SharePoint (and Project Server) Shenanigans

Microsoft Security Bulletin MS13-024 – Critical

Vulnerabilities in SharePoint Could Allow Elevation of Privilege (2780176)

Published: Tuesday, March 12, 2013

Executive Summary

This security update resolves four privately reported vulnerabilities in Microsoft SharePoint and Microsoft SharePoint Foundation. The most severe vulnerabilities could allow elevation of privilege if a user clicks a specially crafted URL that takes the user to a targeted SharePoint site.

This security update is rated Critical for all supported editions of Microsoft SharePoint Server 2010 and rated Important for all supported editions of Microsoft SharePoint Foundation 2010. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerabilities correcting the way that Microsoft SharePoint Server validates URLs and user input. For more information about the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

http://technet.microsoft.com/en-us/security/bulletin/ms13-024

I was recently involved in getting PerfomancePoint and the “Per User Identity” configuration working for a client running SharePoint 2010. The same configuration still holds true for SharePoint 2013, but for 2013 both PerformancePoint and Excel Services now introduce the new “EffectiveUserName” feature, which should make life a load easier.

In the world of SharePoint /PerformancePoint 2010 if you want to build an MI dashboard that shows user specific information in the reports the only way to do this effectively is to use the “Per-User Identity” option in the Data Source Connection setting, which in turn involves setting up Kerberos and specifically constrained delegation, in this article I will cover the broad steps needed.

Kerberos on Web App.

Firstly make sure that Kerberos is running on the Web App that will be hosting your PerformancePoint content, the best way to check this is in the Windows Security log, filter on 4624 events and find a logon event, make sure its a type 3 (Network) and the Process is Kerberos.

Kerberos on Target.

Make sure you have the correct SPNs registered against your target, typically with PerformancePoint this will be an SSAS cube, use SetSPN –S MSOLAPSvc.3/ServerName DomainName\SSASDomainAccount to create the SPNs, these will be key, so take your time and make sure you get them right.

Claims to Windows Token Service

PerformancePoint (along with Excel and Visio Services) relies on the C2WTS for Protocol Transition, so this must be running and configured correctly.

I would recommend running the C2WTS as a separate managed account, this account needs some specific requirements (local administrator, Logon as a service, Act as part of the operating system and Impersonate a client after authentication, set the last 3 in local security policy.)

If the C2WTS is not happy you will probably see something like the error below logged in the Windows Application log when trying to connect.

You also need to register a manual SPN for the C2TWS, something like SetSPN –S SP/C2WTS DomainName\C2WTSDomainAccount, this will allow the “delegation” tab on the user account domain object to become available.

Constrained Delegation.

This is the tricky part to get working, basically we are saying that “object A” is allowed to delegate to “service A” only in, our case it will be “object A & object B and object C”, are allowed to delegate to “Service A” in fact all the objects in the delegation chain, so to allow delegation we open our user object in AD, go to the “Delegation” tab, select “Trust this user for delegation to the specified services only” (This is setting constrained delegation)–> “Use any authentication protocol” (This is allowing protocol transition).

Use the  Add… button to find the service account for the SSAS Domain account mentioned above and select the Service Type you setup earlier.

You will probably have to perform this for your Web Application account, C2WTS account, PerformancePoint account and any other managed service account that is involved, once finished each account should have a setting like this

Remember that if the Delegation tab is not available on the user object you have to create a manual SPN.

If your data connection still refuses to connect with the “Per-User Identity setting”, have another look at the eventlog again and look for this error.

This probably means you still have an SPN missing or not configured correctly, the best way to deal with this is to install Network Monitor then run a trace while trying to connect and filter on the ‘KerberosV5’ events, and you are looking for any Kerberos error codes most likely you will see some kind of PRINCIPLE_UNKNOWN error being reported, normally associated with a user name or service account that has been missed in the constrained delegation settings.

Good luck and Happy SharePointing

So you upgraded to SharePoint Online 2013. If you are like me, you might have been looking on your SharePoint Online public site for the mobile “Contemporary view“. However, you will NOT find it. “Manage Site Feature” does not exist in a public site.

You can use the mobile Contemporary view for your SharePoint Online private site collection. First you will need to enable the feature via Site Settings > Manage Site Features > Mobile Browser View.

The right image is the standard view. The image on the left is the mobile contemporary view.

Just a quick entry.

While running a client health check I spotted an error in the Event log that I have never seen before.

Googling the Event ID and text didn’t help as I couldn’t find anything online about this.

Clearly the BlobCache on this server had become corrupted somehow, upon closer inspection the folder \287314257 was missing from the location D:\BlobCache\14, hence the error.

The fix was to disable the BlobCache from the web.config, do an IIS Reset and delete the folder D:\BlobCache then re-enable the Blobcache.

For most deployments clients want to use all the social features that SharePoint 2010 offers, but on a recent project I was working on, the client wanted all the social features disabled including.

– MySite Creation

– Use of My Profile link

– Page Personalization

– The use of ‘I Like It’ and ‘Tags & Notes’

As I have never had to do this it took a bit of googling to find all the correct settings.

Page Personalization

From CA – > Pick the Web app in question –> User Permissions

Unticking the last 2 items and the ‘Personalize this Page’ menu item is removed, but the users still have the ability to create personal views on lists and libraries, removing ‘Manage Personal Views’ will remove this option as well.

Another option to look at is ‘Edit Personal User Information’

This removes the, Edit Item and My Regional Settings from the ‘My Settings’ link, via the ‘My’ Drop down menu.

My Site & My Profile

To Remove the My Site and My Profile links go to CA –> Manage service Applications –> User Profile Service Application –> Manage User Permissions

By default all authenticated users have access to all the ‘Personal’ features, see the link below for details on the specific feature sets.

http://technet.microsoft.com/en-us/library/ee721063(v=office.14).aspx.

Personally I quite like this feature as you can decide who has access to which feature set, for example you might not want external users or partners to be able to use these features.

A point to note here is that if you disable “Use Social Features”, any of the features that you might have deployed such as the Note Board or list ratings will disappear !

Finally, to remove the SocialRibbonControl (‘I Like It’ and ‘Tags & Notes’) it can be disabled at Farm Level as it is a Farm Scoped feature

http://technet.microsoft.com/en-us/library/ee721062(v=office.14).aspx

Now we have a very short ‘My’ menu.

Happy SharePointing !