To use FBA on a desktop client will be necessary to make a first request to the server and create the authentication cookie. This cookie will be used on the next requests to receive permission from the server to access protected resources imitating the browser’s behavior.
First we need to write a server side method that receives the login and password information, does the authentication task and creates the authentication cookie:

public bool Authenticate(String login, String password)
{
    if (Membership.ValidateUser(login, password))
    {
        System.Web.Security.FormsAuthentication.SetAuthCookie(login, false);
        return true;
    }
    else return false;
}

On the client side we need to make a request to the authentication method and copy the authentication cookie to the future requests (Here you will find an easy way to make post requests using C#):

Cookie cookie = authenticate_response.Cookies[".ASPXAUTH"];
new_request.CookieContainer = new CookieContainer();
new_request.CookieContainer.Add(cookie);

Thanks goes to the following people/sites: http://blogs.msdn.com/dansellers/archive/2005/11/09/491152.aspx & http://windowsitpro.com/Web/article/articleid/9738/extending-the-user-class-in-the-ad-schema.html 

Enable Password Question and Password Reset:

When these attributes are set to true in the web config file as seen below, the user is required to provide an answer to a Password Question when the password is first created.  When the user resets their password, they will also be required to provider the answer they supplied to the Password Question when the password was first created. 

<membership defaultProvider=”ADAMProvider”>
  <providers>
    <add
      connectionStringName=”ADCnString”
      connectionUsername=”CN=ADAdmin,OU=Users,O=ADAuth”
      connectionPassword=Pass@word1
      connectionProtection=”None”
      requiresQuestionAndAnswer=”true”
      enablePasswordReset=”true” …

Mapping Password Question and Answer Attributes:

Both the Password Question and the Answer will be saved in the SQL Server, Active Directory, or the Active Directory Application Mode (ADAM) depending upon the provider you are using. However, if you are using the Active Directory Provider you will be required to modify the schema of either the Active Directory or ADAM to store the Password Question and Password Answer.  Then in the web config file you will need map the Password Question and Answer’s attributes to the modified schema as shown below:

<membership defaultProvider=”ADAMProvider”>
   <providers>
      <add
         connectionStringName=”ADCnString”
         connectionUsername=”CN=ADAdmin,OU=Users,O=ADAuth”
         connectionPassword=Pass@word1
         connectionProtection=”None”
         requiresQuestionAndAnswer=”true”
         enablePasswordReset=”true”
         attributeMapPasswordQuestion=”PwdQuestion”
         attributeMapPasswordAnswer=”PwdAnswer” …
 

Example Schema Modification:

Creating the PwdQuestion and PwdAnswer attribute as defined above is not difficult in the ADAM ADSI Edit tool under the Schema configuration, but initially it takes a while to figure out what values required by the attribute schema wizard.  Below is an example of the values that you can use in your Active Directory or ADAM directory.

    cn:  PwdQuestion
    OMSyntax: 64 (for Unicode string)
    lDAPDisplayName: PwdQuestion
    isSingleValued: TRUE
    AttributeSyntax: 2.5.5.12 (Active Directory syntax type of Unicode)
    AttributeID: 1.2.840.113556.1.6.1.1.6221 (Unique Object Identifiers (OIDs))

    cn:  PwdAnswer
    OMSyntax: 64 (for Unicode string)
    lDAPDisplayName: PwdAnswer
    isSingleValued: TRUE
    AttributeSyntax: 2.5.5.12
    AttributeID: 1.2.840.113556.1.6.1.1.6222

Schema modifications:
Creating the Failed Password Count, Failed Password Answer Time and Failed Password Locked Out Time attributes–as defined below–is not difficult in the ADAM ADSI Edit tool under the Schema configuration, but initially it takes a while to figure out what values are required by the attribute schema wizard. Below is an example of the values that you can use in your Active Directory or ADAM directory.

cn: FailedPwdCount
OMSyntax: 2 (for type integer)
lDAPDisplayName: FailedPwdCount
isSingleValued: TRUE
AttributeSyntax: 2.5.5.9 (Active Directory syntax type of Unicode)
AttributeID: 1.2.840.113556.1.6.1.1.6223 (Unique Object Identifiers (OIDs))

cn: FailedPwdAnswerTime
OMSyntax: 65 (for Large integer/Interval)
lDAPDisplayName: FailedPwdAnswerTime
isSingleValued: TRUE
AttributeSyntax: 2.5.5.16
AttributeID: 1.2.840.113556.1.6.1.1.6224

cn: FailedPwdLockOutTime
OMSyntax: 65 (for Large integer/Interval)
lDAPDisplayName: FailedPwdLockOutTime
isSingleValued: TRUE
AttributeSyntax: 2.5.5.16
AttributeID: 1.2.840.113556.1.6.1.1.6225

Modify Web Config File:
When using the Active Directory Provider you will be required to modify the Web config to map the Failed Password Answer Count, Failed Password Answer Time and Failed Password Answer Lockout Time attributes to the appropriate User’s properties (as created above) in either your Active Directory or ADAM.

<membership defaultProvider=”ADAMProvider”>
   <providers>
      <add

connectionStringName=”ADCnString”
connectionUsername=”CN=ADAdmin,OU=Users,O=ADAuth”
connectionPassword=Pass@word1
connectionProtection=”None”
requiresQuestionAndAnswer=”true”
enablePasswordReset=”true”
attributeMapPasswordQuestion=”PwdQuestion”
attributeMapPasswordAnswer=”PwdAnswer”
attributeMapFailedPasswordAnswerCount=”FailedPwdCount” attributeMapFailedPasswordAnswerTime=”FailedPwdAnswerTime”
attributeMapFailedPasswordAnswerLockoutTime=”FailedPwdLockOutTime”

(Adding the attributes to the user clasee)

From the Schema Console, click the Class folder. Scroll down to the User class, right-click it, and select Properties. On the user Properties dialog box, click the Attributes tab, which Figure 7 shows. Click Add, then choose the Gender attribute. Click OK twice, and you’ve successfully added the Gender attribute to the User class.

I’ve been spending some time looking at the Forms Based Authentication solution that is part of the CKS – it has some great web parts and management forms for working with forms based authentication in SharePoint – but I did find that there are a couple of things to make sure you do before everything will work for you correctly that I thought I would share here.

When activating the user management feature you get an error about a dependant feature not being installed

When you run the setup script you might find that you get yourself into some trouble when the feature “FBAManagementSelf” tries to activate, complaining that a feature that is a dependency of this one is not installed. Technically this is true, the feature it is looking for isn’t installed and that is because it was cut from the solution. So the fix here is to update the feature.xml file and remove the dependency. Browse to 12\TEMPLATE\FEATURES\FBAManagementSelf in windows explorer and open feature.xml and remove these lines:

<ActivationDependency FeatureId="01AA8D8B-000A-4c35-8F4F-5D1280377650" />
<!--  My Settings Save Override  -->

“Object reference not set to instance of an object” error on FBA User Management page

This one had me stumped for a short while, but wasn’t too hard to figure out. Basically what was happening when I clicked on the link from the site settings page I would keep getting the good old NullReferenceException error message there – after downloading the source code and debugging this it became pretty easy to figure out. Basically what this page is doing by default is showing a list of users in the current site that are forms based authentication users – so if none of your FBA users exist in the user info list in the site, then there will be nothing returned and the exception is thrown.

The fix is easy – go in and grant one of your FBA users permission to the site somewhere. This will add them to the list and then when you browse back to the page you will find the exception is gone and you can see the list now.

Apart from that the install and setup was fine for me, just set up your forms based authentication source just like you would normally, and then install this solution to get all the extra goodies and you are off and running!

I’ve been off in Costa Rica sunning and exploring for a few weeks, but now I’m back and it’s time to get back to work!

The first thing I wanted to post about is a new blog you might want to check out.  My partner in crime Sympraxis Consulting has, after a little urging, started his own blog at http://psterpe.wordpress.com.  Pete’s a much better writer than I, so if you watch his blog, I’m certain that you’ll not only learn a few things, but also enjoy the experience.  Pete’s first set of posts is about Adventures in SharePoint Forms Based Authentication.  If you read through these four posts, you should have a good understanding of the basics of FBA.

Since I’ve joined Intervate Cape Town, I’ve been assigned to three projects. Two are Microsoft Office SharePoint Server 2007 (MOSS) solutions, and a small web site based on the Kentico Content Management System (CMS). It’s been a while since I worked with MOSS, so I had to relearn a lot of things. The one MOSS solution was an extranet application, that used Windows (Active Directory) and Forms Based Authentication (FBA). Initially I was a bit confused at how SharePoint handles FBA, and to make matters worse there are some overlapping terms between FBA and the rest of SharePoint’s security model.

Here’s briefly what I learned:

• Permissions assigned to SharePoint groups and users are referred to as roles in the SharePoint Object Model (SOM).
• FBA, which is just standard ASP .NET Forms authentication, also has roles. These roles correspond with SharePoint Security’s concept of a group, and has nothing to do with SharePoint permissions.
• SharePoint handles users and roles coming from ASP .NET Membership the same way as those coming from Windows AD. ASP .NET’s Membership becomes just another credential store to SharePoint. You add an ASP .NET user/role in the same manner as you’d add a Windows AD user/group to a SharePoint user/group. When you search for users/groups you’ll notice that those coming from ASP .NET Membership are prefixed with AspNetSqlRoleProvider:, or aspnetsqlmembershipprovider: for ASP .NET roles, and users respectively.
• It’s best to deploy SharePoint customizations using a SharePoint solution file (.wsp). But where’s a good guide to explain how this works? Well, luckily we have good blogs like the The Bonobo Journal to explain it in layman’s terms.
• Make sure you understand the do’s and don’ts of writing optimal code for SharePoint’s Object Model. Andreas Grabner from InfoQ did an excellent post on this subject.

The other project I got assigned to was done in Kentico. Yes, I had the same confused expression when I heard about it. Turns out Kentico is a really neat .NET CMS that doesn’t get in your way. It’s jam packed with features, and has every standard web technology, like blogs and wikis, out of the box (and they are all really well implemented). What I really appreciate about Kentico is that it’s got a really well designed and simple architecture, based on standard ASP .NET components. When you extend Kentico with custom code you literally open the Kentico Visual Studio solution and start creating ASP web pages (modules), and user controls (web parts). To debug something you just run the solution, and debug it as you’d do with any normal .NET web app. This enables developers to use a familiar development and deployment process.

Kentico arranges it’s web sites as a hierarchy of nodes. Each node has a document type (with its own table in the database), a form/data view, and a page/UI view. To retrieve any document is a straightforward matter:

CMS.TreeEngine.TreeProvider tree = new CMS.TreeEngine.TreeProvider();

treeNode = tree.SelectSingleDocument(CMSContext.CurrentDocument.DocumentID);         

var nodeSet = tree.SelectNodes(CMSContext.CurrentSiteName, treeNode.NodeAliasPath + "/%", treeNode.DocumentCulture, true, "cms.file");

The above code finds the node of the current document shown to the user, and then retrieves all its child nodes. This kind of simplicity is found throughout Kentico, from the application itself, right down to the database. It also provides multiple extension points. You can use the application itself to create new document types, and plug your own code in without using Visual Studio. Your other options are to write your own web parts, and modules in Visual Studio. And lastly if you really wanted to, you can directly query the database. Corresponding directly with the database should not be your first choice, but Kentico provides a database API that assists you in this regard.

The deployment process is also as easy as it gets. To install Kentico you can either use the setup file, or just copy your solution over and connect it to the database. From there on you just export your sites, and import them again on the target server. And yes, Kentico even exports/imports any custom classes that you might have added to it’s Visual Studio solution.

And if you think Kentico is only for small web sites, think again. There’s support for load balancing and server farms. Definitely give Kentico’s free version a try next time your client doesn’t demand SharePoint.

Configuring FBA on MOSS 2007 is fairly straight forward, but if you do not pay attention to each step, you could be in a world of pain.  I found the configuration pretty simple and the value it gives the organisation immense.

I did however run into one small issue on my initial testing server.  The famous “Uknown Error”.  This error occurred as I tried to authenticate my user.  Turns out I had forgotten to give the application pool identity rights to the custom database created for my FBA user store.  Once allocated all worked like a charm.

I couldn’t find anything on the net about this so either everyone started from scratch when they saw this error or simply haven’t run into it.  In any event, hope this helps!

//11 November 2009//

Found this really good post on step by step configuration of FBA.  Just thought I’d add it – http://www.simple-talk.com/dotnet/windows-forms/configuring-forms-authentication-in-sharepoint-2007/

This post serves me as a list of items to do when configuring FBA from scratch in SharePoint. It is by no means self explanatory or exhaustive.

1. Create a new web application call it Intranet, extend it and call that Extranet. Extranet is to live in Extranet zone.

2. Run “aspnet_regsql.exe -E -A all -S DatabaseServerName”

3. Create web application proj in VS to add users via Website ASP.NET Web Configuration. In web.config of this web app set authentication mode = “Forms”, and add connection string setting to the database created in step 2.

4. In Extranet and central admin web.config

Add the following two blocks of configuration settings.

<system.web>

  <!-- membership provider -->

  <membership defaultProvider="AspnetSqlMembershipProvider">

    <providers>

      <remove name="AspnetSqlMembershipProvider" />

      <add name="AspnetSqlMembershipProvider"

           type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

           passwordStrengthRegularExpression=""

           connectionStringName="SqlProviderConnection"

           passwordAttemptWindow="10"

           enablePasswordRetrieval="false"

           enablePasswordReset="true"

           requiresQuestionAndAnswer="false"

           applicationName="/"

           requiresUniqueEmail="false"

           passwordFormat="Hashed"

           minRequiredPasswordLength="3"

           minRequiredNonalphanumericCharacters="0"

           />

    </providers>

  </membership>

  <!-- role provider -->

  <roleManager enabled="true" defaultProvider="AspnetSqlRoleProvider">

    <providers>

      <remove name="AspnetSqlRoleProvider"/>

      <add name="AspnetSqlRoleProvider"

           connectionStringName="SqlProviderConnection"

           applicationName="/"

           type="System.Web.Security.SqlRoleProvider,System.Web,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b03f5f7f11d50a3a"

           />

    </providers>

  </roleManager>

  <!-- other settings -->

</system.web>

<configuration>

<connectionStrings>

  <add name="SqlProviderConnection" connectionString="Data Source=VM-WSSDEV;Initial Catalog=AspNetDb_FBASpike;Integrated Security=True" />

</connectionStrings>

</configuration>

5. In central Admin

6. Add app pool identity user to sql server  assign dbo role to the database created in 2.

7. Add users created in step 3 to Site Collection Admin

8. Download and deploy FBA Tools and Utils for SharePoint 2007 to manage users, roles within SharePoint.

 Zoom In         Whole Page Overview    

In der Version Opera Mini 4.0 werden Sharepoint Seiten in der Regel korrekt angezeigt. In der Beispielseite  oben werden jedoch nicht alle eingebetteten JavaScrips (Gadgets, Widgets usw) korrekt dargestellt. Das Google Custom Search Widget funktioniert einwandfrei während das Laufschrift Gadget auf dem Handy nicht angezeigt werden kann, da dieses Gadget spezielle Funktionen aufruft, die auf dem Handy nicht verfügbar sind. Leider gibt es noch keine Listen, welche Gadgets und Widgets auf Handys mit Symbian Betriebssystem einwandfrei laufen. Da hilft nur ausprobieren. Im Allgemeinen funktionieren Java Script mit einfachen Eingabfeldern und Push Buttons. 

Das Prinzip des Transcoding Servers macht auch Probleme beim Login zu gesicherten Websites. Sharepoint Sites können vom Provider unterschiedlich konfiguriert werden für die Benutzerauthentisierung. Für Basic Authentication werden im Google Mini Benutzername und Passwort optional im Handy gespeichert, sodaß der Benutzer diese nicht immer wieder eingeben muss. Forms Based Login, das bei MOSS 2007 gerne verwendet wird, ist kritisch und funktioniert häufig auch auf dem Opera PC Browser nicht, da Opera weniger tolerant gegenüber falsch aufgesetzten Servern ist als etwa der Internet Explorer oder Firefox Browser.  Dies führt dazu, dass Benutzername und Passwort nicht gespeichert werden oder dass der Zugriff überhaupt nicht möglich ist. Da hilft wiederum nur ausprobieren. Es hilft dabei auch nicht, auf den kostenpflichtigen Opera Mobile Browser umzusteigen, da die beiden Versionen des Opera Mobile Browser  die gleichen Basiskomponenten verwenden.

Falls der Zugriff zu einem gesicherten Sharepoint Portal (speziell MOSS 2007) überhaupt nicht funktioniert, kann eigentlich nur der Hosting Provider helfen.