NOTE: Please note that unless it’s stated, this article provides overview of SharePoint Online Standard for Office 365 Enterprise Customers. I personally think, this is most common deployment model for SharePoint Online for Enterprises.

If you are experienced On-Premise SharePoint 2010 Architect and just getting into Office 365 and SharePoint Online, this article will provide high level overview and basic differences between On-Premise SharePoint implementation vs SharePoint Online features in Office 365. Since Office 365 and SharePoint online are ever-changing landscape, I will try my best to update this article as Microsoft release more updates in future.

Although you can visit my compilation of Office 365 and SharePoint 2010 resources, following three resources are most important for any one wants get up to speed with SharePoint Online. I personally think, these are must have resources for any SharePoint Online Architects.

• Office 365 for Enterprise Service Descriptions – http://www.microsoft.com/download/en/details.aspx?id=13602
• Office 365 for Dedicated Subscription Plans – http://www.microsoft.com/download/en/details.aspx?id=18128
• Phil Wicklund’s Microsoft SharePoint 2010: Deploying Cloud-Based Solutions Book- http://www.amazon.com/Microsoft-SharePoint-2010-Cloud-Based-Organizations/dp/073566210X (Read my review on Amazon for this brilliant resource)

Office 365 and SharePoint Online Overview

• Office 365 can be licensed in one of the three models – for professionals & small businesses, for midsized businesses & enterprises, and for education, Education model is free.
• SharePoint Online comes in 2 flavors – Standard and Dedicated
• SharePoint Online Standard Plans in Office 365
  • SharePoint Online features in enterprise licenses
    • E1 => Basic Collaboration Portal, Office Web Apps for View Only
    • E2 => E1 + Office Web Apps for Edit
    • E3 => E2 + Advanced SharePoint Services like Excel, Access, Visio, and Forms, Office Professional Plus
  • SharePoint Online Standalone Plans
    • SharePoint Online Standalone Plan 1 included in E1 and E2
    • SharePoint Online Standalone Plan 2 included in E3 and E4 – Same as E3 minus Office Web Apps for Edit
• Software and Hardware Requirements
  • See Microsoft SharePoint Online for Enterprises – Service Description for Browser & Desktop Client Software Requirements by each Operating System – Page 9-10 on March 2012 Update
• Tools – Microsoft Office 365 Desktop Setup
  • Free Office desktop setup tool is required for all workstations that use rich Office clients like Outlook, Word, or Excel to access documents from Office 365. It would also automatically configure Outlook and Microsoft Lync to use with Office 365.
  • It is important to note that this tool is not an authentication or single sign-in service.
• Microsoft Office Support
  • 2007 – Excel, Outlook, PowerPoint, Word
  • 2010 – Access, Excel, InfoPath, Outlook, OneNote, PowerPoint, SharePoint Designer, Word, SharePoint Workspace, Project Professional
• SLA
  • 99.9% uptime guarantee
  • SPO Data backed up every 12 hours and retained for 14 days
  • 6 hours RTO – recovery time objective, resume service within 6 hours after service disruption
  • 1 hour RPO – recovery point objective, restore copy of data that is less than 1 hr old

SharePoint Online Storage Guidelines and Software Boundaries for Enterprise Tenant

• Max storage allowed per tenant – 25 TB per tenant
• Allocated Storage (pooled)
  • Applies to all the Site Collections per tenant
  • Initial Storage – 10 GB base customer storage + 500 MB per E1-E4 user license/internal user + No additional storage for external user (e.g. an organization with 1000 internal users and 200 external users by default would have (1000×500) + (200×0) = 500,000 MB = 500 GB + 10 GB = 510 GB initial storage)
  • Additional storage available at a cost per GB per Month, No minimal purchase limitation – $0.20 USD/GB/month
• Minimum Users – 50
• Maximum Number of AD Users – 500,000 AD Objects
• External Users (PALs – Partner Access Licenses) – 50 PALs included per tenant, Current feature preview allows for upto 1000 external users but MS may charge for additional PALs beyond 50 in future Update
• Site Collection storage quota  – 24 MB initial, Maximum allowed up to 100 GB Per site collection
• My Site storage quota – 500 MB per my site, this can’t be adjusted, this does not count towards tenant’s overall storage pool
• Sandbox resource quota – 300 + 200 per number of licensed user seats. e.g. 25 seat licensed environment, server resource quota is 300 + (200×25) = 5,300, This is fixed, can’t be purchased additional resource quota.
• # of Site Collections Per Tenant – 300 Non-My Site Site Collections
• File Upload Limit – 250 MB per file

Authentication and User Management

• Anonymous Users for public sites
• Cloud based Identity – Office 365 Accounts (@onmicrosoft.com)
  • Only global administrator or user management administrator role can managed users
  • Manually create users in Office 365. These accounts will have @[mycompanyName].onmicrosoft.com format
  • Creating Users, office 365 would assign random passwords for each users. User must change their password after they login to Office 365 very first time.
• Identity federation with on-premises Active Directory domain
  • Either register your domain with Office 365 or Use @[mycompanyName].onmicrosoft.com domain
  • Use Active Directory Synchronization (DirSync) Tool to crawl your domain and creates copies of users in Office 365
  • AD synchronization simply replicate users and provisions copies on on-premise  identities in MS Online’s User Store. It doesn’t synchronize passwords and by default, it doesn’t accommodate  single sign on. Users has simply two accounts, two passwords, and the federated identity is simply mapped to the on premise identity.
  • To accommodate single sign on, you can configure ADFS 2.0 server and proxy in your domain and configure Active Directory Federation trust with Microsoft ADFS 2.0 server to federate identities with the Office 365 federation gateway and facilitate single sign on for on premise users. Federated identity is not used for authentication, Authentication takes place on trusted  on-premised identity provider. Exchange Online and Lync Online requires local identity to attach mail boxes.
  • DirSync can only Synchronize a Single Forest. If you have more than 1 forest in your AD, you need to pick the forest with your user accounts or plans on a forest consolidation.
• External Sharing Identities
  • This Site Collection Level  Feature enables company to invite external users to view, share, and collaborate on their sites
  • MS Supports invited external users sign in using MS Online ID services like Windows Live ID including @live.com, @hotmail.com, or @msn.com, Once external user receive their invitation from SharePoint Online, they have to login to the SPO either using Hotmail or MS Online Service ID.
  • External users can use their business email address as long as their email user name associated with Live ID system.

Authorization, Security Groups, Security Roles, and Site Membership

• Security Groups in SharePoint Online
  • Office 365 Global Security Groups
    • These groups created by global administrator
    • If you have many users and if they need to have permissions across more than one SharePoint Online Site Collection, this is preferred method.
    • On premise AD groups can be mapped to the Global Security Groups when AD synchronization is configured. Group membership for Synchronized groups will be updated every 3 hours
  • SharePoint Online Groups
    • Same as On-Premise SharePoint
• Security Roles in SharePoint Online
  • Office 365 Global Administrator
  • SharePoint Online Service Administrator – Office 365 Global Administrator with SharePoint Online License
  • Site Collection Level Role – Site Collection Administrator
  • Site Level Roles – Site Owners, Site Contributors, Site Visitors

SharePoint Online Features Overview

• SharePoint Online Administration
  • Allows you to create Private Site Collection under two managed paths – sites and teams. Custom managed paths are not allowed in SharePoint Online.
  • Allows you to specify Storage and Resource Quota per Site Collection.
  • SharePoint Online doesn’t support customers to use of Windows PowerShell for service administration.
  • SharePoint Online comes with pre-defined list of blocked files. You can’t manage list of blocked file types.
• URL Naming
  • URL structure for SPO sites is based on name of your company provided during sign up. This name can’t be changed. e.g. if your company domain name is contoso, URL would be – https://contoso.sharepoint.com
  • Vanity URLs are not supported for intranet zone sites or SPO private site collection.
  • You can register domain and apply Vanity URLs to your SPO public web sites.
• Single Signon from Browser
  • IE automatically configures SPO sites as trusted sites when users install the service connector. After users singing with the Office 365 application, they will not be prompted for their username & password again when they visit SharePoint Online Sites – Admin, My Site, and Main Root Site Collection
  • Other browsers like Firefox or Chrome would prompt username & password for SPO sites
• Service Applications Partitioned for Each Tenant
  • Secure Store Service
  • Business Data Connectivity Service for WCF Connectors
  • Managed Metadata Service
  • Search Service
• Communities
  • Supported capabilities are My Sites, My Profile,  Ask me About, Status Updates, Recent Activities, Colleague Suggestions, Enterprise Wikis, Blogs, Newsfeed, Note Board, Organization Browser, Content Tagging, Tag Cloud, Tag Profiles, Ratings, Comments, I Like It
  • Profiles are either created when new user is created from Office 365 UI or during profile import from Active Directory.
  • You can brand My Site Host and Individual user My Sites with Custom Sandbox Solutions. It is important to note that when users provisions their My Site first time, it would take default branding based on OOB My Site template. User must upload Sandbox solutions to apply branding to their My Sites. Individual end-users can use SharePoint Designer to update branding on case by case basis as well. This should be avoided.
• Composites
  • Supports methods of customizations and development are Browser Customization, BCS connection to external data sources via WCF endpoint, Sandbox Solutions using Server
    Side Object Model, Access Databases in Access Service, No Code Solutions using SharePoint Designer 2010 including workflows, List & Library InfoPath Forms including Sandbox Solutions with InfoPath Code, Silverlight, JavaScript Client Object Model, jQuery Integration, and Content Editor & Content Query Web Parts
  • Fully trusted Farm Level Solutions are not supported in SharePoint Online Standard. Only dedicated version allows fully trusted solutions with proper code review.
  • BCS in SharePoint Online allows connection to external data sources via WCF endpoint in both read-write manner, It doesn’t support direct connection to SQL Azure (WCF endpoint is required)
  • Although Access Services is supported in SPO, Access reporting is not supported because SSRS is not available for SharePoint Online. Access reporting requires SSRS.
  • SharePoint Online doesn’t allow publishing InfoPath forms that require full trust or farm level deployment.
  • Developer Dashboard is not available in SharePoint Online for customers.
• Content
  • Supported capabilities are Document Libraries, Browser Based Document Editing, Managed Metadata Service, Document Sets, Document Center Site Template, Metadata Driven Navigation, Unique Document ID Service, Shared Content Types across multiple Site Collections, Content Organizer
  • SharePoint Online doesn’t support Record Management, Records Center Site Template, and Information Rights management
  • SharePoint Online doesn’t support Word Automation Services and Open XML SDK
  • SharePoint Online doesn’t support WCM publishing approval Workflow along with Variations for Internet sites. These features are available only for Private Site Collection and Intranet environment.
  • Managed Metadata Service provides multiple taxonomies and folksonomies from tenant-level Term Store service. All Site Collections would share same term store. SharePoint Online service administrator can delegate Term Store management from SPO Admins page.
  • SharePoint Online does not support auditing capabilities to log the opening and downloading of files in document library.
  • Enterprise Content Types across multiple site collections can be created from http://{rootsitecollectionUrl}/sites/contenttypehub
• Insights
  • Supported capabilities are Excel Services with REST-based APIs, KPI Web parts, and Visio Services
  • SharePoint Online doesn’t support Performance Point Services
  • SharePoint Online doesn’t support Power Pivot for SharePoint and Excel
  • SharePoint Online doesn’t support Business Intelligence Center Site Template, Chart Web Parts, and Data Connection Libraries
• Search
  • Supported capabilities are Basic and Enterprise Search Center Site Templates, Metadata Driven Refinement, Phonetic Search, People & Expertise  Search, Documents View In Browser, Best Bets, Site Collection level Search Scopes
  • SharePoint Online supports only Enterprise Search, It doesn’t support FAST Search including Thumbnails & Previews, Deep refinement, Relevancy tuning, Visual Best Bets
  • By default, Search Service is partitioned and enabled for each tenant. Enterprise Search just works without any additional configuration required by tenant. By default, all the content is indexable and searchable. You can configure content is not searchable at the document library or list level, not site level.
  • No administrative access to the Search Service Application, You can’t create additional tenant level Content Sources, Search Scopes, Crawl Rules etc.
  • SharePoint Online only supports site collection level Search Scopes
  • SharePoint Online doesn’t support Federated Search
  • SharePoint Online supports search across all site collections, irrespective of which site collection content resides in. Microsoft already provides default enterprise search center site. You can access talent level default Search Center from http://{rootsitecollectionUrl}/search
  • SharePoint Online Standard doesn’t support indexing content outside of SharePoint.
  • Indexing occurs automatically every 5 minutes. SharePoint Online Crawler setting is to crawl content every 5 minutes.
  • SharePoint Online include PDF iFilter. PDF documents and content with PDF files will be picked up and included in main Search Index, PDF files open in Adobe PDF software.
• Sites
  • SharePoint Online supports most of all capabilities from Sites area including Lists, Libraries, Large List scalabilities, Web Parts, MUI, Security Permissions Management, Audience Targeting, and Site Templates
  • Web Analytics Service is not supported in SharePoint Online.
• Office Web Apps
  • Office Web Apps are included part of SharePoint Online as an preconfigured service to access and view Word, Excel, PowerPoint, and One Notes documents. This is by default available for all the users with SPO licenses
  • Office Web App License is required to Edit Word, Excel, PowerPoint, and One Notes from the browser.
  • Users with Office Web App License can create new Office documents via the Office Web Apps in conjunction with associated document library content types and do not have Office installed on the desktop.
• Public Site
  • Office 365 customers can create only 1 simple public web site per tenancy. Once it’s created, customers can apply a Vanity URL by registering additional domain.
  • Public site does not use SharePoint Publishing Portal framework. These features are supported only for Intranet Sites to brand Intranet Sites with master page framework in private site collections.
  • Public Web Site is configured by built-in Site Designer Ribbon Tool.
  • SharePoint Designer 2010 can’t be used to edit public web site. SPD 2010 can be used to edit only private site collection sites.
• Recycle Bin Capabilities
  • Items supported – Site Collections, Sites, Lists, Libraries, Folders, List Items, Documents, Web Part Pages
  • Site & Site Collection Recycle Bin capability works same as On-Premise for Lists, Libraries, Folder, List Items, Documents, and Web Part Pages Restore
  • Site Collection Recycle Bin capability works same as On-Premise Sites Restore from Site Collection Administration Section
  • New SharePoint Online Tenant specific capability – Tenant level Recycle Bin to restore Site Collection from SPO Admin Page

As I come across more resources and great online articles, I am planning to maintain this list over the time. Please bookmark this article and hopefully it would provide one stop for all Office 365 resources for SharePoint Architects.

Plans & Pricing

• Office 365 Home -  http://www.microsoft.com/en-us/office365
• SharePoint Online Plans – http://www.microsoft.com/en-us/office365/sharepoint-online.aspx#fbid=S-Zm_I32oBi
• Office 365 Plans – http://www.microsoft.com/en-us/office365/all-plans.aspx#fbid=S-Zm_I32oBi
• SharePoint Online Plans Compared to Office 365 – http://g.microsoftonline.com/0BXPS00EN/1182
• Office 365 Deployment Readiness Tool – http://community.office365.com/en-us/f/183/p/2285/8155.aspx

Microsoft Resources

• MSDN SharePoint Online Developer Resource Center – http://msdn.microsoft.com/en-us/sharepoint/gg153540.aspx
• TechNet SharePoint Online Administration Center – http://technet.microsoft.com/en-us/sharepoint/gg144571.aspx
• SharePoint Online End User Resources – http://office.microsoft.com/en-us/sharepoint-help/sharepoint-online-for-office-365-for-enterprises-FX102052854.aspx
• Office 365 TechNet Library – http://technet.microsoft.com/en-us/library/hh852576.aspx
• Office 365 TechNet Library - Deployment Guide for Enterprises – http://technet.microsoft.com/en-us/library/hh852466.aspx
• Office 365 Developer Training Course – http://msdn.microsoft.com/en-us/Office365TrainingCourse
• Office 365 ITPro Videos – http://technet.microsoft.com/en-us/edge/office-365-jump-start-01-microsoft-office-365-overview-for-it-pros
• Power User – SharePoint Online for enterprises Help and How-to – http://office.microsoft.com/en-us/sharepoint-online-enterprise-help/?CTT=97

Office 365 Updates & Office 365 Community

• Office 365 Community – http://community.office365.com/en-us/default.aspx
• Office 365 – SharePoint Online blogs – http://community.office365.com/en-us/b/office_365_technical_blog/archive/tags/SharePoint+Online/default.aspx
• Office 365 Technical Blog – http://community.office365.com/en-us/b/office_365_technical_blog/default.aspx
• Office 365 Service Updates – http://community.office365.com/en-us/w/office_365_service_updates/974.aspx
• Feb 2012 – SPO Update – http://community.office365.com/en-us/b/office_365_technical_blog/archive/2012/02/21/sharepoint-online-service-update.aspx

Microsoft Downloads

• Office 365 Downloads – http://www.microsoft.com/download/en/office-365.aspx?q=office+365
• Office 365 for Enterprise Service Descriptions – http://www.microsoft.com/download/en/details.aspx?id=13602
• Office 365 for Dedicated Subscription Plans – http://www.microsoft.com/download/en/details.aspx?id=18128
• Office 365 Deployment Guide for Enterprises – http://www.microsoft.com/download/en/details.aspx?id=26509
• SharePoint Online for Office 365: Developer Guide – http://www.microsoft.com/download/en/details.aspx?id=17069
• Hybrid SharePoint Environments with Office 365 – http://www.microsoft.com/download/en/details.aspx?id=27580
• Security in Office 365 White Paper – http://www.microsoft.com/download/en/details.aspx?id=26552
• Office 365 Single Sign-On with AD FS 2.0 whitepaper – http://www.microsoft.com/download/en/details.aspx?id=28971
• Office 365 Developer Training Kit – June 2011 Update – http://www.microsoft.com/download/en/details.aspx?id=14889

Great Articles

• SharePoint Online planning guide for Office 365 for enterprises – http://office.microsoft.com/en-us/sharepoint-online-enterprise-help/sharepoint-online-planning-guide-for-office-365-for-enterprises-HA101988931.aspx
• SharePoint Online: software boundaries and limits – http://office.microsoft.com/en-us/sharepoint-online-enterprise-help/sharepoint-online-software-boundaries-and-limits-HA102694293.aspx
• Introduction to Business Connectivity Services in SharePoint Online – http://msdn.microsoft.com/en-us/library/hh412217.aspx
• SharePoint Online: An Overview for Developers – http://msdn.microsoft.com/en-us/library/gg317460.aspx
• Customizing SharePoint Online Using SharePoint Designer 2010 – http://msdn.microsoft.com/en-us/library/gg454744.aspx
• Migrating Content Between SharePoint Online Site collections – http://blogs.msdn.com/b/microsoft_cloud/archive/2012/03/11/migrating-content-between-sharepoint-online-site-collections.aspx
• Fabian’s Excellent Article Series on BCS & SharePoint Online – http://www.sharepointfabian.com/blog/Lists/Posts/Post.aspx?List=a4668dd2%2D4dac%2D4cce%2Dbaf0%2Dddb1ea4f2d5e&ID=214
• Sharing SharePoint Online Site with External Users – http://office.microsoft.com/en-us/sharepoint-online-enterprise-help/share-a-site-with-external-users-HA102476183.aspx

In theory, this code should work but it seems like SharePoint doesn’t work same for WCF and Console Application.

After spending couple of hours troubleshooting usual service accounts settings, WCF services configuration, security permissions checks, and Google search, finally I stumbled upon MSDN Blog and KB article written in 2005 for WSS 2.o SP2.

• http://blogs.msdn.com/b/mpoulson/archive/2005/12/02/499504.aspx
• http://support.microsoft.com/default.aspx?scid=kb;EN-US;909455

Basically these articles suggests that even though accounts might have enough permission to execute code, explicit impersonation is required to make successful SharePoint actions. Apparently this kind of impersonation requires even at the sites, lists, and document libraries level.

After wrapping up my site collections provisioning code with impersonation, I was able to successfully execute code in the WCF service.

using System.Security.Principal
....
WindowsImpersonationContext wic = WindowsIdentity.GetCurrent().Impersonate();
//implement OM code here
wic.Undo();

I was really surprised that ages old articles helped me to resolve SharePoint 2010 programmatic issues without much explanation by KB article. Since farm account has sufficient rights to perform farm level operations, it simply doesn’t make sense to explicitly impersonate with farm account again in code. I am still trying to figure out what exactly required impersonation, what exactly enhanced security in framework means, and why farm account explicit impersonation required even though WCF service was running under same account which has full privileges to perform farm level actions. My search for correct explanation continues.

Hope this really helps someone. It took me while to figure it out and stumble upon correct solution or I should rather say, peculiar situation.

His webinar motivated to write detailed article on my experience and high level items needs to be considered while designing and implementing SharePoint 2010 extranets. Hopefully this article would provide general checklist & guidelines require to design SharePoint 2010 extranets.

Understand Extranet Type based on Business Requirements & Usage Scenarios

• Define the User Personas - Employees, Partners, Vendors/Customers
• Externally Available Intranets or Collaborative Sites for Employees without requiring logging into VPN or Corporate Network – Extranets for Remote Employees
• Typically extranets are platform shared with external users such as partners, vendors, and customers
  • Shared Collaborative environment with Partners or Customers – External facing Team Sites (e.g. Customer Portal, Partner Portal)
  • Internet facing read only documents, wiki sites, or shared collaboration environment – Publishing Feature (e.g. Marketing Sites, School Portal, Blogs & Discussion Forums)

Typical Extranet Project/Implementation Team

• Part-time involvement from IT Teams – Infrastructure Team, Security Team, Network Team
• Ideal Full-time Project Team – Product Owner, Business Analyst/Project Manager, SharePoint Architect, SharePoint Administrator, More than 1 SharePoint Developer, SharePoint Quality Assurance, User Experience Architect

Infrastructure Considerations

• Core SharePoint Infrastructure & Network Topology – UAG, Firewalls, DMZ, Servers, Network, DNS, Databases, SAN
• Extranet Network Topology
  • Typically decides where would be SharePoint Servers located – In corporate network or DMZ
  • Typically decides high level SharePoint Server Topology and SharePoint Architecture
  • Topologies to Consider – Edge Firewall Topology, Back-to-Back Firewall Topology, or Split Back-to-Back Firewall Topology – e.g. Configure UAG in DMG to protect extranet farm hosted in corporate farm using Edge Firewall Topology
• Server and Farm Topology
  • Single Farm vs. Multiple Farms
    • Do you really require separate farm? – Impact on licensing, hardware, security, physical data separation etc.
    • Options are Single farm with same sites serving both intranet and extranet (e.g. Same Web Application serving both intranet/extranet in Single Farm), different sites for intranet or extranet environment (e.g. Multiple Web Applications in serving both intranet/extranet in Single Farm), or Multiple farms for physical separation (e.g. Multiple Web Applications serving intranet and extranet in different Farm)
  • SharePoint Farm Architecture – Web Front Ends, App Servers, DB Servers
    • Hardware vs. Software Load Balancer for Web Front Ends
    • Install SSL certificate on SharePoint web application
  • Cross-Farm Infrastructure for Multiple Farms
    • Shared SharePoint Services – User Profiles Service, Search Service, Managed Metadata Service etc.
  • Virtualization, High Availability,  Backup-Restore Approach, and Disaster Recovery
  • Global Availability and Latency – WAN Acceleration with Central Farm vs. Global Farms in Multiple Locations with Data/Documents Replications

Security and Identity Management Considerations

• Identity Management System
  • Internal and External Accounts should be in separate identity management system.
  • Understand Types of Users
    • Internal Users – in most cases, it’s AD
    • Extranet System Managed Users – AD, ADLDS, SQL, LADAP
    • Extranet System Federated Users – ADFS
    • Extranet System Open ID or Social System Users – Live ID, Google, Facebook, Twitter, LinkedIn etc.
  • Sample Configurations
    • Single AD with Same OU or Multiple OU for both Internal and External Accounts – Windows Authentication is sufficient
    • Multiple AD with Two-way Trust for both internal and External Accounts – Windows Authentication is sufficient
    • Multiple AD with Single-way Trust for both internal and External Accounts  – Requires Claims & LDAP FBA
    • AD for Internal Users and ADLDS FBA for external Accounts  -  Requires Claims based authentication
    • AD for Internal Users and SQL/ASP.NET FBA for external Accounts  – Requires Claims based authentication
    • AD for Internal Users and ADFS (Web based SSO federation) for external Accounts – Requires Claims based authentication
    • AD for Internal Users and Windows Live ID for external Accounts – Requires Claims based authentication
• Authentication – Account/Identity Management
  • It is important to note that SharePoint doesn’t perform Authentication
  • Decide whether to use Classic (Windows – NTLM or Kerberos with Internal AD) or Claims (LDAP/SQL/FBA/ADFS/ADLDS etc.) based Authentication.
  • It is important to note that regardless of what Authentication Source or Authentication Type is, SharePoint treats all users as SPUser object. SPUser object would contain user token based on authentication type or authentication source.
  • Does Kerberos need to be  enabled to pass credentials to the internal systems? Claims are built to avoid Kerberos delegation to pass Claims without concerns of multiple-hops.
• Login Experience
  • Classics Authentication – Mixed-Mode Authentication - MOSS 2007 way
    • When to use? Different protocols like HTTP or HTTPS for internal vs. external users, separate environments or URLs for internal and external users, Single Sign on for internal users in corporate network
  • Claims Authentication – Multi-Mode Authentication – New in SharePoint 2010, Provides option to Choose Authentication Type before Login Prompt
    • When to use? Single URL for both internal & external users (There is exception – if both internal & external users are in same AD or multiple AD with two-way trust with windows authentication can have single URL), Must be used for Live ID, Must be used to federate between two organizations,
  • Custom Login Page
    • Most customer facing application requires custom branded login page. Requires custom development for branded login page. Out of box login options may not be sufficient for externally facing portals.
    • Optionally use Third-Party SharePoint Protection & Reverse-Proxy lookup Tools like UAG as long as these tools supports authenticate logic for all configured identity management systems.
• Authorization – Site Membership
  • Unlike Authentication, SharePoint performs Authorization by assigning SPUser object to SharePoint Security Groups
  • Two Kind of Authorizations driven by Site Taxonomy
    • Shared Sites/Pages like Yahoo and Dedicated Sites for customers
    • Driven by Customer SLA & Sites Hierarchy – Separate/Dedicated Site Collection for each Customer Site or Single/Shared Site Collection for Multiple Customers
  • Protecting Content
    • Driven by User Personas, User Types, and Site Hierarchy
    • Site Level Permissions Inheritance – Inherit Security or Break Security
    • Site Security Groups -Use Out of box Security Groups or Create New Security Groups based on Out of box Permissions
  • Site Membership
    • Consider Automated Security Group and Site Membership Provisioning and Cleanup Process
    • Either Assign Users or Groups to the SharePoint Security Groups
      • Assign AD or ADLDS Groups to the SharePoint Site Security Groups, AD Groups are recommended for account maintenance if users are in AD. Map these AD groups to SharePoint Security Group for ease of Site Membership management
      • Assign individual users to the SharePoint Site Security Groups – This may require for ADFS
    • Define process to delegate site membership, Make business users/site owners to manage site membership
    • If external users or customers are managing site membership, Use People Picker filtering mechanism to restrict external users visibility in internal directories. Use stsadm -Peoplepicker-searchadcustomquery for AD. Implement custom filtering in Find methods of FBA/ASP.NET Membership Providers
• User Life Cycle Process
  • In most cases, extranet environments are controlled environment which doesn’t require user registration process. User registration typically requires for public facing internet sites.
  • Needs to define process for User Provisioning & Decommissioning
    • Define business process to request provisioning new users – both in bulk & individual
    • Define needs for Shared User Accounts or Dedicated User Account
    • Consider Auto User Provisioning Process  and Decommissioning Process
  • Self-Service User Management – Needs to define self-service or IT managed User management process - how user would reset their passwords, how users would request access to the sites, how users would be given access to the sites etc.
  • User Monitoring & Auditing – It’s a process challenge, external users not sneaking in from back door – Proper User Validation, Expiration, and De-Provisioning  (e.g. Verify users once a 3 months), Either build custom tools or use third-party ISV products for Identity Management

Information Architecture Considerations

• Logical Architecture, Site Hierarchy, Site Taxonomy
  • Web Application, DNS, Host Header, and Application Pool
    • Single or Multiple  SharePoint Web Apps
    • When would you require Single SharePoint Application? – Single URL
    • When would you require Separate SharePoint Application? – different URLs or Authentication Settings
  • Site Collection vs. Sites – Extranet Sites Hierarchy and Number of Sites based on Taxonomy
    • In most cases, SLAs, Security Isolation & Data Protection drives this design. Use Site Collection if Security is boundary and users will have full control. If dedicated content database is important, use site collection as well.
    • Use Sites for Shared Access scenario where multiple customers will have read-only access to the content or contribute access to shared data. As long as customers can’t manage security, you are OK having this model.
    • Plan to use dedicated Site Collection for customer/partner centric portals. You can use SharePoint Multi-Tenancy framework as well for host named site collections. This is how Office 365 or Hosted/Cloud environments work.
  • Single Site to serve All Customers or Dedicated Sites for Each Customer
    • Review business requirements to see if there are needs for dedicated collaborative environments like document libraries, calendars, contacts, SharePoint lists etc. This will require Multiple Site Hierarchy.
    • If business requirements drive design for personalized web parts, data views, dashboards driven by user identity, it may require Single Site or Few Sites based on site types.
• Navigation – Cross Site  Navigation and Cross Site-Collection Navigation
• Site Life Cycle Management
  • Needs to define process for  New Site Provisioning and Site Decommissioning
    • How does site would be provisioned? IT managed; User Managed through IT defined workflow, User Managed through browser based site templates etc.
    • Define business process to request provisioning new sites – both in bulk & individual
      • Site Decommissioning Process – Consider archiving site, instead of deleting it
      • Consider Auto Site Provisioning and Decommissioning Process
  • Needs to define process of extending or maintaining existing sites with new features
  • Site Auditing – Build tools to audit site provisioning, site membership, site maintenance, and  site decommissioning
  • Multiple ways to define site templates in SharePoint – Site Definitions,  Feature Stapling, Web Templates, Coded Site Templates based on blank site templates and activating/maintaining features programmatically
    • One way to speed up initial site design – Use out of box site templates (e.g. team site or blank site) with browser based customizations to speed up initial site template design working with business owners, Save site as template, and import saved site template wsps into Visual Studio to create base Site Template. This process would work only for non-publishing sites. Publishing feature disables save as site template.

Content – Site and Page Contents Considerations

• Page Design – Page Templates – Content Pages
  • Site Pages vs. Application Pages vs. Page Layouts
    • Site Pages – If users are expected to add/remove web parts, personalize page, or requires web parts
    • Application Pages – Administrative Pages
    • Page Layouts – If users are expected to manage contents on page or users are expected to create pages based on pre-defined formats.
  • For the publishing driven sites, needs to define content approval process, content authoring process, and content deployment strategies
• Collaborative Content
  • Collaboration with Customers – Document Libraries, Annoucements, Calendar, Contacts, Team Sites
  • Rich Media – Audios and Videos, should define Digital Asset Management strategies
• Rollup Views
  • Content Query Web Part – within site collection
  • Lightning Conductor Third-party web parts – cross site collection
  • Custom Search Based API - cross site collection
• Data – Integration with other systems within organization
  • Define systems to integrate – SAP, CRM, Lotus Notes, Other SharePoint Farms (e.g. IT Intranet, Document Warehouses), and Third Party Systems
  • Each System would provide its own challenge to access data from SharePoint, May require developing custom web services interface or BCS for platform Integration
  • Does external users requires data interactivity – Reporting, KPIs, Scorecards, Dashboards etc.? Do external user’s credentials pass through to the Business intelligence systems? – This may require SSRS, Excel Services, Performance Point Services, Visio Services, BCS or other mechanisms with Kerberos or Claims enabled authentication
  • Data Security – Define process to expose internal data securely to the customers
    • Would customer credentials  pass through to the internal systems? – this would require Kerberos enabled on the SharePoint
    • Access Internal Systems based on User/Site Metadata/Personalization and Service Accounts instead of passing user credentials to the data source systems, requires proper metadata governance, metatada mapping, and metadata sync process
• Search
  • Decide to use Fast Search vs. Enterprise Search capability vs. Custom Search Driven Components
  • Searching data from multiple internal systems may require BCS/LOB connectivity for platform integration with metadata targeted custom search API
  • Allows you to target information to customer by external user expertise and based on user profiles

Other Major Considerations

• User Personalization and Preferences
  • Define User Personalization Data Store – SharePoint User Profiles vs. SQL Server Users DB vs. Custom Tools
  • Use User Metadata to target specific contents and implement personalization
  • May require tools to Sync User Metadata with Source Systems
  • May require tools to manage User Maintained Metadata and Preferences
• Metadata
  • Application Metadata – Store in web.config, web application configuration store etc.
  • Site Metadata – Store in SharePoint site property bag properties
  • User Metadata – Store in User Profiles, SQL Servers, and AD/ADLDS properties etc.
• Licensing
  • Work with your Microsoft reps for licencing impact, Each organization would affect different way
  • Per User CAL – Internal vs. External Facing
• Social Integration
  • Any Social Integration – Twitter, Facebook, LinkedIn, Google+ etc.
• Mobility Access
  • Target Platform – Blackberry, IPhone, Android, Windows Mobile
  • Any support for Mobile Device Access, HTML 5, MAC OS, iOS for cross-platforms and cross-device support.
  • Plant to integrate open standards like Jquery, Avoid Plugins like Adobe Flash or Silverlight for UI which not supported on iOS as of now
• Cross-Browser Support
  • Define Browser Support Standards for IE, Chrome, Firefox – Checkout SharePoint 2010 Level 1 and Level 2 browser support and see if any custom tools needs to incorporated
  • Do you really need to use Silverlight or Adobe Flash? May be HTML 5, CSS 3 for industry standards
  • Target Standard Screen Resolution – 1024×768 vs. 1280×1024
• Look and Feel – Branding
  • Custom Master Pages, CSS, Images, JavaScript, jQuery files etc.
  • UX Experience – AJAX vs. Jquery vs. Silverlight vs. HTML5 vs. JavaScript
  • Concept Design to Wireframes – Design Wireframes for pages, sub sites, and content pages
  • Style Guide – Microsoft Metro look & feel vs. Corporate Style Guide
• Custom Development - Methodology and Environments
  • Build out Multiple Environments – Individual Developer VMs, Integration, Staging, Authoring, Production
  • Implement Coding Guidelines and Adhere Standards
  • Plan to standardize Code Organization in Visual Studio – Many Codeplex tools available to enable RAD
  • Plan to Use Source Code Control Management like TFS
  • Plan to perform Unit Testing, Automated Build Management, and Continuous Integration for Proper Release Management.
  • Plan to standardize Code Deployment using PowerShell Scripts vs. Manual PS Commands – Packaging using Features & Solutions Framework
• Production Diagnosis – Logging and Auditing
  • Review out of box diagnostics and logging options – ULS, Event Logs, Developer Dashboards
  • Plan to build IT Support and Monitoring Framework – Error Handling, Logging
• Performance
  • Caching – ASP.NET Caching vs. Page Output Caching vs. Custom Caching Components
  • Browser Optimizations – CSS Optimizations
  • Plan to perform Load Testing
• Anti-Virus
  • Plan to use SharePoint specific Anti-Virus product to scan external user uploaded documents.
  • Consider blocking Infected Documents
• Localization – Global Platform
  • Decide to use Different UI experience for different regions or  Consistent UI experience at all regions
  • Multi- Lingual Sites vs. MUI vs. Both vs. ASP.NET Custom Globalization Resource Files
    • Variations and Content Translation Tools
    • Sites in specific language and currency
• Web Analytics
  •  SharePoint Out of box Web Analytics or Custom ISV tools
  • SharePoint Web Analytics not useful – Per Site Collection or Per Site, Instead Integrate with Web Trend or Google Analytics or ISV tools
• End-User Training and Adoption
  • Plan to have proper documentation, online help, and system adoption plans
  • Plan to have proper communication and notifications for updates or new features rollout
  • Plan to have initial Pilot program, product roadshow, or adoption programs
• IT Support and Monitoring
  • Plan to have feedback forums for external users to submit incidents and general system help
  • Plan to have dedicated IT support team to respond user incidents in timely manner

This article will demonstrate creating WCF Services using Visual Studio WCF Service Application template, host WCF services in the IIS by publishing from Visual Studio, and consume WCF services in SharePoint Web parts to display Shared document library data.

Step 1 => Create WCF Service using Visual Studio as WCF Service Application
Create New Project – Visual # -> WCF -> WCF Service Application – Niks.SP2010.IISHostedWCFService

By default, WCF Service Application would add four items – web.config, service1.svc, service1.svc.cs, and Iservice1.cs. Iservice1 is service interface and service1.svc.cs is service class implementation.

Delete default service1.svc and Iservice1.cs. Remove all the service1 references from the web.config file especially service behavior configuration.

Add New WCF Service Project Item by right clicking on Project and Add New Item. From the Add New Item window, select Web and select WCF Service. Specify IISHostedWCFService.svc and Add item to the project.

This would add three items – IISHostedWCFService.svc, IISHostedWCFService.svc.cs, IIISHostedWCFService.cs

Implement business logic in IIISHostedWCFService.cs and IISHostedWCFService.svc.cs. Since this type of service will be hosted in IIS, you need to use Client Side Object Model unless it’s deployed to the IIS on SharePoint Servers. If IIS hosted service is hosted in IIS on SharePoint box, it can use Server Side Object Model.

Since this WCF service will be hosted on dedicated non-SharePoint IIS web servers, it would use Client Side Object Model to  access SharePoint data from remote machines. You can standardize client object model installation using the client object model redistributable on non-SharePoint Servers. This will install three DLLs on the GAC – Microsoft.SharePoint.Client, Microsoft.SharePoint.Client.Runtime, and Microsoft.SharePoint.Client.Runtime.Resources DLLs.

• SP2010 RTM COM Redistributable – http://www.microsoft.com/download/en/details.aspx?id=21786
• SP2010 SP 1 COM Redistributable - http://www.microsoft.com/download/en/details.aspx?id=26624

Reference Client Object Model DLLs in the Project

Define the Service Contract and Data Contract in IIISHostedWCFService.cs

[ServiceContract]
public interface IIISHostedWCFService
{
    [OperationContract]
    List<DocumentData> GetLists();
}

[DataContract]
public class DocumentData
{
    [DataMember]
    public int ID { get; set; }
    [DataMember]
    public string Title { get; set; }
}

Implement the Service Contract – IISHostedWCFService.svc.cs

public List<DocumentData> GetLists()
{
    List<DocumentData> docData = new List<DocumentData>();
    string siteURL = "<a href="http://sp2010vm/">http://sp2010vm</a>";
    string documentListName = "Shared Documents";

    using (ClientContext clientContext = new ClientContext(siteURL))
    {
        NetworkCredential credentials = new NetworkCredential
            (ConfigurationManager.AppSettings["SvcAccountId"],
            ConfigurationManager.AppSettings["SvcAccountPassword"],
            ConfigurationManager.AppSettings["SvcAccountDomain"]);
        clientContext.Credentials = credentials;

        List list = clientContext.Web.Lists.GetByTitle(documentListName);
        var camlQuery = new CamlQuery { ViewXml = "<View/>" };

        ListItemCollection listItems = list.GetItems(camlQuery);
        clientContext.Load(listItems);
        clientContext.ExecuteQuery();

        foreach (ListItem listitem in listItems)
        {
            docData.Add(new DocumentData() { ID = Convert.ToInt32(listitem["ID"]), Title = listitem["Title"].ToString() });
        }
        }

    return docData;
}

Update Your Web.Config as following for WCF service security mode, bindings, service behaviors, and endpoints. Additionally, it enables windows authentication, disables impersonation, and allows all users to access web service.

<configuration>
  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding name="BasicHttpEndpointBinding">
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Ntlm">
              <extendedProtectionPolicy policyEnforcement="Never" />
            </transport>
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <services>
      <service behaviorConfiguration="Niks.SP2010.IISHostedWCFService.IISHostedWCFServiceBehavior"
        name="Niks.SP2010.IISHostedWCFService.IISHostedWCFService">
        <endpoint address="basic" binding="basicHttpBinding" bindingConfiguration="BasicHttpEndpointBinding" name="basicBindingConfig"
                  contract="Niks.SP2010.IISHostedWCFService.IIISHostedWCFService" />
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="Niks.SP2010.IISHostedWCFService.IISHostedWCFServiceBehavior">
          <serviceMetadata httpGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
  <system.web>
    <compilation debug="true" />
    <authentication mode="Windows" />
    <identity impersonate="false" />
  </system.web>
  <system.webServer>
    <security>
      <authorization>
        <remove users="*" roles="" verbs="" />
        <add accessType="Allow" users="*" />
      </authorization>
    </security>
  </system.webServer>
</configuration>

Step 2 => Deploy WCF Service in IIS 7
Once WCF Service logic is implemented, next logical step is to publish the WCF service application to the IIS.

In IIS 7, create new web site -> Site Name – IISHostedWCFService, ApplicationPool – IISHostedWCFService, Port-9999, Physical directory – C:\inetpub\wwwroot\IISHostedWCFService

In IIS, change the App pool identity to – Niks\Administrator from default AppPoolIdentity

In IIS, disable anonymous authentication and enable windows authentication. Allow all users in authorization section.

In VS, Publish WCF Service -> Web Deploy, service URL – http://localhost:9999, site/app name – IISHostedWCFService, Mark IIS as destination and Publish, it will copy SVC, BIN directory, and web.config to inetpub physical directory – IISHostedWCFService. Please note that when you are making changes in IIS authentication or authorization options, it would change web.config in IIS virtual folder, it wouldn’t change in visual studio web.config. Republishing from Visual Studio, may overwrite web.config in IIS virtual folder.

Step 3 => Test the WCF Service
To Test the WCF Service Interface, In IIS web site content view, right click and browse WCF file.

If your SharePoint Web Application IIS web site is not enabled for anonymous authentication or claims based authentication, it would ask you for the credential and should take you to the WCF interface – http://localhost:9999/IISHostedWCFService.svc. Click on the Link – http://sp2010vm.niks.local:9999/IISHostedWCFService.svc?wsdl to see the service contract information.

Step 4 => Consume the WCF Service from SharePoint
In real world scenarios, you would be consuming WCF services from the non-SharePoint remote applications like CRM, SQL Server SSIS Packages, ASP.NET, Silverlight, or Console Utilities. For the demonstration purpose, I will consume Custom WCF Service from the SharePoint web application. Create new empty SharePoint Project – Niks.SP2010.IISHostedWCFServiceClient

Reference the WCF Service by right clicking project and Add Service Reference. Enter WCF Service Address – http://sp2010vm.niks.local:9999/IISHostedWCFService.svc and Click Go to discover. Add Proper Namespace and click OK to add WCF Service Proxy in Visual Studio.

Addingt Service reference would add app.config file in the project and WCF binding’s entries for <system.serviceModel>. To Consume WCF Service from SharePoint User Interface, Add Visual Web Part.

In Visual Web Part Code, invoke the WCF Service proxy, pass the user credential to the service, and call service method to return list of documents by populating ASP.NET data grid. Following code would invoke service and run WCF Service under user context.

protected void Page_Load(object sender, EventArgs e)
{
    Niks.SP2010.IISHostedWCFServiceClient.IISHostedWCFService.IISHostedWCFServiceClient client
        = new Niks.SP2010.IISHostedWCFServiceClient.IISHostedWCFService.IISHostedWCFServiceClient();

    Niks.SP2010.IISHostedWCFServiceClient.IISHostedWCFService.DocumentData[] docData = client.GetLists();
    gvDocData.DataSource = docData;
    gvDocData.DataBind();
    client.Close();
}

Final step to call WCF Service properly during runtime, copy App.Config <System.ServiceModel> section to the SharePoint Web Application. By default, it’s using basicHttpBinding binding & NTLM as authentication method. Please note that WCF Service endpoint is http://sp2010vm.niks.local:9999/IISHostedWCFService.svc.

<configuration>
    <system.serviceModel>
        <bindings>
            <basicHttpBinding>
                <binding name="basicBindingConfig" closeTimeout="00:01:00" openTimeout="00:01:00"
                    receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
                    bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                    maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                    messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                    useDefaultWebProxy="true">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                    <security mode="TransportCredentialOnly">
                        <transport clientCredentialType="Ntlm" proxyCredentialType="None"
                            realm="" />
                        <message clientCredentialType="UserName" algorithmSuite="Default" />
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <client>
            <endpoint address="<a href="http://sp2010vm.niks.local:9999/IISHostedWCFService.svc/basic">http://sp2010vm.niks.local:9999/IISHostedWCFService.svc/basic</a>"
                binding="basicHttpBinding" bindingConfiguration="basicBindingConfig"
                contract="IISHostedWCFService.IIISHostedWCFService" name="basicBindingConfig" />
        </client>
    </system.serviceModel>
</configuration>

Once web.config is properly configured, open the SharePoint Web Application and add Custom Web Part on the page. It should display list of all the documents title in Grid View

Additional Resources

• Deploying an Internet Information Services-Hosted WCF Service – http://msdn.microsoft.com/en-us/library/aa751792.aspx
• Getting Started Building a WCF Web Service using WCF Service Application with Slightly different approach than mine  – http://blogs.msdn.com/b/ericwhite/archive/2010/05/11/getting-started-building-a-wcf-web-service.aspx
• Hosting WCF Service in IIS using WCF Library Approach – http://blogs.msdn.com/b/amitlale/archive/2007/05/21/hosting-wcf-service-in-iis.aspx
• Hosting a WCF Service in IIS using WCF Service Web Site Approach – http://blogs.msdn.com/b/trobbins/archive/2006/11/27/how-to-hosting-a-wcf-service-in-iis.aspx

As you can read from earlier article, one of the great things about WCF services are they can be hosted and deployed multiple ways. One of the options are SharePoint 2010 allows custom WCF service hosted in SharePoint Root ISAPI directory. In this article, I will walkthrough step by step process of setting up custom WCF service project as SharePoint Solution, how it can be deployed to the SharePoint 2010, and how it can be consumed from the SharePoint web parts.

The Custom WCF Service built in this article returns list of documents name and title information from the Shared Document Library in the root site collection web site and displays on the SharePoint Site using web parts interface.

Step 1 => Setup WCF Service Project to host in SharePoint

Create New Empty SharePoint Project – Niks.SP2010.SPHostedWCFService and Select “Deploy as a Farm Solution”. This approach will deploy WCF service in SharePoint Root, ISAPI directory.

Add WCF Service Project Item by right clicking on Project and Add New Item.

From the Add New Item window, select C# and select WCF Service. Specify SPHostedWCFService.cs and Add item to the project.

This should add three files in the project – web.config, ISPHostedWCFService.cs, and SPHostedWCFService.cs. Please note that ISPHostedWCFService is service interface and SPHostedWCFService is class implementation.

App.config should look like this.

<configuration>
    <system.serviceModel>
        <behaviors>
            <serviceBehaviors>
                <behavior name="Niks.SP2010.SPHostedWCFService.SPHostedWCFServiceBehavior">
                    <serviceMetadata httpGetEnabled="true" />
                    <serviceDebug includeExceptionDetailInFaults="false" />
                </behavior>
            </serviceBehaviors>
        </behaviors>
        <services>
            <service behaviorConfiguration="Niks.SP2010.SPHostedWCFService.SPHostedWCFServiceBehavior"
                name="Niks.SP2010.SPHostedWCFService.SPHostedWCFService">
                <endpoint address="" binding="wsHttpBinding" contract="Niks.SP2010.SPHostedWCFService.ISPHostedWCFService">
                    <identity>
                        <dns value="localhost" />
                    </identity>
                </endpoint>
                <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
                <host>
                    <baseAddresses>
                        <add baseAddress="<a href="http://localhost:8732/Design_Time_Addresses/Niks.SP2010.SPHostedWCFService/SPHostedWCFService/">http://localhost:8732/Design_Time_Addresses/Niks.SP2010.SPHostedWCFService/SPHostedWCFService/</a>" />
                    </baseAddresses>
                </host>
            </service>
        </services>
    </system.serviceModel>
</configuration>

Next step is to compile the Project and find the PublicKeyToken using sn.exe from command prompt. This is required for next steps for full assembly reference in WCF Service file. Running this command prompt, would return public key token – 9a823b7ed0a910a2 for this WCF Web Service

Unfortunately there is no ”WCF Service” SharePoint Project Item available in Visual Studio. You can download CKSDEV codeplex solution which would ease adding WCF Service SPI in Visual Studio.

Since I wanted to go with manual way (which is easy by the way), To host WCF Service in SharePoint ISAPI folder, right click on project and Add SharePoint Mapped folder – ISAPI. Within ISAPI folder, add SPHostedWCFService folder to host custom WCF web service and add two text files and rename them as SPHostedWCFService.svc and web.config

Add following lines in SPHostedWCFService.svc, Specify correct PublicKeyToken derived from earliar step.

<%@ Assembly Name="Niks.SP2010.SPHostedWCFService, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9a823b7ed0a910a2"%>
<%@ ServiceHost Service="Niks.SP2010.SPHostedWCFService.SPHostedWCFService" %>

Add following in web.config in ISAPI folder

<configuration>
  <system.serviceModel>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true"/>
    <bindings>
      <basicHttpBinding>
        <binding name="customBasicHttpBinding">
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Ntlm"/>
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior name="customBasicBehavior">
          <serviceMetadata httpGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="false" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <services>
      <service behaviorConfiguration="customBasicBehavior"
        name="Niks.SP2010.SPHostedWCFService.SPHostedWCFService">
        <endpoint address="" binding="basicHttpBinding"
        bindingConfiguration="customBasicHttpBinding"
        contract="Niks.SP2010.SPHostedWCFService.ISPHostedWCFService">
          <identity>
            <dns value="localhost" />
          </identity>
        </endpoint>
        <host>
          <baseAddresses>
            <add baseAddress="<a href="http://localhost/_layouts/WorkflowDemonstration">http://localhost/_layouts/WorkflowDemonstration</a>" />
          </baseAddresses>
        </host>
      </service>
    </services>
  </system.serviceModel>
</configuration>

Step 2 => Implement Business Logic in WCF Service

Once basic project is setup, next logical step would be implementing business logic in WCF Service. Each WCF Service has to define two steps – Interface and Implementation.

Define the Service Contract and Data Contract in ISPHostedWCFService.cs

[ServiceContract]
public interface ISPHostedWCFService
{
    [OperationContract]
    List<DocumentData> GetLists();
}

[DataContract]
public class DocumentData
{
    [DataMember]
    public string Name { get; set; }
    [DataMember]
    public string Title { get; set; }
}

Implement the Service Contract – SPHostedWCFService.cs

In this WCF Service, since I am hosting WCF Service on the SharePoint farm, I am using Server Side Object Model to access Shared Documents document library from the root site collection web site and return documents information in the business object collection.

Since SharePoint is ASP.NET web application, please ensure to set each service method – AspNetCompatibilityRequirements to either Required or Allowed for ASP.NET compatability as shown in following code snippet.

[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)]
public class SPHostedWCFService : ISPHostedWCFService
{
    public List<DocumentData> GetLists()
    {
        List<DocumentData> docData = new List<DocumentData>();

        string siteURL = "<a href="http://sp2010vm/">http://sp2010vm</a>";
        string documentListName = "Shared Documents";

        using (SPSite spSite = new SPSite(siteURL))
        {
            SPDocumentLibrary spLibrary = (SPDocumentLibrary)spSite.RootWeb.Lists.TryGetList(documentListName);
            foreach (SPListItem listitem in spLibrary.Items)
            {
                docData.Add(new DocumentData() { Name = listitem.Name, Title = listitem.Title});
            }
        }

        return docData;
    }
}

Step 3 => Deploy WCF Service in SharePoint

Once WCF Service logic is implemented, next logical step is to package the WCF service solution and deploy it to the SharePoint. This step is similar to any other SharePoint WSPs. This step requires packaging WCF SharePoint solution and deploys it through Visual Studio or Solutions & Features Framework API as Farm level solution. Deploying solution would provision Niks.SP2010.SPHostedWCFService.dll into GAC and Niks.SP2010.SPHostedWCFService folder wtih WCF endpoint in SharePoint Root ISAPI directory.

To Test the WCF Service Interface, Click on the URL – http://SP2010VM/_vti_bin/SPHostedWCFService/SPHostedWCFService.svc

If your SharePoint Web Application IIS web site is not enabled for anonymous authentication or claims based authentication, it would ask you for the credential. Click on the Link – http://sp2010vm.niks.local/_vti_bin/SPHostedWCFService/SPHostedWCFService.svc?wsdl to see the service contract information.

Step 4 => Consume WCF Service from SharePoint

In real world scenarios, you would be consuming WCF services from the non-SharePoint remote applications like CRM, SQL Server SSIS Packages, ASP.NET, Silverlight, or Console Utilities. For the demonstration purpose, I will consume Custom WCF Service from the SharePoint web application.Create new empty SharePoint Project – Niks.SP2010.SPHostedWCFServiceClient

Reference the WCF Service by right clicking project and Add Service Reference. Enter WCF Service Address  – http://SP2010VM/_vti_bin/SPHostedWCFService/SPHostedWCFService.svc and and Click Go to discover. Add Proper Namespace and click OK to add WCF Service Proxy in Visual Studio

Adding reference to the WCF Service, would add app.config file in the project which needs to be copied to the SharePoint Web Application Web.Config file. To Consume WCF Service from SharePoint User Inteface, Add Visual Web Part

In Visual Web Part Code, invoke the WCF Service proxy, pass the user credential to the service, and call service method to return list of documents by populating ASP.NET data grid. Following code would invoke service and run WCF Service under user context.

protected void Page_Load(object sender, EventArgs e)
{
    Niks.SP2010.SPHostedWCFServiceClient.SPHostedWCFService.SPHostedWCFServiceClient client
        = new Niks.SP2010.SPHostedWCFServiceClient.SPHostedWCFService.SPHostedWCFServiceClient();
    client.ClientCredentials.Windows.AllowedImpersonationLevel =
        System.Security.Principal.TokenImpersonationLevel.Impersonation;

    Niks.SP2010.SPHostedWCFServiceClient.SPHostedWCFService.DocumentData[] docData = client.GetLists();
    gvDocData.DataSource = docData;
    gvDocData.DataBind();
    client.Close();
}

Final step to call WCF Service properly during runtime, Copy App.Config <System.ServiceModel> section to the SharePoint Web Application. By default, it’s using basicHttpBinding binding & NTLM as authentication method. Please note that WCF Service endpoint is ttp://sp2010vm.niks.local/_vti_bin/SPHostedWCFService/SPHostedWCFService.svc.

<configuration>
    <system.serviceModel>
        <bindings>
            <basicHttpBinding>
                <binding name="BasicHttpBinding_ISPHostedWCFService" closeTimeout="00:01:00"
                    openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                    allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                    maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                    messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                    useDefaultWebProxy="true">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                    <security mode="TransportCredentialOnly">
                        <transport clientCredentialType="Ntlm" proxyCredentialType="None"
                            realm="" />
                        <message clientCredentialType="UserName" algorithmSuite="Default" />
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <client>
            <endpoint address="<a href="http://sp2010vm.niks.local/_vti_bin/SPHostedWCFService/SPHostedWCFService.svc">http://sp2010vm.niks.local/_vti_bin/SPHostedWCFService/SPHostedWCFService.svc</a>"
                binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_ISPHostedWCFService"
                contract="SPHostedWCFService.ISPHostedWCFService" name="BasicHttpBinding_ISPHostedWCFService" />
        </client>
    </system.serviceModel>
</configuration>

Once web.config is properly configured, open the SharePoint Web Application and add Custom Web Part on the page. It should display list of all the documents name & title in Grid View

Important Notes regarding Updating WCF Service Interface & Implementation

• If you are changing any logic in WCF Service contract implementation, you don’t have to refresh Service Reference from the Client.
• If you have changed WCF Service Contract Interface or Business Objects Definitions, you don’t have to refresh Service Reference from the Client using Visual Studio

Additional References – Hosting WCF Services in SharePoint

• Sahil Malik’s Apress Book – Building Solutions for SharePoint 2010 – Writing Custom WCF Services, Chapter 5, Page 155
• McGraw Hill’s Microsoft Sharepoint 2010 Web Applications Complete Reference Book – Add a SharePoint-Hosted WCF Service, Chapter 11 – Workflow, Page 246
• Microsoft SharePoint 2010 Development with Visual Studio 2010: Expert Cookbook, Chapter 6, Page 237
• SharePoint 2010 Foundation SDK – Creating a Custom WCF Service in SharePoint Foundation using WCF Library Project Item – http://msdn.microsoft.com/en-us/library/ff521581.aspx
• SharePoint 2010: Create Custom WCF Service using CKSDEV Project Item – http://ranaictiu-technicalblog.blogspot.com/2011/03/sharepoint-2010-create-custom-wcf.html
• Hosting WCF Service Inside SharePoint 2010 – Similar Approach as Mine – http://mstecharchitect.blogspot.com/2010/03/hosting-wcf-service-inside-sharepoint.html

With SharePoint 2010, Microsoft has allowed SharePoint developers an option of hosting Custom WCF Services in SharePoint 2010 environment. Additionally, WCF Services can be hosted in IIS as well. As with many other Microsoft technologies, developers and administrators faces decision making process whether to deploy custom WCF Services in SharePoint or IIS. Unfortunately, I haven’t come across any official guidance in this matter from Microsoft and most of the articles on TechNet or MSDN demonstrate custom WCF service hosted in SharePoint 2010.

In this article, I will try to list high level items needs to consider while making decision on deploying WCF Service in IIS or SharePoint.

Hosting WCF Service in IIS

• Can be deployed to dedicated IIS web servers, non-SharePoint servers to utilize dedicated RAM
• WCF Service would run in its own worker process or application pool
• WCF Service can have separate authentication and authorization mechanism than SharePoint Implementation.
• WCF Service can be configured with impersonate = false to run WCF Service logic as application pool service account.
• If you are accessing or processing SharePoint data from WCF services, you must use REST based API or client side object model to integrate with SharePoint implementation unless you are deploying WCF services as dedicated IIS web site on SharePoint Servers.
• Needs to deploy WCF service on multiple IIS servers with load balancer to provide high availability
• WCF Service hosted on separate IIS server wouldn’t interfere with SharePoint processes and chew up RAM required by SharePoint operations

Hosting WCF Service in SharePoint

• Runs in SharePoint Web Application’s worker process
• Deployed to SharePoint servers in the farm using SharePoint solutions framework
• WCF Service would have to use same authentication and authorization mechanism as SharePoint Implementation.
• WCF Service can’t be configured with impersonate = false since impersonation is enabled by default in SharePoint 2010. This allows calling application to run WCF service in user context and return security trimmed data.
• If you are accessing or processing SharePoint data from WCF services, it provides best performance because it runs under SharePoint worker process and can use Server Side Object Model
• WCF Service is already deployed to all the WFE servers and provides high availability by using SharePoint inbuilt load balancer
• WCF Service hosted in SharePoint worker process would share RAM with SharePoint operations and it may degrade SharePoint performance and scalability
• If your web application is configured with claims based authentication, it is important to remember that IIS website is configured to have anonymous access. Since your WCF endpoints would be hosted in SharePoint web application, it may receive requests from anonymous users. It is always best practice to check if user is authorized user in WCF service implementation.

Based on above items, hosting WCF Services on dedicated IIS servers would make great case for centralized enterprise services library especially when performance, security, scalability, authentication, and authorization model matters most. This would allow hosting all the custom WCF Services in single environment managed by single team whether they are based on SharePoint or not.

Best use case to deploy WCF Service in SharePoint is to extend SharePoint capabilities and run WCF Services in User Context like out of box WCF Services hosted in ISAPI directory (e.g. Client.svc or ListData.svc or ASMX files). Additionally, hosting WCF services would allow you to use Administrative SharePoint APIs which isn’t available in Client Object Model or REST based API. E.g. User Profile Services API are not available through client object model and if your WCF service is maintaining User Profiles, you have to use Server Side Object Model and hosting custom WCF Service in SharePoint would make more sense.

And, here is the Kicker. You can also host WCF Services as dedicated IIS web sites on the SharePoint Servers to use best of both worlds. This would allow performing Administrative SharePoint operations using Server Side Object Model with dedicated worker process, impersonation model, authentication model, and authorization model. Recently I wrote SharePoint Site Provisioning WCF web service which needed to run under farm account (impersonation = false), anonymous authentication disabled, and perform Administrative APIs using Server Side Object Model. This was perfect case where I needed to host WCF services on IIS servers on SharePoint Servers.

Hopefully this article would help making intelligent decisions while hosting custom WCF Service based on SharePoint Framework.

I recently came across very interesting error while deploying solutions and activating features using powershell on one of our farm’s central admin server. What surprised me that we were using same approach to deploy our code from central admin server since last couple of months and suddenly it’s stopped working while activating features and throwing error.

Enable-SPFeature : The Feature is not a Farm Level Feature and is not found in a Site level defined by the Url. At D:\Deploy\SPSolutionDeploymentScript.ps1:287 char:22 + Enable-SPFeature <<<<  –identity $webFeatureName -URL $spWeb.url -Confirm:$false + CategoryInfo: InvalidData: (Microsoft.Share…etEnableFeature:SPCmdletEnableFeature) [Enable-SPFeature], SPCmdletException + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletEnableFeature

Looking at the error, it was clear that PowerShell wasn’t able to find SharePoint Features and Solutions framework API on the server. What I didn’t know was what would or which SharePoint Service application would enable this framework on the server. My first guess was to reach out to our SharePoint admin to see if he is aware of any recent changes on the central admin server configuration. Additionally, I tried to deploy and activate features through one of the WFE servers and it worked fine. As I was waiting for admin response, I have reached out to greater SharePoint community via twitter. My good friends from SharePoint Twitter communities, both Dan Usher (@usher) and Clayton Cobb (@warrtalon) came to rescue right away and first clue was SharePoint Foundation Web Application Service may not be running. While I was trying to confirm whether this service was running earlier and stopped recently causing feature activation issues, I received response from Admin that this service was indeed stopped and he may have stopped recently.

Well, problem is solved and resolution is clear. We just needed to activate the SharePoint Foundation Web Application Service to resolve the issue. But, as we were exchanging information on twitter, I have realized that this could be major SharePoint release management decision. As an Admin, we would like to disable the SharePoint Foundation Web Application Service on the central admin server. Disabling SharePoint Foundation Web Application Service on central admin server seems one of the best practices since it isn’t used to serve pages to the end-users and disabling this service would conserve server memory for other dedicated SharePoint application tier services enabled on Central Admin/Application Server.

In General, here are the guidelines I have came to conclusion whenever I come across similar situation in future.

• It is still best approach to deploy code and activate features from central admin. This would allow central admin server as a main administrative consoles for both configurations and custom deployment.
• It is still best practice to disable the SharePoint Foundation Web Application Service on the Central Admin Server to avoid additional performance overhead by running less SharePoint Web Application IIS worker processes
• Since you have to activate SharePoint Foundation Web Application Service on the Central Admin Server to deploy code from the Central Admin Server, It would be great practice to enable the Service during deployment process and disable during normal runtime. It would be nice to have a deployment tasks to enable the service, deploy custom solutions, and disable the service.
• One last point, there is nothing written on stone or as a best practice to deploy code from central admin, it is just my preferred method to centralize administrative tasks in one place. If your situation is different and able to deploy custom solutions from the WFE servers running SharePoint Foundation Web Application Service, you are covered.

Here is another great article recommendaed by Dan Usher and it provides same architectural insights faced by SharePoint Architects and IT Pros in real world – http://blogs.technet.com/b/speschka/archive/2010/11/27/beware-of-default-solution-deployments-for-custom-claims-providers-in-sharepoint-2010.aspx

How ASP.NET Session State really works in SharePoint?

As many of you are aware, ASP.NET allows persisting session states in three different medium – on server memory as a inproc which would require server & load balancer affinity, on SQL Server to persist session in database, or on Session State Server to persist session on dedicated server memory. Both SQL Server and Session State Server would support server farm environment and because SharePoint is the multi-server farm environment based on ASP.NET framework, by default, it can be enabled to use SQL Server and SqlSessionStateStore provider to persist session state using ASP.NET Session State Service Application.

Should I really worry if ASP.NET Session State is enabled on my SharePoint farm?

ASP.NET Session State Service as SharePoint Session State Management depends on many factors including how many concurrent users will be accessing site, or heavy vs. average vs. low usage of session objects. If you really need to persist user session information and if you can store them in other mediums like cookies, ASP.NET Session state may not be necessary. Since SharePoint is built on top of ASP.NET framework, ASP.NET Session State Service would be ideal place to persist user sessions. Since ASP.NET Sessions gets stored in the SQL Server, heavy usage of session state may require detailed database planning, regular truncating/maintenance/cleanup of expired session state data, or fine tuning of default 60 minute session expiration time. Great thing about this service is even though it’s enabled on whole farm, it’s not used unless specific application is activated to use session state and you have full control & visibility of how ASP.NET sessions gets stored in SharePoint.

How do I enable ASP.NET Session State in SharePoint?

ASP.NET Session state is available to the SharePoint environment by enabling “SharePoint Server ASP.NET Session State Service” service application on the SharePoint farm. You can’t enable this service application using central administration browser interface. You must enable it using PowerShell command.

Step 1: Enable ASP.NET Session State Service

To enable ASP.NET session state, log on the Central Admin Server using Farm Admin Account, and

• Either Run PowerShell command “Enable-SPSessionStateService –DefaultProvision” to create service application with default state. By default, this will create service application database with “SessionStateService_<GUID>”, on the same database server where farm configuration database is located using windows credentials of the logged in user.
• Or Run PowerShell command “Enable-SPSessionStateService -DatabaseServer YourDBServerName -DatabaseName YourDBName” to create service application with specific database name on non-SharePoint configuration database server. For more details and additional parameters, please visit Enable-SPSessionStateService http://technet.microsoft.com/en-us/library/ff607857.aspx.

By enabling Session State Service on your farm,

It would create database on specified server – SessionStateService_<GUID>

It would create SharePoint Server ASP.NET Session State Service in Manage Service Applications

It would add module in all web applications on farm – <add name=”Session” type=”System.Web.SessionState.SessionStateModule” />

It would add sessionstate entry in all web applications on farm

<sessionState mode=”SQLServer” timeout=”60″ allowCustomSqlDatabase=”true” sqlConnectionString=”Data Source=SP2010VM;Initial Catalog=SessionStateService_1079ab25364440b0b38b15ad2392b6d0;Integrated Security=True;Enlist=False;Connect Timeout=15″ />

Step 2: Activate ASP.NET Session State on SharePoint Web Application

By enabling ASP.NET session state service in the SharePoint farm, every SharePoint web application in the farm ready to use ASP.NET session framework. To ensure SharePoint web application gets activated to persist ASP.NET sessions, you have to manually update Web.Config file for the specific SharePoint web application on all servers in the farm.  - <pages enableSessionState=”true”

Step 3: Although this may not be necessary, performing IISReset on all the servers would help resetting all the sessions.

How would you use ASP.NET Session State Service in Code?

This is straightforward. You can access ASP.NET session state object using HTTPConext.Current.Session and use the ASP.NET session state same as typically ASP.NET Session Management. Here is the sample code which would create new ASP.NET session object called “SampleSessionKey”, if it doesn’t exists.

After above code runs, this is what you would see in the ASP.NET Session State Service Application database. By default, it would create session for 60 minutes. If you want to increase or decrease session expiration, you have to pass “SessionTimeout” parameter while creating ASP.NET Session State Service using Enable-SPSessionStateService command.

Additional References

• Session State Management in SharePoint – http://msdn.microsoft.com/en-us/library/ff648090.aspx
• Using Session State in SharePoint 2010 – http://blogs.msdn.com/b/markarend/archive/2010/05/27/using-session-state-in-sharepoint-2010.aspx
• How to enable Session State in SharePoint 2010 – http://moustafa-arafa.blogspot.com/2010/05/how-to-enable-session-state-in.html
• Enable session state for SharePoint Server 2010 and Foundation – http://code-journey.com/2011/enable-session-state-for-sharepoint-server-2010-and-foundation/
• SharePoint 2010 Session Management – http://blog.petercarson.ca/Pages/SharePoint-2010-Session-Management.aspx
• SharePoint 2010 FBA and Sliding Sessions – http://blogs.msdn.com/b/scicoria/archive/2011/06/10/sharepoint-2010-fba-and-sliding-sessions.aspx
• SharePoint 2007 – Improve ASP.NET Session State performance – http://blogs.technet.com/b/patrick_heyde/archive/2009/12/22/sharepoint-2007-improve-asp-net-session-state-performance.aspx
• Understanding the implications of turning on SessionState – http://www.bluedoglimited.com/SharePointThoughts/lists/posts/post.aspx?ID=69

The real reason behind this is when you create web application either through PowerShell or central admin, SharePoint configures application pool information at many different locations including machine level permissions, IIS, and database permissions. If you ever want to manually change the application pool, you must be aware of what really happens under the hood and visit all the different locations to change application pool manually. As you may think, manually changing all these machine level settings is tedious, error-prone, and requires better option. Luckily Microsoft has provided better option as manage service accounts page on the central administration site. It is best practice to change content web application pool or even service web application pool from the central administration to ensure SharePoint Content Web application runs smoothly.

You can use following step by step guide to change application pool for the given SharePoint web application. Additionally, it would walk you through what really happens under the hood and where SharePoint makes necessary changes to ensure Application Pool is configured properly.

Pre-requisites

• New AppPool account must be Domain User Account (e.g. Niks\SPAppPool)
• New AppPool account must register as SharePoint Managed Account

Changing Application Pool from the Central Administration

Visit Manage Service Accounts page on the central administration to change the application pool.

Run the IISReset after updating application pool to ensure all the configuration settings has been updated to access SharePoint Web Application correctly.

What really happens under the hood?

After you change the application pool through central administration, SharePoint automates various configuration settings changes at the machine level, IIS, and SQL Server.

• SharePoint Web Application App Pool in IIS

• Machine-level Permissions
  • New AppPool account added as Member in the WSS_WPG, AD Group
  • New AppPool account added as Member in the built-in IIS_IUSRS, AD Group

• SQL Server and database permissions
  • SharePoint will create new SQL Server Login for AppPool Account in the Database if it doesn’t exists
  • New AppPool account is assigned to the db_owner role for the Web application content databases.

  

  • New AppPool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the farm configuration database.

  

  • New AppPool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the SharePoint_Admin content database.

  

  • New AppPool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the StateService database.

  

  • New AppPool account will be assigned to the db_owner role for the associated user profile service application databases (e.g. Profile DB, Social DB, and Sync DB)

There you go. Regardless of what you do and where you manually change application pool account info, you still have to change application pool through manage security accounts screen. So, why not just change only at 1 place on manage security accounts screen and let SharePoint does it’s magic to update all the required places. Hopefully this will help. !!!!!

Filed under: Admin General ]]> http://nikspatel.wordpress.com/2012/01/25/best-practices-to-change-app-pool-account-for-sharepoint-web-applcation/feed/ 0 nikspatel 1-Wrong AppPool Configuration Error 2-Managed Account for AppPool 3-Updating SharePoint Web AppPool 4-Run IISReset 5-IIS AppPool Setting 6-SpAppPool Membership 7-WSS_Content SPAppPool 8-Farm Config DB SPAppPool 9-Central Admin DB SPAppPool 10-State Service DB SPAppPool 11-User Profile DBs SPAppPool