Single sign on SharePoint with Azure

Single Sign On (SSO) with Azure AD and SharePoint Server

Version 1.0

Contents

1.      Prerequisite 
2.      Overview
3.      Azure AD with Enterprise application
     3.1    Steps to add SharePoint on premises application
     3.2    Configure Azure AD SSO:
4.      SharePoint on-premises Single Sign-On Configurations
     4.1    Configure Identity Provider
     4.2    Activate Identity Provider SharePoint On Premises
5.      Test SSO Configurations
     5.1     Unit Test

We are going integrate SharePoint On premises with Azure AD using Claims(Claims outputs provided by any 3rd party). we will cover Authentication of users from Azure AD groups too.

1.     Prerequisite
   To enable bridge between Azure AD and On premises SharePoint you need have following items already configured.
   a.       Azure Subscription
   b.      SharePoint server any version
   c.       Azure AD users synced or non-synced 
2.     Overview
   This configuration consists of two main platforms.
   1.       Azure AD with enterprise application
   2.       SharePoint 2010 server identity provider
   
   
   We have to configure Azure AD in such a way so SharePoint can be accessed via Azure AD users and enable SSO experience for SharePoint by authenticating users from Azure AD.
   First, we will configure azure with SAML base authentication and will add users to provide access to this newly created azure application for SSO. You can configure these users later but its compulsory step.
   Second, we will configure SharePoint on premises server in such a way so it can communicate with Azure AD by creating Claim base authentication.
   
   
3.     Azure AD with Enterprise application
    First login to Azure Portal using this URL: https://portal.azure.com/
   To connect SharePoint on premises with Azure AD first we have to add SharePoint on premises application from gallery to our application list.

1. 
   
   
   
   
   
   
   

     3.1 Steps to add SharePoint on premises application

1: From the left navigation of Azure portal click Azure Active Directory Icon.

2: Click Enterprise Applications and then select All Applications.

   Select All applications:

         

3: Add new application by clicking on New Application Button just beside columns button.

        4: In add from gallery search box type “SharePoint On premises” Just click on this                     application and provide name to this application if you want to change name by default           name “SharePoint on-premises” then click add.

    3.2 Configure Azure AD SSO:

    1: Just after completion of app creation navigate to Single Sign-on as showing in following       image:

       2: Select Single Sign-on Method SAML

      3: Set up Single Sign-On with SAML screen, click Edit icon to open Basic SAML                        Configuration dialog. In this page enter SharePoint on premises configurations.

      4: On the basic SAML configuration screen, do the following steps

a: Identifier (Entity ID) in this text box type URL with this pattern urn:sharepoint:federation for example urn:sharepoint:OnPremisiseSharePointUrl.com i.e.

b: Reply URL in this text box type URL with this pattern: https://<YourSharePointServerURL>/_trust/default.aspx

For example https://OnPremisiseSharePointUrl.com/_trust/default.aspx

c: Sign-on URL in this text box, type a URL using the following pattern:

https://<YourSharePointServerURL>/_trust/default.aspx

For example https://OnPremisiseSharePointUrl.com/_trust/default.aspx

Note for Point b and c:

It should be with https not http else our redirection to SharePoint site will not work and URL should contain /_trust/ why we are using this, will discuss during SharePoint identity provider configuration steps.

After these configurations save this screen and back to Set up Sign-On with SAML Screen.

5: The screen we discussed at point 3 should be in front of you. From the SAML Signing Certificate portion download the Certificate (Base64). We will be using this certificate during SharePoint on premises server configuration.

6: From portion 4 copy these values save some in notepad.

Note: Login URL you will get will be like this: https://login.microsoftonline.com/638dc12b-863f-4882-a2f8-a3f6d9cli75v/saml2 just replace saml2 with wsfed and save this final URL in your personal notepad file. Final URL should be like this: https://login.microsoftonline.com/638dc12b-863f-4882-a2f8-a3f6d9cli75v/wsfed

7: Before leaving Azure Portal you should have following items in your system:

          i: Base64 Certificate downloaded at point 5.

         ii: Entity Identifier value set at point 4 sub point a.

        iii: Login and Logout URL discussed at point 6.

4:   SharePoint on-premises Single Sign-On Configurations

In following configurations, we will configure SharePoint on premises environment to create Identity provider to communicate with Azure AD.

4.1 Configure Identity Provider

1: Login to Server where you have installed SharePoint.

2: Configure new Trusted Identity Provider in SharePoint Server using the following PowerShell script:

                Just update three values in this script then happy to execute script$realm = 'urn:sharepoint:onPremisesSharePointWebUrl.com'

$wsfedurl= 'https://login.microsoftonline.com/638dc12b-863f-4882-a2f8-a3f6d9cli75v/wsfed'

$filepath= 'C:/temp/SharePoint SSO.cer'

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($filepath)New-SPTrustedRootAuthority -Name "AzureSSOPortal" -Certificate $cert

$map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" -IncomingClaimTypeDisplayName "name" -LocalClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"

$map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" -IncomingClaimTypeDisplayName "GivenName" -SameAsIncoming

$map3 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" -IncomingClaimTypeDisplayName "SurName" -SameAsIncoming

$map4 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "Email" -SameAsIncoming

$map5 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming

$ap = New-SPTrustedIdentityTokenIssuer -Name "AzureAD" -Description "SharePoint secured by AzureSSOPortal" -realm $realm -ImportTrustCertificate $cert -ClaimsMappings $map,$map2,$map3,$map4,$map5 -SignInUrl $wsfedurl -IdentifierClaim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"

$realm in this variable put entity identifier value copied from Azure.

$wsfedurl in this variable put login URL copied from Azure don’t forget to replace saml with wsfed.

$filepath give path where you have pasted Base64 certificated downloaded from Azure.

3: Sometimes by default Claim providers are not enabled in SharePoint for this you have to run following script:

           $setcba = Get-SPWebApplication "http://OnPremisesSharePointWebApplicationURL.com/"

$setcba.UseClaimsAuthentication = 1;

$setcba.Update()

 4.2 Activate Identity Provider SharePoint On Premises

1: In Central Administration, navigate to Manage Web Application and select the web application that you wish to secure with Azure AD.

2: In the ribbon, click Authentication Providers and choose the zone that you wish to use.

3: Select Trusted Identity provider and select the identify provider you just registered named AzureAD.

4: On the sign-in page URL setting, select Custom sign in page and provide the value “/_trust/”.

5: Click OK.

Note: “/_trust/” we are using this so we can redirect to Microsoft Login page as we defined in Azure SSO configuration.

Now final Step
Go to: IIS-> Web application -> Authentication -> Enable Anonymous Authentication & Forms Authentication and Disable windows Authentication on all servers for this specific web application.  

5: Test SSO Configurations

In our scenario because users are synced with Azure AD so we don’t have to create manual user in Azure AD. Just go to SharePoint web application where you have applied Identity provider then navigate to Permission policy and add user as per Azure AD user and give controls you want to give.
In alternative mapping select your web application and add same http url with https with default zone.

After this just visit web application it will redirect you to Microsoft Login enter your credentials and enjoy.

          Microsoft Login Page should appear with following parameters
1: In your URL there should be your tenant ID 638dc12b-863f-4882-a2f8-a3f6d9cli75v
2: URN entity identifier should be there in URL which shows our redirection is fine.

If you unable to login please use following step:
1: Enter your credentials as per the user defined in Azure AD. If user failed to login on the same screen it will give you four values Request ID, Correlation ID, Time Stamp and Message Error.

Just copy these values and paste on azure portal test application screen.

Note for future Blogs:
1: In People Picker all users and groups will be resolved it can be solved by developing Custom Claims Provider.
Follow this link to fetch users and groups from Azure AD:
https://sharepointenvironment.blogspot.com/2019/08/sharepoint-on-premises-people-picker.html

2: To Resolve audience issue UPS should be synced with Claims provider i will write blog on this.

3: To revert changes back to windows authentication first remove trust integration by vising CA-> Web applications -> Select Web application and uncheck the trust provider then save. After this run this script:
  $setcba = Get-SPWebApplication "http://OnPremisesSharePointWebApplicationURL.com/"
  $setcba.UseClaimsAuthentication = 0;
  $setcba.Update()

4: Sign Out and Sign in as a different URL can be set using IIS using Rewrite URL will write Blog on this.

5: Custom Claims Provider integration with Graph API will write Blog on this.
Follow this link to integrate Graph API:
https://sharepointenvironment.blogspot.com/2019/08/sharepoint-on-premises-people-picker.html

6: Add new claims in current Claims will write blog on this soon.

If you need any assistance please feel free to comment i will resolve your problem. Thanks for reading.

Step by Step implementation pf Repository Pattern using C# for Beginners

Design Pattern:
         Create a pattern for your code so it can be reusable and with well maintained code. So easy to add new modules without writing too much code.

Repository Pattern:
Basic Purpose of design pattern is to have separation between Business Logic and DB calls.
Advantages:
1: Easily testable business Logic
2: Application works on API calls
3: All modules have API so it can easily integrate able with any other platforms.
4: Maximum implementation OOP concepts like Templates, Interfaces and Inheritance.

Implementation of Repository Patterns step by step:

2 step:

3rd step:

4th step:

5th step:

6th step:

7th step:

8th step:

9th step:

10th step:

11 step:

12th step:

13th step:

14th step:

15th step:

16th step:

17th step:

18th step:

19th step:

Further Implementation projects:

Common Project

1: Create folder APIResponse

2: Add 3 classes as per the image

3: Install Nuget package of Json.net in common project

4: Add AppConstant class as per the image

5: Add HttpHelper class and add below functions one function to get data and second for post

   public static List<T> DownloadSerializedJsonViaGET<T>(string url) where T : new()

        {

            using (var client = new WebClient())

            {

                try

                {

                    client.Encoding = Encoding.UTF8;

                    client.Headers[HttpRequestHeader.ContentType] = AppConstant.ContentType;

                    client.Headers[HttpRequestHeader.Accept] = AppConstant.ContentType;

                    string jsonData = client.DownloadString(url);

                    var response = JsonConvert.DeserializeObject<List<T>>(jsonData);

                    ResponseList<T> responseForCurrentObject = new ResponseList<T>();

                    responseForCurrentObject.data = response;

                    responseForCurrentObject.Message = "Successful Transaction";

                    return responseForCurrentObject.data;

                }

                catch (WebException exception)

                {

                    #region EXCEPTION HANDLING

                    var errorResponseText = "";

                    if (exception.Response != null)

                    {

                        var responseStream = exception.Response.GetResponseStream(); // Get API error and show as message

                        if (responseStream != null)

                        {

                            using (var reader = new StreamReader(responseStream))

                            {

                                errorResponseText = reader.ReadToEnd();

                            }

                        }

                    }

                    return JsonConvert.DeserializeObject<List<T>>(errorResponseText);

                    #endregion

                }

            }

        }

        public static Response<T> DownloadSerializedJsonViaPOST<T>(string url, object data, string method = "POST") where T : new()

        {

            using (var client = new WebClient())

            {

                try

                {

                    client.Encoding = Encoding.UTF8;

                    client.Headers[HttpRequestHeader.ContentType] = AppConstant.ContentType;

                    client.Headers[HttpRequestHeader.Accept] = AppConstant.ContentType;

                    var obj = JsonConvert.SerializeObject(data);

                    string jsonData = client.UploadString(url, method, obj);

                    var response = JsonConvert.DeserializeObject<T>(jsonData);

                    Response<T> responseForCurrentObject = new Response<T>();

                    responseForCurrentObject.data = response;

                    return responseForCurrentObject;

                }

                catch (WebException exception)

                {

                    #region EXCEPTION HANDLING

                    var errorResponseText = "";

                    if (exception.Response != null)

                    {

                        var responseStream = exception.Response.GetResponseStream(); // Get API error and show as message

                        if (responseStream != null)

                        {

                            using (var reader = new StreamReader(responseStream))

                            {

                                errorResponseText = reader.ReadToEnd();

                            }

                        }

                    }

                    return JsonConvert.DeserializeObject<Response<T>>(errorResponseText);

                    #endregion

                }

            }

        }

Service Project

1: Add two folder one for interface and second for implementation

 2: Implementation of interfaces

Web Project 

1: Call service function in your web project

API Project

1: Install nuget package AutoMapper in your api project

2: Do basic configuration for Mapper. (Auto Mapper is for to map input entities with db context entities)

3: Create Folder DTO in Common project 

4: Copy entities from Model and paste in UserDTO class

5: Use auto mapper as per the below image in your API project controller:

In case of any query feel free to reach me. Thanks for reading the blog. 

Algorithm we study How Microsoft Implemented in SharePoint?

SharePoint have allot of other functionalities i already explained in this blog: SharePoint 2013 Other Functionalities

Now we are going to discuss 3rd Functionality of SharePoint Indexing and Search.

3: Indexing and Search:

Searching option in SharePoint is very efficient to search anything like Document, Username, Site etc. SharePoint provides you ability to search from unstructured and structured content. Structured content means content with primary key save in SQL db. unstructured means without primary key. Search option not only bound to search only connected db you may access data from external AD server and you can configure this search from GUI of SharePoint.

Scenario:
When user enter any word to search how SharePoint search work?

Mechanism:
It depends on your technical person who implemented SharePoint in your organization how much access he have assigned you. Like when you enter word to search it checks boundaries like it should be at site level, document level or at list level etc.

You can also set priority level , if specific group of users enter word first search at site level they have access if not found start traversing to other sites. It also enhance the search performance.

SharePoint Search options:

• If you chose specific option, it have their on scope:
• Search Center: The ability to restrict searching to a site, site collection, to a rule
• Web Parts: Providing various search functionality. 
• Best Bets: Allows targeting of data based on a keyword and synonyms. 
• Advanced Search: Provides more control over the information they are looking for.
•  Refinements: This is a new feature in SharePoint for search, provides drill down of data using tags and metadata. Examples of this is content type, location, author and metadata tags.

Thanks for your time. Your Comments will be highly appreciated.

Business Workflows in SharePoint

1: Content Management explained in this Blog (Content Management).

How its 3 Tier Architecture?
Business workflow is main pillar of SharePoint to automate operations of your Business. As we know 3 tier have Presentation tier, Business Logic tier and Database tier. Business logic mean Logic as per your business for this Microsoft introduced Business workflows in SharePoint.

Lest discus another functionality of SharePoint.

2: Business Workflows?

Lets break this word between workflows and Business workflows.

• What is Workflow?

Workflow is an automatic process which trigger after specific condition. For example company with 5000 employees have attendance machine after month end during payroll process it gets attendance from machine and calculate salary of each employee if you have to do it manually how much time you need? allot of man power requires to do this and you can't give salary on same day.

 For this purpose you just have to configure workflow for first time by applying different checks. I explained a very simple workflow for your understanding but you can handle complex scenarios using workflows in SharePoint Like Procurement etc.

• Business Workflows:

Now combine these words Business Workflows. In workflow explanation we have created a generic workflow will work for all companies.

Now Business workflow, automation according to your business. Like your company deduct 2% of your salary if you get late and 4% if you get off without leave but if you have non avail leaves automatically minus from leaves, not % deduction from your salary.

Advantages Of SharePoint Workflows:

• You don't need to write code for workflows, SharePoint (Nintex workflow) gives you graphical representation to automate your business.
• If you have to write code you needs month to do this but using Workflow you can automate process in day. 

3rd Functionality is Best thing of SharePoint 2013 You will love it.

Thanks for your time. Your suggestions and queries will be highly appreciated. Thanks.

Final Year Project Ideas in SharePoint.

Don't worry by reading these names, things are very easy just study once. If you are looking for to select FYP you may develop any of this module using any technology. Like Content Management System, Business Workflows etc.

SharePoint Functionalities:

SharePoint is Combination of these given fields:

1: Content Management System

2: Business Workflows

3: Indexing and Search

4: Enterprise Integration & Collaboration

5: Business Intelligence

6: Portals

1: Content Management System:

SharePoint as Content Management System, CMS have these basic functionalities so you will get these all in SharePoint.

As per my this blog SharePoint As Document Management System i have explained regarding Document Management System but SharePoint not only save documents but also any kind of Content like pdf, Excel, images, HTML etc. So SharePoint is Content Management System. SharePoint have all these above functionalities create content of any type then measure quality, storage space etc then develop means save this content, optimize if created content is working efficiently or not. Deliver this content to production. Manage this content to control visibility or other operations like Create, Update or Delete Permissions. In future if you need to update this content you can do it easily.

You can also integrate workflows with these operations to perform specific task on specific conditions. 

2: Business Workflows

Thanks for your time. If you will have any query feel free to comment here. Thanks

SharePoint in simple Language?

SharePoint?

SharePoint can make your organization paperless.  

Whenever you want to start working on SharePoint, first question comes in mind what SharePoint is? then you search Internet says Its a Document Management, collaboration etc yes right. But explanation required:

Scenario:
First i will describe a scenario For example you have a company and you win a project. Then you find specific persons, have skills at specific technology. You choose 5 persons for this job, after that emails and documents start floating. After sometime no one have idea about document Version, everyone think they have latest and updated document. You create specific folders in your system to save these documents. Huge bundle of documents saved in your system. In future if you want to search specific document, it becomes panic for everyone to get updated version.

Problems:
1: Search specific skills set person.
2: Documents Updated version for everyone.
3: Documents Searching
4: Usage of Disk space of your system.

Solution:
So then Microsoft introduced SharePoint how to utilize SharePoint to solve these problems.
For this scenario Just create a new site.
1: Create Document Library add concerns persons in this site and give rights to upload documents.
SharePoint will do automatically versioning with last modified date and modified by.
2: Title search is by default available and its very efficient.
3: SharePoint will get those users who are available in your SharePoint Server(Active Directory).
4: You don't need to worry about Disk Usage Space or security issue it will be on cloud or server.

Conclusion:
According to our above discussion do you know what we have learned?
We have learned SharePoint Document Management System and collaboration in SharePoint. Now time to give your precious time to your family. Thanks

Thanks for your precious time. If you will have any query feel free to comment here.

What you should know before Development of SharePoint?

Although Architecture for SharePoint to access list or file of Document Library define in this image:

but in code you have to access first site then Open web.

Get SharePoint List Using C# code:

In this tutorial we will learn how to get Document Library files by traversing SharePoint Architecture.

SharePoint Architecture to access any list:

SecurityPrevillages-> Site(ByProvidingURL) ->Web -> List (like DocumentLaibrary) -> Get Files under Document Library

Steps:

1: Create Console Application using C# etc then add this library "using Microsoft.SharePoint".

2: Get the path of site which library files you want access in your code like (string baseUrl = "http://sp2013:81/sites/sis/";)

3:  Security Check if you are running this utility on same server where SharePoint is deployed. Get Security check by adding this line SPSecurity.RunWithElevatedPrivileges(delegate() {  //YourCOde });

4: Then Get site where you want some changes or want to get something from existing applications like Document Library.

5: Get all uploaded documents on document library by passing library name as a parameter in   SPDocumentLibrary lib = (SPDocumentLibrary)web.Lists[LaibraryName];

6: using Lib.RootFolder to get all files existing in this folder.

This is Generic Function written in C# to access all documents from a specific Library:

public static bool getAllDocuments(String LaibraryName)
{
Console.WriteLine("getAllDocuments debug, START");
bool isOK = false;
string baseUrl = "http://sp2013:81/sites/sis/";
try
{
SPSecurity.RunWithElevatedPrivileges(delegate()
{
using (SPSite site = new SPSite(baseUrl))
{
using (SPWeb web = site.OpenWeb())
{

SPDocumentLibrary lib = (SPDocumentLibrary)web.Lists[LaibraryName]; //Get All documents with name
//SPDocumentLibrary lib = (SPDocumentLibrary)web.Lists["Client Incoming Correspondence"]; //Get All documents with name

IEnumerable<SPFile> allFiles = ExploreFolder(lib.RootFolder);
foreach (SPFile file in allFiles)
{
Console.WriteLine("getAllDocuments debug, File Name : " + file.GetType());
string filename = file.Name;
Console.WriteLine("getAllDocuments debug, File CharSetName : " + file.CharSetName);
Console.WriteLine("getAllDocuments debug, File SourceLeafName : " + file.Title);
string strFileExtension = new FileInfo(file.Name).Extension;
string strFileUrl = file.Url;
Console.WriteLine("strFileUrl : " + strFileUrl);

}

}
}
});
}
catch (Exception e)
{
Console.WriteLine("getAllDocuments debug, " + e.Message);
isOK = true;
}
Console.WriteLine("getAllDocuments debug, END");
return isOK;
}

By using this approach you can access any list. Thanks for reading this blog if you need any help feel free to comment here. Thanks