Developing Secure Mobile Applications from SharePoint Presented by Seyfarth Shaw LLP and Something Digital

Size: px

Start display at page:

Download "Developing Secure Mobile Applications from SharePoint Presented by Seyfarth Shaw LLP and Something Digital"

Shannon Austin
10 years ago
Views:

1 Developing Secure Mobile Applications from SharePoint Presented by Seyfarth Shaw LLP and Something Digital

2 Glenn Ferrie Practice Manager Something Digital, LLC Mark Soriano Application Development Manager Seyfarth Shaw LLP Byong Kim Senior Legal Solutions Architect Seyfarth Shaw LLP Developing Secure Mobile Applications from SharePoint Presented by Seyfarth Shaw LLP and Something Digital June 10, 2014

3 Session Topics Seyfarth Shaw: Our journey upgrading SeyfarthLink to SharePoint 2013 to enhance the user s mobile experience Something Digital: Explore different methods of developing secure applications in SharePoint 2013

4 Polling

5 What mobile app do we build? Immediate business need was to bring SeyfarthLink, Seyfarth Shaw s client collaboration platform, to be supported on mobile devices Clients and attorneys constantly asked whether or not their ipad or iphone could be used Decision to not build a mobile application for the sake of it The Firm wanted to develop something that would be utilized instead of spending the time and resources to build an application for marketing purposes Factors for our decision making: Learning Curve Time/Cost Demand

6 What approach we used Conducted a 3 day strategy session with a consulting firm focused on mobile application development Discussed pros and cons for: Native Application Mobile Website Hybrid Application SharePoint 2013 vs SharePoint 2010 Mobility HTML5 SharePoint 2010 Mode Upgrade path Search Security Enhancements

Active Directory / NTLM On-premises Difficult to invite 3 rd parties Forms-base Authentication

7 SharePoint Security Then and Now THEN In earlier releases of SharePoint, IT Pros and developers could rely on Active Directory or Forms-based authentication. Active Directory / NTLM On-premises Difficult to invite 3 rd parties Forms-base Authentication Easier to invite 3 rd parties Developers managed user access 1 st class user management took time to develop No great story for mobile users here

SharePoint Security Then and Now NOW With SharePoint 2013*, IT Pros and developers can use existing protocols for authentication as well as Claims-based authentication.

8 SharePoint Security Then and Now NOW With SharePoint 2013*, IT Pros and developers can use existing protocols for authentication as well as Claims-based authentication. With appropriate configuration, identity can be federated across many applications spanning trust realms. *you can do this with SP 2010 Active Directory / NTLM Forms-base Authentication Claims-based Authentication Federated Identity Responsive Mobile Experience for SharePoint 2013 Improved compatibility with mobile browsers for Android and ios

9 SharePoint Security and Now Claims-based The Basics This is the simplest view of Claims-based Authentication Issuers: Active Directory, Office 365, Microsoft, Google, Yahoo, Facebook, etc.

Issuer SharePoint Security and Now Claims-based 3 4 5 2 How it works In this graphic you will see: you (aka the client), the issuer, and the relying party.

10 Issuer SharePoint Security and Now Claims-based How it works In this graphic you will see: you (aka the client), the issuer, and the relying party. The relying party is any application, service, or resource secured with claims-based auth Unauthenticated client requests access to relying party 2. Relying party redirects the client to the issuer 3. Issuer prompts client for identification 4. Client authenticates with the issuer 5. Issuer redirects secure request to relying party 6. Relying party provides access to the client

11 SharePoint Security SeyfarthLink Needed to refactor custom code that was specific to authentication Encoded format i:0#.w <domain>\<user> Any reference to username Navigation Documents Recent Activity SharePoint 2010 Mode Can leverage claims-based by conversion Upgrade path to 2013 for each site more difficult Decided to create fresh 2013 sites and migrate content ourselves F5 - Big IP Appliance Access Policy Manager (APM) Reverse Proxy Server Local Traffic Manager (LTM) Load balancer

12 SharePoint Mobile Responsive Design Out-of-the-box (OTB) vs Custom SharePoint Contemporary View SharePoint Device Channel - Detect specific device being used Hybrid SharePoint OTB Contemporary View and our own custom mobile responsive design Web Controls Example: Grids, Textboxes, Dropdowns Conversion of Telerik/.NET web controls to Telerik Kendo UI

13 SharePoint Mobile Responsive Design Transition from desktop to mobile device One webpart for both desktop and mobile experience Show/hide styles and functionality based on screen width/height Easier maintenance and support Mobile device agnostic Native device functionality limited

14 Client/Server Development Client Side JSON jquery CSS 3 Server Side WCF SharePoint Object Model

15 Testing Ramping up both onshore and offshore resources Automated testing when we can, but with mobile devices having team members be involved with usability testing Leverage existing/available tools Visual Studio 2013 Microsoft Test Manager Team Foundation Server Invested in mobile devices for testing iphone, ipad Nexus 7 Google Glass

16 DEMO: SeyfarthLink for Mobile Demo application SeyfarthLink - Desktop SeyfarthLink - Mobile (using responsive design)

Legend AD Active Directory STS Security Token Service RP Relying Party (App) Trust Reams A set of resources protected by an identity provider and its associated policy SharePoint Security and Now

17 Legend AD Active Directory STS Security Token Service RP Relying Party (App) Trust Reams A set of resources protected by an identity provider and its associated policy SharePoint Security and Now Federated Securtity enables collaboration across multiple systems, networks, and organizations in different trust realms. More info:

18 SharePoint 2013 Security Security Model Options / Platform Support

19 + DEMO: Federated Auth Sample SharePoint 2013 Online (data) Federated Authentication Office 365 Microsoft Azure AD ASP.NET MVC 4 + Bootstrap Azure Web Sites SharePoint 2013 CSOM

20 Free Stuff! Just for you FREE Online resources that will enable you to start creating mobile web sites with SharePoint 2013 and Azure including the source code from the SD Demo. Free SharePoint 2013 Trial: US/evalcenter/hh aspx Free Microsoft Azure Trial: Azure Dev Tools: Source code (GitHub): Telerik Kendo UI

21 The Office 365 Trust Center - trust-center-cloud-computing-security- FX aspx Links & References SharePoint, Security, Compliance Links for IT Pros and Developers configuring SharePoint environment on-premises or in the cloud. Overview of identity, authentication and authorization in Office Configure SP2013 for claims-based authentication - What s new in auth for SP2013

22 A Guide to Claims-based identity and access control Links & References continued More Links for IT Pros and Developers configuring SharePoint environment onpremises or in the cloud. Mobile security and authentication in SharePoint Federated Authentication Overview - What s new for mobile devices for SharePoint F5 BIG IP Appliance

23 Office Dev Center Developer Resources Links for devs Get some help. SharePoint 2013 / Azure Resources Articles, Walkthoughs, and Sample Code SharePoint for IT Pros Azure Dev Center Azure Doc Center

24 Questions We ll now open it up for questions

25 Thank You

SharePoint Development: When Out-of-the-Box Just Isn t Enough

SharePoint Development: When Out-of-the-Box Just Isn t Enough Henry Bernet Senior SharePoint Architect Pillsbury Winthrop Shaw Pittman Mark Soriano Application Development Manager, Seyfarth Shaw LLP Tim