Session delivered at the Australian SharePoint conference

1. Dealing with and Learning from the
Sandbox
Elaine van Bergen
OBS

2. Who Am I ?
• SharePoint 2010 MCM
• SharePoint MVP
• Co-organiser of Melbourne SharePoint User Group
(MSPUG)
• @laneyvb on Twitter

5. Types
• SharePoint online dedicated
• On-premise sandbox
• SharePoint online

6. Online Dedicated
• Unlikely to be used by Australian Customers
• May actually be hosted not dedicated
• Great case study for what Microsoft requires for
customisation
• Plenty of advice useful for all SharePoint developers

7. Design Process for Customisation
• Gather requirements.
• Create high-level design (HLD) document.
• Microsoft review of HLD.
• Develop custom solution.
• Test, package, and validate with MSOCAF.

8. Design Guidelines - Examples
• Use native SharePoint functionality when possible
• Evaluate the use of a client-side solution
• Create logical solution versioning
• Move business logic to separate classes
• Develop asynchronous code that connects to an
Internet address
• Ensure that dependencies to external systems are
managed correctly

9. Design Guidelines – Directory Structure
• Solution Artifacts
• Release
• Source code
• Installation scripts
• Test documentation
http://www.microsoft.com/download/en/details.aspx?displaylan
g=en&id=18128

10. MSOCAF
• Guidance Package
• Analyze Code
– Structure
– FXCOP
– Additional Rules
• Submit
https://caf.sharepoint.microsoftonline.com/Default.aspx

11. MSOCAF – Additional Rules
• SPList.Items
• SPListItemCollectionGetItemByID inside loop
• SPListItem.Update() inside loop
• Log Exceptions in Feature Receiver and Report Back
to SharePoint
• SharePointMonitorScope Webpart Check
https://caf.sharepoint.microsoftonline.com/Default.aspx

12. Demo
MSOCAF

13. SharePoint Online Dedicated
Great Guidance for ANY SharePoint
Development

14. On Premise Sandbox
• How does it work ?
• Why ?
• Development Setup

15. FRONT END BACK END
User Code Service
(SPUCHostService.exe)
Execution Manager
(Inside Application Pool)
Sandbox Worker Process
(SPUCWorkerProcess.exe)
IIS
(WPW3.EXE) Web.config / CAS Policies
Sandbox Worker Proxy Process
(SPUCWorkerProcessProxy.exe)

16. Deployment
• Solution Gallery at Site Collection
• Site Collection Admin uploads and activates solution
• Solutions are validated against policies
• No artefacts on file system
• No IIS Reset

17. Custom Validators
[GuidAttribute("34805697-1FC4-4b66-AF09-AB48AC0F9D97")]
public class PublisherValidator : SPSolutionValidator{
[Persisted]
List<string> _allowedPublishers;
public override void ValidateSolution(
SPSolutionValidationProperties properties){
}
public override void ValidateAssembly(
SPSolutionValidationProperties properties,
SPSolutionFile assembly){
}
}

18. Supported Artefacts

19. API Scope
• Sandboxed .Net Code
– Very limited subset of Microsoft.SharePoint
– Scoped to current SPSite and below
– No SPSecurity
– No web service , external data or other network
calls
• Client side code
– Silverlight
– JavaScript

20. ECMAScriptControlsand Logic
Browser
JSON Response
ECMAScript OM Server
XML Request
OM
Proxy
Client.svc
XML Request
Proxy
JSON Response Content
Managed OM
database
Managed Client
Managed Controls and Logic SharePoint Server

21. Server .NET Managed Silverlight ECMAScript
(Microsoft.Shar (Microsoft.Shar (Microsoft.Shar (SP.js)
ePoint) ePoint.Client) ePoint.Client.Sil
verlight)
SPContext ClientContext ClientContext ClientContext
SPSite Site Site Site
SPWeb Web Web Web
SPList List List List
SPListItem ListItem ListItem ListItem
SPField Field Field Field

22. Full Trust Proxy
• Operations in class that inherits
Microsoft.SharePoint.Usercode.SPProxyOperation
• Arguments in serializable class that inherits
Microsoft.SharePoint.Usercode.SPProxyOperationArgs
• Register full trust proxy
• Recycle user code service
• Consume via SPUtility.ExecuteRegisteredProxyOperation

23. Display Logic
Reusable/Complex Logic

24. Solution monitoring
• Protects Site Collection from resource intensive
solutions
• Resource Points measure resource consumption
• Site Collection Quota limits resource consumption
per day
• Absolute Limit limits cuts of solutions when limit hit

25. Monitored Metrics
Resources Per Absolute
Metric Name Description Units
Point Limit
Process gets abnormally
AbnormalProcessTerminationCount Count 1 1
terminated
CPUExecutionTime CPU exception time Seconds 3,600 60
CriticalExceptionCount Critical exception fired Number 10 3
Percentage Units of
PercentProcessorTime Note: # of cores not factored in Overall Processor 85 100
Consumed
Number of Threads
ProcessThreadCount Threads 10,000 200
in Overall Process
SharePointDatabaseQueryCount SharePoint DB Queries Invoked Number 20 100
Amount of time spent waiting
SharePointDatabaseQueryTime Seconds 120 60
for a query to be performed
UnhandledExceptionCount Unhanded Exceptions 50 3

26. Why ?
• Developers can deploy updates without IIS restarts
• Site Collection Owners can control loading of
solutions
• Complex code separated from display logic
• Solution performance can be monitored and
controlled
Rapid changes possible with low Governance

27. Development Setup
• Enable Microsoft SharePoint Foundation Sandboxed
Code Service via CA
• Download power tools
http://visualstudiogallery.msdn.microsoft.com/8e602a8c-
6714-4549-9e95-f3700344b0d9
• Download Silverlight toolkit
http://www.microsoft.com/web/gallery/install.aspx?appid=sil
verlight4tools;silverlight4toolkit;riaservicestoolkit

28. Sandbox modes
• Local Mode:
– Execute code on WFE
– Low administration overhead
– Lower scalability
• Remote Mode:
– Execute on dedicated SharePoint servers
– Load balanced distribution of code execution
requests

29. Demo
Sandbox Solutions

30. Common Pain Points
• Error Handling/Visibility
• Configuration Storage
• Limited API set
• Learning curve required

31. On Premise Sandbox
Promotes efficient , well designed code that
allows for rapid user interface change

32. SharePoint Online
• Development Process
• Data Access
• Authentication

33. spo.company.com/test
spo.company.com/prod
*.wsp
Upload/
Activate/
Deactivate
local.company.com

35. Data Access
• SharePoint data – Rest API, webservices, CSOM
• JSON-P calling services
http://www.wictorwilen.se/Post/SharePoint-Online-and-
External-Data-using-JSONP.aspx
• BCS + WCF Service + Client Object Model
• Applications put or get data to/from SharePoint

37. Authentication
• Claims + Federation + Multiple Authentication
Providers
• FedAuth cookie with HTTP Only Flag = WinInet.dll
• Active vs. Passive
COMPLICATED !
http://msdn.microsoft.com/en-us/library/hh147177.aspx
http://www.wictorwilen.se/Post/How-to-do-active-
authentication-to-Office-365-and-SharePoint-Online.aspx

38. SharePoint Online Sandbox
Authentication and Data Access need to be
carefully planned

39. Summary
Consider sandbox concepts as part of your
solution design
@laneyvb

40. Gold Sponsors
Silver Sponsors
Bronze Sponsors Media Sponsors