Author: paranoidmike

A Product Manager sharing experiences on & of the job.

InfoPath forms error – one of the most obscure I’ve ever seen…

Published on by paranoidmike3 Comments

I had an InfoPath web form configured, working well, and ready to deploy.  I let my colleague know about it and when he tried it out a day or two later, he was getting an error message I hadn’t myself seen:

Warning

There has been an error while processing the form.

Click Continue to resume filling out the form. You may want to check your form data for errors.

Click Start Over to load a new copy of the form.

Show error details

When I browsed the Details of the error message, InfoPath Forms Services showed me this:

An error occurred accessing a data source.

An entry has been added to the Windows event log of the server.
Log ID: 5566

Not much help there, but I kept trying to figure this out.  I tried from different browsers (same error) and from different PCs (still same).

I got the bright idea to check the settings in the Data Connection in the InfoPath template I’d designed, but everything looked the same – even the URL that I was using to retrieve an XML representation of the List data (according to this helpful blog entry on “Accessing SharePoint List Data as XML” and “Populating form data from SharePoint List Views”).  However, when I tried completing the Data Connection wizard for this existing connection, I was getting blasted with this error:

The file is not a valid XML file.
The file is not a valid XML document.
A document must contain exactly one root element.
  Line 1, Position 0

I wondered if I’d messed up the permissions on the List, so I verified that I and my colleague had Read & Contribute permissions (so the Form would load), and I even added back the “System Account” with its Limited Access (using the “trick” documented in this blog article).  Still nothing.

When I tried to load that URL in a browser, the page it returned was blank, and even when I looked at the View Source, there wasn’t anything helpful there:

I retried this over and over for a few days, re-examining the URL in the Data Connection, triple-checking the GUIDs (thinking they must’ve gotten changed somehow during a recent tweak to the List), and wondering what I’d done wrong (or what had gotten horked up on the servers).

And the Solution Is…

Eventually I tried some googling on “A document must contain exactly one root element”, and finally returned to my old friends, the InfoPathDev.com and SharePointBlogs.com sites.  When I arrived back at the “Accessing SharePoint List Data as XML” article, one of the comments jumped out at me:

I can’t get this to work on a List that contains a Lookup field.  I just get a blank page in the browser. Have you encountered this too? Any ideas?

Bingo!  One of the recent tweaks I’d made was to convert a field in the list from using the “Choice” data type to the “Lookup” data type.  (Note: using a Lookup to a separate List enables me to delegate maintenance of that list of Choices to my team members, without asking them to muddle around in the bowels of my List’s Column settings.)

All I had to do was to remove the one Lookup field from the View I was retrieving in this Data Connection, and the web Form started working again (without any changes or re-Publishing necessary, even!).  I even confirmed that the URL, when used in a browser, would return a readable XML document (though you have to View Source on the returned page, which looks just as blank in IE8 as the failing one).

Lesson: if you’re going to leverage SharePoint Lists as XML data sources in your InfoPath Forms, make sure that the View you select does NOT include a Lookup field.  I told you this was obscure…

Categories XML

Obama White House – starting to feel a lot like Christmas

Published on by paranoidmikeLeave a comment

I’m getting awfully excited about the team that Obama is building. Biden’s track record & poise, the behind-the-scenes bulldog who’s going to be chief of staff, Clinton’s abilities/intelligence, Richardson’s sheer ability to articulate… It’s like the Bizarro world version of the Bush White House.

Especially after the past two years’ painfully-drawn out campaigning, the forced antagonism, the hyper scrutiny of every little difference between presidential candidates. Now, to see some of the strongest, smartest Democratic candidates all coming together to form such a solid team – it’s like this is the reward for sufering the last couple of decades of rampant Republican deconstructivism.

Actually, the first thought when I realized that we had these five (and others) I’m the same cabinet was, “this is starting to make me think of The West Wing [the fantasy White House that most of us had wished was really running the country]” – above all, with more collected intelligence and good intentions than I could’ve hoped would come together to lead this country.

I’ve been saying for the last couple if years that I’d be happy with a president that accomplished exactly *nothing* during their term, after the retarded clearcutting & international embarrassment of the tenure of the Connecticut Chimp. Now I’m actually looking forward to not just a period of healing from the road rash W has left behind, but real improvement in the lives of significant numbers of people (both inside and outside the US) that really *need* the help [instead of just lining the pockets of those who’ve already enriched themselves at the expense of the hard workers whose backs bore the burden of the conquistadors].

I’m not quite retardedly naive to think this will be a scandal- or failure-free era, but it’s awesome to not have to grit my teeth every time the president is about to open his mouth and prove how “special” he really is.

Can non-Microsoft ERM (electronic rights management) be integrated into MOSS 2007?

Published on by paranoidmike4 Comments

Fascinating question: can an organization that has deployed MOSS 2007 plug in another ERM/IRM (Electronic Rights Management) technology into the MOSS back-end, so that documents downloaded from MOSS would be automatically protected with that non-Microsoft ERM technology?

MOSS 2007 (aka SharePoint 2007) provides integration with the Microsoft Information Rights Management (IRM) technology – any documents that are uploaded to an “IRM-enabled” Document Library will automatically be (encrypted and) protected with a specific IRM policy whenever that document is downloaded again.  This depends both on the Microsoft implementation of IRM (RMS) policies (known as “Information Management Policy” in the MOSS SDK) as well as the inclusion of the Microsoft IRM “lockbox” (security processor) library on the MOSS server farm.  As I understand it, the procedure is basically:

  1. MOSS receives the download request from a remote client
  2. MOSS looks up the information management policy that is associated with the document’s List or Content Type (depending where the policy is applied)
  3. MOSS calls an instance of the IRM security processor (installed with the RMS Client on the front-end servers) to (a) encrypt the document, (b) generate the IRM license based on the associated policy, and (c) encrypt the content encryption key with appropriate RM Server’s public key. 
  4. MOSS delivers the protected document to the remote client – otherwise the same way that it would deliver an unprotected document.

Guessing How Third-Party ERM Could Integrate Into MOSS

So theoretically, for a third-party ERM solution to properly intercept the steps in this sequence:

  • the MOSS server would have to request a method/API that is “pluggable”
  • the MOSS server would have to support the ability to “plug” alternative ERM policy services in place of the native Microsoft IRM policy services
  • the MOSS server would have to support the ability to “plug” an alternative security processor in place of the native Microsoft RM security processor
  • the ERM solution would have to implement the pluggable responder for the “policy lookup” service, as well as a replacement UI and business logic framework for the server-side ERM policy “creation/assignment” capability that MOSS provides for IRM
  • the ERM solution would have to support a thread-safe, multi-threaded, rock-solid-stable security processor that could run in a potentially high-volume server environment

Given how much effort Microsoft has gone to in the past couple of years (not without external incentives, of course) to make available and document the means for ISV’s to interoperate with Microsoft client and server technologies, I’d figured there must be some “open protocol” documentation that documents how an ISV would create compatible ERM components to plug into the appropriate locations in a MOSS environment.

I scoured the SharePoint protocols specifications, but there were no specific protocols documents, nor any mention of “information management” in any of the overview documents.

There are some occasional references in the Microsoft Forums and elsewhere that hint at details that might be relevant to a third-party ERM plugin for MOSS, but I can’t tell if this is actually related or if I’m jus chasing spectres:

Aha!  It Appears the Answer is “Yes”

(I thought about erasing and rewriting the above, but there’s probably someone somewhere who thinks the same was I do about this, so I’ll leave it and just share my new insight below).

As always, I really should’ve started with the WSS 3.0 SDK and then branched out into the MOSS SDK and other far-off lands.

It turns out that the WSS SDK had the “secret” locked up in a page entitled “Custom IRM Protectors” (not to be confused with the forum post linked above).  My theory above didn’t nearly guess correctly, but it most closely resembled the “Autonomous Protector”:

Create an autonomous protector if you want the protector to have total control over how the protected files are rights-managed. The autonomous protector has full control over the rights-management process, and can employ any rights-management platform. Unlike the process with an integrated protector, when Windows SharePoint Services invokes an autonomous protector, it passes the specific rights that the user has to the document. Based upon these rights, an autonomous protector is responsible for generating keys for the document and creating rights-managed metadata in the correct format.

The autonomous protector and the client application must use the same rights-management platform.

So for a third-party ERM vendor to support an integrated experience in MOSS, while still using its non-Microsoft ERM client (i.e. not the Microsoft RMS Client), it would have to:

  • provide a COM component on each MOSS web server that implements the I_IrmProtector interface and an I_IrmPolicyInfo_Class object (analogous to my theorized “alternative ERM policy service”).
  • provide a rights management platform that protects (at the server) in a way that’s compatible with protections enforced by their rights management client (e.g. an alternative security processor available either locally or remotely from each MOSS web server)
  • override the default “integrated protectors” for Microsoft Office document types, and (presumably) support the ability to protect the Microsoft Office document types with the autonomous protector(s)

If I’m reading this right, then with a server-accessible rights management platform and one or more autonomous protectors, MOSS would be able to handle the rest of the required functionality: policy storage, UI, management interfaces (business logic), etc.

Now I wonder if anyone has actually implemented this support in their ERM solution…

"you most closely resemble survey respondents within the Omnivores typology group"

Published on by paranoidmikeLeave a comment

Apparently I too am a technology/information Omnivore, according to the Pew Internet & American (?) Life project.

Basic Description
Members of this group use their extensive suite of technology tools to do an enormous range of things online, on the go, and with their cell phones. Omnivores are highly engaged with video online and digital content. Between blogging, maintaining their Web pages, remixing digital content, or posting their creations to their websites, they are creative participants in cyberspace.

Defining Characteristics
You might see them watching video on an iPod. They might talk about their video games or their participation in virtual worlds the way their parents talked about their favorite TV episode a generation ago. Much of this chatter will take place via instant messages, texting on a cell phone, or on personal blogs. Omnivores are particularly active in dealing with video content. Most have video or digital cameras, and most have tried watching TV on a non-television device, such as a laptop or a cell phone.

Omnivores embrace all this connectivity, feeling confident in how they manage information and their many devices. This puts information technology at the center of how they express themselves, do their jobs, and connect to their friends.

When I read this description, it reminded me of something my wife Robin has repeatedly pointed out about me: I am one of the least social people she knows. I rarely make social plans with anyone (including her), I don’t naturally or voluntarily engage with people outside of work, and I am quite comfortable (or at least not dissatisfied) staying home with my TV, laptop and dogs.

So how to reconcile these two states of being – the “meatspace” Mike, who doesn’t engage in any social contact, and the “cyberspace” Mike, who engages with strangers, colleagues and friends with nary a second thought, on a frequent, bleeding edge basis? I have to assume that the cyberspace activities of an Omnivore are not just a pleasant and easy means of interacting with friends/family/colleagues, but are in part a way of shielding ourselves from the demands of the meatspace environment where the interactions are somehow (cf. Introvert) more draining, demanding and threatening.

I am the same person, but in these differing situations I am able to engage in much different ways – and it appears that I’m on a trajectory that will increase the divergence between my social and cyber personalities.

I don’t know what to make of that – whether it’s a natural progression of the aging Introvert, or if there’s some progressive neurochemical change that’s making it harder to engage in person (and thus I’m biased more towards the distant/electronic/asynchronous interaction), or maybe I just don’t have the strength, adrenaline and childish curiosity that I did in my 20’s.

Apparently I too am a technology/information Omnivore, according to the Pew Internet & American (?) Life project.

DLL Injection in Windows: what security countermeasures can you use?

Published on by paranoidmikeLeave a comment

Manage the Administrators group

Examine any default install of Windows since NT4 SP6.  You’ll notice that the SeDebugPrivilege is assigned by default only to the .\Administrators local group of the Windows host.  While this isn’t exactly unusual for users to be members of Administrators on their own PC, don’t think that every user or process automatically gets this capability in Windows.

cuffedCountermeasure: If you want to assert an explicit distinction between those who do and do not have the SeDebugPrivilege on a Windows system, explicitly manage the membership of the Administrators local group.  This is especially useful (and applicable) to Windows Servers, where most of your users won’t have (or have need for) this membership.

How to implement:

  • run the net localgroup command locally e.g. with these parameters: “net localgroup Administrators NAME_OF_USER_OR_GROUP_TO_REMOVE /Delete” (or run it remotely via a remote-shell tool such as psexec.exe)
  • configure a Group Policy (e.g. using Active Directory group policy) that sets the membership of the Administrators group using the Restricted Groups security setting (either overwriting the existing membership or incrementally adding/deleting specified security principals)

Manage the SeDebugPrivilege

The obvious flipside of the default SeDebugPrivilege assignment is that you can change the security principals to whom the privilege is assigned.  In fact, if you review (or have implemented) the Microsoft Security Security Accelerators for Windows (Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008), you’ll find they recommend

Countermeasure: remove the Administrators group from the SeDebugPrivilege.

How to implement:

  • run the ntrights.exe Resource Kit command-line tool locally e.g. with these parameters: “ntrights.exe –u Administrators –r SeDebugPrivilege” (or run it remotely via a remote-shell tool such as psexec.exe)
  • configure a Group Policy (e.g. using Active Directory group policy) that removes all security principals that are assigned the SeDebugPrivilege privilege

Run Apps, Services as lesser-privileged user

So the first two BKMs are great and all, but there are still lots of situations where you can’t make these blanket changes to the entire OS (though thankfully virtualization is reducing these “shared system” problems).  You may have to find ways to launch one or more processes with different security context or privileges than the rest of the system – sometimes having to run something with more privilege than the rest of the system (e.g. try Sudo for Windows), but usually wanting to strip privilege and permissions away from specific processes.

jailbirdCountermeasure: use Windows’ Software Restriction Policy (aka SRP or “SAFER”) to strip the Token of as many groups and privileges as the application can tolerate.  You don’t have to set a restrictive policy for the whole system – you can set this on an application-by-application basis (which can be practical in server environments, where you may only have a few critical applications to have to protect from each other).

How to implement:

  • Download and use Michael Howard’s SetSAFER application, which will strip varying levels of privileges and groups from the security token assigned to the process (thus making it more difficult for the process to access privileged objects in Windows).  If you want to dig into the code for this, and if the source code isn’t available, you can take a look at the code included in the original article (on which SetSAFER was based), or fire up DotNet Reflector and inspect the MSIL for the SetSAFER “executable”.
  • You could also try “psexec –l” (which implements one of the approaches taken by SetSAFER – one of the “stripped-down profiles”).

 

Something about this feels like I’ve missed another approach that should be mentioned in this context, but I’m sure there’s smarter folks than I reading this who can add any missing details to the picture.  Thanks, and have fun with this!