definition but I first wanted to try to create template directly in SharePoint. I quickly found out that if you have the "Office SharePoint Server Publishing" Feature turned, on the "Save site as template" will not be available. The most common solution that many suggested was to simply turn off the Publishing Feature, create the site template and then manually turn on the Pushing Feature.

However this would not work well because I am building an automated site provisioning processes using K2 blackpearl. Basically in this K2 blackpearl process I use an InfoPath form, get approval on the site request, and then dynamically generate the site with custom SharePoint groups. We are trying to drive SharePoint Governance with K2 blackpearl which will ensure that the site topology is organized well, SharePoint groups and users are managed in a repeatable process and system administrators can be less involved with creating sites. As well, I want to use customized site templates to ensure that all sites are presented in the same manner instead of being a hodge-podge mess of content. We are even going as far as adding standardized content types into the site templates with K2 workflows mapped to the content types to ensure that publication of the content always goes through a standard process.

Back to the original problem at hand – knowing that I am creating an automated process to site provisioning I cannot expect users to go in and manually turn on the Publishing Feature on the site. The options I came up with were the following:

1. Create my own site template and in the ONET.xml add a dependency to turn on the Publishing Feature.
2. Create stapling Feature that would turn on the Publishing Feature.
3. Write some code that would turn on the Publishing Feature.
4. There are more – but will stick to this for now…

Option 1 – Did not work as intended. I wanted to use the STS template. I followed best practices, created my own site template and then added <Feature FeatureId="94C94CA6-B32F-4da9-A9E3-1F3D343D7ECB" /> to the <WebFeatures> element in the onet.xml file. I also modified the <Modules> to have several custom web parts displayed on the default.aspx. Doing this made sure that the Publishing Feature was turned on when the site was provisioned by SharePoint. However the Publishing Feature would completely wipe out my home page (default.aspx) and all the changes I made to default.aspx in the onet.xml file were gone!!!

Now, if a manually create my site template and then manually turn on the Publishing Feature the default.aspx will not get wiped out. Since the Publishing Feature is being turned during the actual site creation process within SharePoint, SharePoint is allowing the Publishing Feature to take over the homepage. So this would not work for me.

Option 2 – My next solution was to create the following Site Stapling Feature:

<Feature Id="13F62CC1-22DE-4719-AA44-1BCACD9E2D50"
         Title="ML Demo KB Site Staple"
         Description="Associates publishing and content type binding to Site Template."
         Version="1.0.0.0"
         Scope="Site"
         Hidden="FALSE"
         xmlns="http://schemas.microsoft.com/sharepoint/">
    <ElementManifests>
        <ElementManifest Location="SiteStaple.xml" />
    </ElementManifests>
</Feature>

<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
    <!-- Web Publishing -->
    <FeatureSiteTemplateAssociation Id="94C94CA6-B32F-4da9-A9E3-1F3D343D7ECB" TemplateName="KB#0" />
    <!-- KB Content Type Binding -->
    <FeatureSiteTemplateAssociation Id="AD644A91-BA8B-45ff-89FD-F96BCBEDC3BD" TemplateName="KB#0" />
</Elements>

As you can see the FeatureSiteTemplateAssociation is used to turn the custom features I need, including the Publishing Feature. The result was the exact same as Option 1. Again because the Publishing Feature is being activated during SharePoint's site provisioning process the default.aspx page is being overridden.

Option 3 – My ultimate solution was to add some code into my K2 blackpearl process to activate the Feature. I was pretty happy to say to that point I had no code yet in my process – however that is just not possible some days but that is why K2 blackpearl is so great. I basically added the following lines of code into my site provisioning process and I was able to completely replicate what I was able to do manually as a user within SharePoint.

The K2 Process

Code from "Activate Site Features"

//Activate the Features...
using (SPSite site = new SPSite(K2.StringTable["SharePoint Site Collection URL"]))
{
    string webURL = K2.StringTable["KB Collaboration Site Logical Path"] + "/KB" +
        K2.ProcessInstance.DataFields["New KB Number"].Value;

    using (SPWeb web = site.OpenWeb(webURL))
    {
        SPFeatureCollection features = web.Features;

        features.Add(new Guid(K2.StringTable["Publishing Feature"]), true);
        features.Add(new Guid(K2.StringTable["Web Publishing Feature"]), true);
        features.Add(new Guid(K2.StringTable["KB Content Type Binding Feature"]), true);
    }
}

K2 blackpearl Developer Resources

I was just given some links to a really great resource for K2 Developers. Chris Geier at K2 has pulled this together and is managing it; this is great!

In it are good blog postings, K2 whitepapers, KB articles, MSDN articles, videos, etc. I still recommend getting the K2 blackpearl Professional book and use this information to supplement your learning of the K2 blackpearl Platform.

• http://www.k2underground.com/sme/k2smedeveloper.html
  
• http://www.k2underground.com/sme/LearningK2.html - K2 Resources
  
• http://www.k2underground.com/sme/MSDevelopmentResources.html - Non core technologies
  
• http://www.k2underground.com/sme/InfoPathResources.html - InfoPath Resources
  
• http://www.k2underground.com/sme/SharePointResources.html - SharePoint Resources
  

K2 blackpearl Kerberos Configuration

1 - Introduction

Recently I went through another Kerberos configuration and I promised myself after going it I would write something about it. I have had to do Kerberos configurations several times and it seems that every time I do it something changes. Luckily it is not just me who has this experience so I do not feel too bad.

I am not a security expert nor am I a network engineer. There are tons of blogs and articles that explain Kerberos however I am going to try to make this simple. When installing K2 or MOSS you may need to configure Kerberos to get around authentication issues associated an account's credentials being passed between applications that reside on different physical servers. For example:

• Application A is on Server A.
• Application B is on Server B.
• A user logs into Application A on Server A and needs to use Application B services that are on Server B.
• Application A needs to pass the user's credentials from Server A to Server B so that Application B can authenticate against that account without requiring another login.

Kerberos is required to resolve the issue commonly referred to as the "double hop" issue. If you ever see errors like "NT AUTHORITY/ANONYMOUS LOGON" or "401 - Access Denied" you are experiencing an issue that can be resolved by configuring Kerberos authentication. When receiving an error like this, what is happening is Application A does not have permission to delegate user credentials to Application B which resides on Server B. Because there is no permission to delegate permissions from one machine to another, Application B subsequently defaults to using an anonymous login which is not sufficient for most applications.

To resolve this issue a level of trust needs to be created such that service accounts are trusted to pass a user's credentials from one machine to another.

• First, a combination of service type and machine, and service account will be registered with the domain controller.
• Second, a service account will then be given permission to pass user credentials to a specified registration (service type, machine, and service account).

In the case of K2, Kerberos authentication is always required once the K2 topology becomes dispersed across multiple servers. A common scenario is when SharePoint and K2 are not installed on the same physical servers.

Setting up Kerberos authentication should not be confused with Single Sign-On (SSO). SSO is used for storage of multiple username and passwords and then allowing the user to only log in once. Since all of the credential information is stored centrally then a broker will use those stored credentials to log the user into another application without having them to type in a different username and password. This is typically used so that the user does not have to remember multiple username and passwords to access systems.

In following sections I will discuss setting up Kerberos for K2 blackpearl. In part two of this series I will discuss Kerberos considerations for SharePoint. Setting up Kerberos authentication in a SharePoint environment is considered to be a best practice and provides better security than NTLM. It is also common to have to configure Kerberos with SharePoint when working with SQL Reporting services (SSRS).

2 - K2 and Kerberos

As mentioned before, you will need to set up Kerberos authentication for K2 when it is distributed across many servers. The major components are that can be distributed are:

• The K2 Host Server
• SQL Server
• SharePoint
• SQL Reporting Services
• K2 Workspace web site

The K2 Getting Starting documentation is really good. A good portion of the following documentation comes from it however I have re-organized it a little and identified a few gaps.

2.1 - K2 and SQL Server

It is possible to have K2 blackpearl and SQL Server sitting on different machines and not require Kerberos authentication. The K2 Service account needs to have access to the access to SQL Server to access the various K2 databases; that is it.

2.2 - K2 Host Server

In the K2 Getting Started instructions, it states that you will need to run the following commands:

• setspn -A K2Server/MachineName:5252 domain\K2 Service Account
• setspn -A K2Server/MachineName.FQDN:5252 domain\K2 Service Account
• setspn -A K2HostServer/MachineName:5555 domain\K2 Service Account
• setspn -A K2HostServer/MachineName.FQDN:5555 domain\K2 Service Account

You will need to run these commands regardless of how you plan to distribute your K2 environment.

To verify the spn commands you ran:

• setspn -L domain\K2 Service Account

This command states which machines the K2 Services Account can delegate from. It is good to run this periodically so you do not get lost while doing this.

The following picture shows the following Kerberos delegations that could be required based on the distribution of the K2 environment. The numbers correspond to sections below.

2.3 - K2 and SharePoint

A common scenario is that K2 Host Server and the SharePoint server will not reside on the same machine. If that is the case the following commands need to executed.

• setspn -A HTTP/MachineName domain\SharePoint Service Account
• setspn -A HTTP/MachineName.FQDN domain\SharePoint Service Account

Notes:

• The MachineName is the name of the server where SharePoint resides. If there is an alias for the SharePoint site the MachineName will be the DNS entry. If you have multiple web front end servers (WFEs) in the SharePoint farm that are load balanced it is not required to run the above commands for each physical machine. For example if the SharePoint DNS entry is http://mymossfarm/, then the setspn command would be HTTP/mymossfarm. Make sure that this name is configured in DNS as an A Record and NOT an alias (CName).
• The SharePoint Service Account refers to the service account for the application pool that SharePoint is running under.

Now that the spn has been set up for the SharePoint WFE we need to:

• Go to Administrative Tools >> Active Directory Users and Computers.
• Search for the SharePoint Service Account, open properties, go to the Delegation tab, and select the "Trust this user for delegation to specified services only" option. Then select the "User Kerberos only" option.
  
  
• Press the add button, search for the K2 Service Account and select both the K2Server and K2HostServer Service Types. These were created in section 2.2.
• Click ok and ok again.
• Finally you will need to go to Central Admin of SharePoint >> Application Management >> Authentication Providers. Then in the default zone you will set the IIS Authentication Settings to use "Negotiate (Kerberos)". You will need to do an IIS reset for the changes to take effect.

In the delegation tab, what we basically did was say that the SharePoint Service Account is allowed to delegate credentials to the K2 Service Account only. Hopefully that can simplifies your understanding of what is going on.

You may be wondering why you had to do all of this. If you do not, K2 commands that are generated from SharePoint will not be trusted by the K2 Host Server. For instance the K2 task list web part, a web service call from web enabled InfoPath, etc. will not be trusted by the K2 Host Server. If you were to run the K2 Service from command line and not do any of the configurations above you would see a bunch of "NT AUTHORITY/ANONYMOUS LOGON" errors.

Debugging Note - There can be no duplicate SPN entries created. Uniqueness is defined by the combination of service and machine name. Examples of a service to this point are K2Server, K2HostServer and HTTP. A common mistake is to set up SPNs for the same service and machine with multiple service accounts. You will not receive an error when using the setspn command however Kerberos will not work if this is done. Some tools are discussed later that will help uncover these sort of issues.

Unusual Error – I had a painful experienced recently when configuring a K2 environment. We had followed all of the instructions correctly but we were still getting "NT AUTHORITY/ANONYMOUS LOGON" errors when watching the K2 Host Server via command line. Our solution was to select the "Use any authentication protocol" option instead of the "User Kerberos only" option in the Delegation tab. We lost days trying to figure this issue; unknowingly thinking that the only valid option was to select "User Kerberos only".

When doing some research on this option I found that the "Use any authentication protocol" option, meant that "the account can use the protocol transition extension to obtain a service ticket enables it to obtain service tickets to a pre-configured subset of kerberized services". I needed some more clarification and a colleague of mine (Jason Montgomery) sent me the following, "For Kerberos to function, a user's computer needs to be able to contact the Key Distribution Center (KDC) directly in order to get a Ticket to pass along to the Web Site they would like to authenticate with. If the user is outside the network and doesn't have network access to the KDC (Domain Controller), Protocol Transition allows the user to authenticate using any windows authentication protocol (Client Certificates, Forms Auth, Token, proprietary, etc). Once the user has authenticated, the Protocol Transition Extension allows the Service to retrieve a Ticket from the KDC on behalf of a user to itself. From this point on, the Service will be to properly pass the users ticket along to other tiers where required allowing the system to function as designed." He further explained "In your case having Protocol Transition setup didn't work because the Service needs first authenticate the user then call LsaLogonUser or use WindowsIdentity to obtain the token using the S4USelf extension (i suspect they are using the normal Kerberos proxy delegation or S4UProxy extension). If the K2 Service doesn't use the S4USelf extension during Auth then configuring K2 to use Protocol Transition will always fail". That was much lower that I had expected to go, however my tip is sometimes if Kerberos is still not working, try changing the Kerberos delegation to use the "Use any authentication protocol" option.

2.4 - K2 and K2 Workspace

When K2 and the K2 Workspace are placed on different servers, Kerberos authentication will need to be configured between the K2 Workspace and the K2 Host Server. In many cases I personally tend to keep the K2 Workspaces on the same machine as the K2 Host Server. The reason being is that the K2 Workspace is typically only opened up to a few power users and administrators. It is full of a ton of administrative functionality and I typically equate it to Central Administration for SharePoint.

Before continuing note that many occasions I have seen the same account used for both the K2 Service and the K2 Workspace Service. It is still required that you set up an SPN because delegation is going across physical servers and that is why Kerberos is required.

• If you have not done section 2.2; complete that first.
• setspn -A HTTP/MachineName domain\K2 Workspace Service Account
• setspn -A HTTP/MachineName.FQDN domain\K2 Workspace Service Account
• Go to Administrative Tools >> Active Directory Users and Computers.
• Now search for the K2 Workspace Service Account, open properties, go to the Delegation tab, and select the "Trust this user for delegation to specified services only" option. Then select the "User Kerberos only" option.
• Press the add button, search for the K2 Service Account and select both the K2Server and K2HostServer Service Types.
• Click ok and ok again.

We have now given the K2 Workspace Service Account permission to pass user credentials to K2 Service Account. Otherwise you will get a bunch of 401 errors in the K2 Workspace web site.

2.4.1 K2 Workspace IIS Metabase

Next you need to update the IIS Metabase. The changes will be made to IIS in order to allow Kerberos authentication for the K2 Workspace web site.

• Open IIS Manager.
• Right click the top node and select properties.
• Check the Enable Direct Metabase Edit checkbox.
• Click ok a few times and finish.
• Get the K2 Workspace Site Identifies from the IIS Manager. Click on top node and in right main window, there will be a Site Identifier number. That number will be used in the following commands.
• Open a command line window and cd C:\Inetpub\AdminScripts
• Next you need for force IIS to use Kerberos instead of NTML. Run the following commands
• cscript adsutil.vbs set w3svc/NTAuthenticationProviders "Negotiate,NTLM"
• cscript adsutil.vbs set w3svc/Site Identifier/NTAuthenticationProviders "Negotiate,NTLM"

2.5 – SharePoint and K2 Workspace

If SharePoint and the K2 Workspace are not on the same server, Kerberos authentication needs to be set up such that the SharePoint Service Account and delegate to the RuntimeServices web services that are hosted within the K2 workspace.

• You must set up the SPN that were described in section 2.3.
• At a minimum make sure to complete the first three bullets on Section 2.4 (even if both K2 Host Server and the K2 Workspace are on the same machine.
• Go to Administrative Tools >> Active Directory Users and Computers.
• Now search for the SharePoint Service Account, open properties, go to the Delegation tab, and select the "Trust this user for delegation to specified services only" option. Then select the "User Kerberos only" option.
• Press the add button, search for the K2 Workspace Service Account and select the HTTP Service Type.
• Click ok and ok again.

2.6 - K2 and SSRS

Another common scenario is that SSRS will already be installed somewhere. The following configurations are required.

Note - This can be avoided by installing SSRS on the machine where the K2 Host Server resides. This is possible because SSRS is a web site can be installed anywhere. Be warned, that if you do this, you will need to pay another SQL Server License because Microsoft deems this as another install of SQL Server.

2.6.1 SSRS to K2

The Reporting Services Service Account is the account which the SSRS web site runs under in the IIS Application Pool. This is needed to ensure that the account that being used to access a report is verified against the K2 Host server. For instance if K2 SmartObject Data Provider is used in a SSRS report, the account needs pass the K2 Host Server.

Complete the following:

• If you have not done section 2.2; complete that first.
• setspn -A HTTP/MachineName domain\Reporting Services Service Account
• setspn -A HTTP/MachineName.FQDN domain\Reporting Services Service Account
• Go to Administrative Tools >> Active Directory Users and Computers.
• Now search for the SSRS Service Account, open properties, go to the Delegation tab, and select the "Trust this user for delegation to specified services only" option. Then select the "User Kerberos only" option.
• Press the add button, search for the K2 Service Account and select only the K2HostServer Service Type.
• Click ok and ok again.

2.6.2 K2 to SSRS

Another thing you will need to do is to allow the K2 Host Server service account to schedule SSRS reports. Now the K2 Host Server needs to be able to delegate to the SSRS Service Account. You will not need to run any spn commands because you have then all done at this point. You need to do the following:

• Search for the K2 Service Account, open properties, go to the Delegation tab, and select the "Trust this user for delegation to specified services only" option. Then select the "User Kerberos only" option.
• Press the add button, search for the SSRS Service Account and select the HTTP Service Type.
• Click ok and ok again.

2.6.3 - K2 Workspace to SSRS

To add one more wrinkle to this, if you have the K2 Workspace and SSRS sitting on different servers, you need to allow the K2 Workspace to delegate use credentials to SSRS. This is because SSRS reports are embedded directly into the K2 Workspace.

• If you have not done section 2.4; complete that first.
• At a minimum, complete the first three bullets of 2.6.1.
• Go to Administrative Tools >> Active Directory Users and Computers.
• Search for the K2 Workspace Service Account, open properties. On the Delegation tab both "Trust this user for delegation to specified services only" and "User Kerberos only" options should already be selected.
• Press the add button, search for the SSRS Service Account and select only the HTTP Service Type.
• Click ok and ok again.

2.6.4 SSRS IIS Metabase

Next you need to update the IIS Metabase. The changes will be made to IIS in order to allow Kerberos authentication for the SSRS web site.

• Open IIS Manager.
• Right click the top node and select properties.
• Check the Enable Direct Metabase Edit checkbox.
• Click ok a few times and finish
• Get the SSRS Site Identifies from the IIS Manager. Click on top node and in right main window, there will be a Site Identifier number. That number will be used in the following commands.
• Open a command line window and cd C:\Inetpub\AdminScripts
• Next you need for force IIS to use Kerberos instead of NTML. Run the following commands
• cscript adsutil.vbs set w3svc/NTAuthenticationProviders "Negotiate,NTLM"
• cscript adsutil.vbs set w3svc/Site Identifier/NTAuthenticationProviders "Negotiate,NTLM"

5 - Still Having Issues - Kerberos Configuration Tool

Download this tool; this helped me out tremendously after going through the Kerberos configuration and validating if I had set up everything correctly. It took a little bit to get the hang but it works great.

You only need to install it on one machine in the farm. What you can do is modify the parameters and it will tell you if there are any issues with Kerberos authentication between machines.

Some other tools that were recommended to me which I have not used are ldifde.exe and spnquery.vbs.

6 - Recommendations

My recommendation is place the K2 Host Server, K2 Workspace and SSRS on the same machine. SharePoint should be installed on its own dedicated environment. The SSRS install is only created to support K2 SSRS reports. This will only require you to complete sections 2.2, 2.3 and 2.5.

7 - References

• Download Support Tools – this will allow you to run the setspn command.
• How the Kerberos Version 5 Authentication Protocol Works – very in dept and not for the faint of heart J
• Kerberos Configuration Tool - Here is the tool I referenced above.
• http://msdn.microsoft.com/en-us/magazine/cc188757.aspx
• http://technet.microsoft.com/en-us/library/cc738207.aspx

8 - Credits

I also had some reviewers which helped me out.

• Jason Montgomery – K2 Insider
• Blake Carrigan – K2 Support Consultant
  

April 2009 K2 User Group

Update 4/16/2009 - here is the recorded presentation.

All,

I will be making a presentation to the K2 User Group on Tuesday April 14^th from 11am to 1pm central US time. Below is information for attending via LiveMeeting.

I will be making a presentation on how to do document management with SharePoint and K2 with no code. This is a demo that I have given a few times and really demonstrates the power of the wizards within K2 to some really effective business processing. The information below says that the demo is on blackpoint, however it is all built on blackpearl. However since it is a no code implementation, it can be done completely on blackpoint…

---------------------------------------

Phillip Knight from Merit Energy will be hosting the K2 user group meetings at Merit Energy, located at 13727 Noel Road, 2nd Floor Conference room, Tower 2, Dallas, Texas 75240. Parking information is included in the linked map below. Remote attendance information is included at the bottom of this message.

Link to map: http://www.meritenergy.com/content/MeritMap.pdf. Reminder: Merit Energy is on the 5^th floor, but the meeting will be held in a 2^nd floor conference room. Once off the elevator, go to the reception area and we will bring you back to the conference room.

Please RSVP to me via email
whether you are attending via live meeting or if you will be attending in person (so that we can plan for the number of people to order food for).

Check out the K2 Underground site and our user group at http://k2underground.com/k2/InterestGroupHome.aspx?IntGroupID=11. We are posting webexes/live meetings from our meetings at this site.

5/12/2009 11am – 1pm
06/9/2009 11am – 1pm
07/14/2009 11am – 1pm
08/11/2009 11am – 1pm
09/8/2009 11am – 1pm

Meeting Agenda:
11-11:15 Networking/Refreshments
11:15-11:30 Announcements/Intros of New people
11:30-11:45 Tips & Tricks
11:45-12:45 Technical Presentation
12:45-1:00 Meeting Wrap up

The Announcements section of the meeting will include any information regarding K2 upcoming events and user group events as well as brief introductions of our presenter and refreshment provider.

The Tips & Tricks Presentation is when we as members can pose questions to each other on projects that we are working on and having difficulty with. It is also a time when if we have learned something that we feel will be helpful to others, we can share it with the group. Bring yours to share/ask.

Meeting Presentation & Company:

We thank Jason Apergis from MicroLink for
presenting at our April K2 user group meeting. Jason will be demonstrating a K2 BlackPoint document management workflow with no code that contains InfoPath, site creation, permission management, topology management, site templates, content types, sharepoint integrated workflow for word documents, document metadata updating, emails, etc.

Founded in 1998, MicroLink provides Business Intelligence, Information Discovery, Portals, and Collaboration solutions. MicroLink has a history of providing reliable, high quality, customer-driven solutions that focus on improving productivity, collaboration, and teamwork throughout our customers' enterprise. With a reputation for consistent, superior performance, and outstanding work in the public sector and commercial organizations MicroLink has earned the respect of its clients, partners, and employees. In recognition of this dedication, MicroLink has received the following awards; 2007 Autonomy Global Partner of the Year, 2008 Microsoft Federal Repeatable Solutions Award, 2007 Microsoft Federal Partner of the Year, and the 2007 and 2006 Microsoft DoD Partner of the Year, IBM Cognos client award for Excellence in the Public Sector 2008.

Meeting Presenters:

Jason Apergis is a coauthor on the recent WROX Professional K2 BlackPearl book that was released. He authored the chapter on InfoPath, SmartObjects and Deployments. Jason is also a K2 Insider. He currently works for MicroLink LLC as a Solution Architect focusing on MOSS and Business Process Automation solutions. Over the past four years Jason has done a lot of work with K2.net integrating it with BizTalk, SharePoint 2003/2007, InfoPath, ASP.net, SSIS, mainframes and other non-MS technologies. One of the solutions was nominated for a Microsoft Partner of the Year solution in 2006. Jason is a Virginia Tech alumni completing both his undergrad and masters in Information Technology. He plays ice hockey on a regular basis and is a huge Washington Capitals fan.

Meeting Sponsor:

We thank Jason Moseley from Hitachi Consulting for sponsoring our refreshments at our April meeting. Hitachi is a Microsoft Gold Certified Partner with a full range of business solutions and services for strategy and organization effectiveness, business intelligence and performance management, customer and channel (including CRM) and strategic technologies (including IT architecture and SOA).

Hitachi Consulting is widely recognized leader in delivering practical, value-based business strategies and technology solutions. From business strategy development through application deployment, we are committed to helping clients quickly realize measurable business value and achieve sustainable ROI.

For more information please contact Jason Moseley, Senior Manager Hitachi Consulting (amoseley@hitachiconsulting.com, 972-768-2789)

For Virtual Attendees:

Note: please keep your phone on mute until you are ready to speak.

Audio Information

Telephone conferencing
Choose one of the following:

 Start Live Meeting client, and then in Voice & Video pane under Join Audio options, click Call Me. The conferencing service will call you at the number you specify. (Recommended)

 Use the information below to connect:
Toll: +1 (719) 867-1571

Toll-free: +1 (877) 860-3058

Participant code: 914421

First Time Users:

To save time before the meeting, check your system to make sure it is ready to use Microsoft Office Live Meeting.
Troubleshooting
Unable to join the meeting? Follow these steps:

Copy this address and paste it into your web browser:

1. https://www.livemeeting.com/cc/scna1/join?id=KZ3QJJ&role=attend&pw=7%21j%27mJ%28%7BP

2. Copy and paste the required information:

Meeting ID: KZ3QJJ

Entry Code: 7!j'mJ({P
Location: https://www119.livemeeting.com/cc/scna

If you would like to provide refreshments at an upcoming meeting or present at an upcoming meeting, please contact me.

Our next meeting announcement will be sent out next Tuesday.

Let me know if you have any questions prior to the meeting.

What is SharePoint Governance?

1 Introduction

One of the most challenging things with SharePoint is not user adoption; far from it. From what we have seen with SharePoint is that enjoys extremely high adoption however with most implementations of SharePoint tend to grow at an uncontrolled pace. From an IT perspective, it is reminiscent of file share. Tons of sites, more sub sites, upon sub sites and upon sub sites of content. Clients come back every time saying, we love SharePoint but we have issues. In most cases it is not having governance and program management to support SharePoint. SharePoint is not like other server products out there that IT departments purchase or support. It is not like PeopleSoft, SAP, SQL Server, whatever else that is out there. SharePoint allows everyday users to freely create and store content. If not managed or configured correctly such that SharePoint does not align itself with the goals and objectives of the organization it will grow in an uncontrolled rate.

The following are reasons why governance should be established:

• Improve information reliability, availability, and security.
• Address how information is shared, used and analyzed internally and externally.

2 What is Governance?

Governance is the combination of people, policies and processes that an organization leverages to achieve a desired outcome. There needs to be a measurable outcome that the organization expects to achieve through governance to obtain a desired result. To accomplish this there must be adoption by both stakeholders and users. To have high adoption the right people must be selected to craft policies and then SharePoint stakeholders must given a clear understanding of how to meet these policies.

To create these policies executive, financial, IT, department leads, compliance, development and information workers need to be selected. It is extremely important to pick people who share the common vision and work together to achieve a common goal. Once policies have been created, heavy handed enforcements are not needed. Instead policies can be enforced with education, training and communications plans. Training needs to be geared specifically to targeted audiences and cannot be in the form of a onetime push of information. Still even with training a minimal level of enforcement will be required and processes will have to be created to enforce policies. Processes can be executed through system automation or manually. Finally a governing body is needed to measure performance and continually update policy based on the evolving workplace. What should be put in place is a governance process that is scalable and flexible to meeting the demands of the business.

3 SharePoint Governance

The following is Microsoft's definition of how governance should be implemented with SharePoint (http://technet.microsoft.com/en-us/library/cc263356.aspx). Every enterprise is unique and should determine the best way to implement its own governance plan. The following are suggested stages of a governance implementation:

• Determine initial principles and goals: The governance body should initially develop a governance vision, policies, and standards that can be measured to track compliance and to quantify the benefit to the enterprise. For example, at this stage, the initial corporate metadata taxonomy could be determined along with the initial IT service offerings. The initial principles, goals, and standards should be published and publicized.
• Develop an education strategy: The governance policies that you determine must be publicized to your enterprise, and you should have ongoing education and training plans. Note that this includes training in the use of Office SharePoint Server and training in the governance standards and practices. For example, your IT department could maintain a frequently asked questions (FAQ) page on its Web site to respond to questions about its Office SharePoint Server service offerings. Your business division could provide online training that describes the implementation and use of the document management system in the enterprise.
• Develop an ongoing plan: Because successful governance should be ongoing, the governance body should meet regularly. Ongoing activities include incorporating new requirements in the governance plan or reevaluating and adjusting governing principles or standards. Conflicts may need to be resolved as competing needs arise, such as between your IT department and one or more business divisions. Your governance body should report regularly to its executive sponsors to promote accountability and to help enforce compliance across the enterprise. Keep in mind that, although this sounds laborious, the goal is to increase the return on your investment in Office SharePoint Server, maximize the usefulness of your Office SharePoint Server solution, and increase the productivity of your enterprise.

Highlighting the last sentence of this is extremely important. What should remember is that this is not easy and that organizations should plan on understanding SharePoint governance before they start.

4 What does a SharePoint Environment without Governance?

Here are just a few things I have seen:

• Site administrator and contributors are not sufficiently trained nor did many have strong information architecture backgrounds.
• No governing body that understands how to use SharePoint to solve business problems.
• No consistency in the way content is presented across SharePoint.
• Roles and responsibilities have not been officially defined.
• Management and staff do not always understand the level of effort involved in building and managing a SharePoint site.
• Site topology is not actively managed.
• There is clear line between what is considered intranet, extranet, and public content.
• Islands of information are created in the form of SharePoint lists and not managed as enterprise business data. This analogous to having Excel and Access manage enterprise business data.
• Custom solution development, deployment and maintenance standards were never created.
• Content databases growth is uncontrolled.
• No content development and integration.
• No document discovery and impossible to find a document. Search is not always the solution.
• Myriad of web documents stored all over the place.
• No document retention and retirement.
• Content security is uncontrolled and impossible to manage accounts.

The challenge that we have seen with the purchase of SharePoint is that sometimes it is positioned as an out of the box silver bullet solution when in fact SharePoint is a platform for creating solutions. Much of the out of the box functionality of SharePoint can be used to solve many business needs. SharePoint empowers every day business users with the ability to create web based solutions that can be highly integrated with Microsoft Office. This is why we have seen such high adoption of SharePoint and why Microsoft is making significant investments into the technology. However SharePoint commonly runs into problems where business users are not properly trained to create solutions nor given parameters in which they should work within. This is why governance has become a predominant issue with many organizations that have implemented SharePoint.

5 SharePoint with Governance

Creating a governance structure could possibly bring:

• Reliable and available content.
• Business processes that are built around the web content management.
• Information management focusing on identifying owners of high-valued data.
• Secure information.
• Meets business objectives.
• Complies with policies and regulations.
• Carbon footprint reduced.
• Useful taxonomy and metadata management.
• Site topology matches the organization.
• Managed expectations (audience, staff, and executives).
• Roles and responsibilities identified.
• Site continuity.
• Processes to review site statistics to improve user experience and make most popular content readily available.
• Continuous improvement of Search by reviewing search statistics.
• Codified policies and procedures (management, planning, design).
• Process within the PMO to identify opportunities where SharePoint should be used in the enterprise architecture.
• Configuration Management policies for SharePoint.
• Change management business processes.

As you can see, SharePoint governance is not just about managing SharePoint for a system standpoint, it also provide guidance the users of SharePoint.

All of these things can be prioritized and driven by the SharePoint Governance team. To support this team you need:

• Business users and power users who are supportive of SharePoint.
• Systems analysts who are devoted to supporting SharePoint.
• Developers who create custom functionality.
• Systems administrators who manage the SharePoint farms.
• Technical leadership who understand how to translate business requests into SharePoint solutions.
• Business directors who can position SharePoint.

Once governance team is put together, they can continually manage and improve SharePoint as it evolves with the organization.

6 References

• Implementing SOA Governance - http://www.infoq.com/articles/implementing-soa-governance
• Governance Resource Center for SharePoint Server 2007 - http://technet.microsoft.com/en-us/office/sharepointserver/bb507202.aspx
• What is governance? - http://technet.microsoft.com/en-us/library/cc263356.aspx