Reza Alirezaei , SharePoint MVP /MCTSDevelopment Horizon, Corp.http://blogs.devhorizon.com/rezaTwitter: @rezaal

Turning Chaos into Order: Best Practices for Developing

SharePoint Applications

Who am I?• Microsoft MVP

– SharePoint (2007, 2008)– SQL Server Reporting Services (2006)

• Microsoft Certified Technology Specialist– MOSS 2007 Configuration– MOSS 2007 Application Development

• Top 20 Contributor to MSDN Wiki 2006, 2007,2008

• International SharePoint Professional Association Regional Evangelist (Canada)

• Architect/Instructor/Speaker – Enterprise level SharePoint application– Large scale Integration Projects

Agenda• Dev Tooling Experience• Configuration• Performance• Security• Some Architectural Decisions

Prerequisites Good Understandings of SharePoint DevDefinitely Not a 101 session

Why do I care?

Anti best practices:“I suppose it is tempting, if the

only tool you have is a hammer, to treat everything as if it were a nail.”

Abraham Maslow

• Most Popular Tools– WSPBuilder (Community)

http://www.devhorizon.com/go/100

– STSDEV (Community)http://www.devhorizon.com/go/101

– VSeWSS (Microsoft)http://www.devhorizon.com/go/102

– Old School way

• Microsoft endorsement on VSeWSS• Cleanup code is your responsibility

SharePoint Uber Dev Tools

A Survey by Todd Bleeker (MVP)

DEMO

• Quick Overview of all three tools• VSeWSS Solution Generator– VSeWSS WCF endpoint

• Four most common solutions:– Settings in Solution Manifiest – SPWebConfigModification class – SharePoint List– Configuration From Web Services – Property bags (SPWebApplication.Properties)

• SPWebConfigModification’s Top 6 Issues http://www.devhorizon.com/go/103

• Scope at Web Application, not Site collection

• Note: Persisted attributes in SPPresistedObject class as BLOB XML

Configuration Management Strategy

DEMO

• ONLY one slow Web Part… ONLY one slow Process….

• No ASP.NET Async Luxury – No Async Page Directive– How many Web Parts on one page– How many instances of your Web Part on one page

• So, what are my *pure SharePoint* options?– Create a Worker Class to handle Async code – SPLongOperation Class – Use Built-in Functionalities

• -ed Event handlers• Workflows• CQWP• DFWP

“Execution in Parallel” is King!

Workflow or

Event Handler?

Cancel?Event

Receiver

Workflow

HumanInterference

?

Running > 5 min

High Volume Yes

Yes

Yes

Yes

DEMO

Asynchronous Dev

– MSDN Paper http://www.devhorizon.com/go/104

– Roger Lamb’s Bloghttp://www.devhorizon.com/go/105

– . Net Rule for Disposing Objects

– Edge –Cases!!

– SPDisposeCheckhttp://www.devhorizon.com/go/106

Memory Leaks

Edge Case -1

public class MyFeatureRec : SPFeatureReceiver {public override void FeatureActivated(SPFeatureReceiverProperties

properties){

//Does the following reference to SPSite leak? SPSite site = properties.Feature.Parent as SPSite;

}}

Edge Case -2

public class MyClass: SPItemEventReceiver {public override void ItemUpdated(SPItemEventProperties

properties) { //Does the following reference to SPWeb leak? SPWeb web = properties.OpenWeb(); }}

Edge Case -3public class MyClass: SPWebProvisioningProvider {public override void Provision (SPWebProvisioningProperties props) { //Does the following reference to SPWeb leak? SPWeb web = props.Web;

}}

My $0.02

Don’t Dispose in Edge Cases

DEMO

•SPDisposeCheck•Edge Cases

How about this one?

• SPWeb oWeb = SPContext.Current.Web;

• //Does the following reference to SPSite leak?•

SPSite oSite = oWeb.Site;

Say No To Disposing Of objects hanging off SPContext

IIS

Custom WPs/Procs

MOSS

WSSCRL/Native APIs

MDAC LDAP

BDC AudienceExcelSrv Forms

CMS Analytics

Search ProfilesAll of these technologies must fit in a single 32-bit process

MOSS is a Ecological System

x64 Issues– Many of the current dev tools run in WOW– Some tools don’t support x64 bit (STSDEV)– Infrastructure Cost– Not ISV friendly– VS 2008 WF Templates (Seq and State) not

supported, but who cares?!

x86 Issues Last slide + A lot more issues!

Go hybrid & Build “ Any CPU”• Artifact/WP development - don’t matter• Protocol handlers/iFilters/ Document Convertors

App Pool Best Practices – Say No to Web Gardening • Not supported• Breaks Blob Cache (Wrong Header)

– Leave App pools in Legacy Mode (a.k.a worker process isolation mode)

– Most of the time , leave App Pool settings as it is– Stick to reasonable upper bounds of RAM utilization

(850 Mb on x86 or 1.2Gb on x64)

List Capacity Planning

• Working with Large List Paper MSDNhttp://www.devhorizon.com/go/107

• Recap of the MSDN paper on my bloghttp://www.devhorizon.com/go/108

• Bottom Line is :2000 items per list limit is …..SPList w/DataTable or SPList w/for/each ……..Escalation of SQL Server Lock on Lists Table is serious Be cautious about using Collections & Avoid Using

Indexes on each Call

Properly Working With Collections

// BAD waySPWeb web = SPContext.Current.Web;string tasksID = web.Lists[“Tasks”].ID;string tasksTitle = web.Lists[“Tasks”].Title;

// GOOD waySPWeb web = SPContext.Current.Web;SPList tasksList = web.Lists[“Tasks”];string tasksID = tasksList.ID;string tasksTitle = tasksList.Title;

What is wrong with this code?SPList bigList = web1.Lists[“BigList”];

foreach(SPListItem item in bigList.Items){

if(item[“MyColumn”] == “Foo”){

Console.WriteLine(“Found One!”);}

}

• SPList.Items gets a collection with ALL list items– Terrible for big lists– Lots of memory needed– Lots of SQL I/O– Lots of network– Lots of CPU

• Instead use SPList.GetItems– Takes a CAML query

Working with SPListSay No To

– Content Query Web Part (QueryOverride Prop)– Data Form Web Part with FullTextSqlQuery Object– PortalSiteMapProvider Class

• Primarily used for navigation controls• Optimized to query data not only across lists, but across webs• Scope limited to the current site collection• Limitations :

– Not good for infrequent queries – Not good for frequently changed data– Uses the same shared caching facility in your site collection– MOSS Only

Options for Querying SP Data

SPLis

t w/ D

ataTab

le

SPLis

t w/ f

or/eac

h

Browse

r view

Lists.

asmx

SPLis

tItem w

/ Data

Table

SPLis

t w/ S

PQuery

Searc

h

PortalSi

teMap

Provid

er

201622

145552

3585 392 339 327 327 40

List with 100,000 items, Page Size of 100 Items, no Indexed Columns, Site Under Load

milliseconds

Avoid Reporting directly off of SharePoint Databases

• Use OM • Web Services• RPC Calls (Remote)• Use innate capability of your reporting tool– Lists or Database?

DEMO

• Reporting against Lists•Aggregating of Content

• Know your threat model and what security context your code runs on behalf of. http://www.devhorizon.com/go/110

• GAC or BIN?– Event Receivers– Workflows– Provision Handlers– Web Parts if they’re being manipulated programmatically

• permcalc -Show <assemblyName> utility in .Net Framework 2.0 http://www.devhorizon.com/go/111

• NEVER raise the trust level in Web.config to FULL – NEVER!

• System Account = Application Pool Identity

• Elevation of Privilege – do it the right way!

Security is NOT a Joke

DEMO

Elevating the security context *Properly*

• Only WSP deployment , but….– Use timer Jobs to Sync up thing in your entire farm

CKS:IEE http://www.devhorizon.com/go/109

• Don’t touch file system on a server directly

• Don’t touch file system by System.IO either

• Don’t use LOCK in timer jobs if targeting the farm

Think Farm, NOT Standalone

Per-Customer Customization

System Files ALL in WSP Package!

DEMO

System.IO Love

(Well, not really!)

References

• Professional SharePoint 2007 Web Content Management Development by Andrew Connell

http://www.devhorizon.com/go/112

• Francis Cheung (Microsoft patterns & practices) http://www.devhorizon.com/go/113

• Patterns & Practices SharePoint Guidance http://www.devhorizon.com/go/114

THINK SHAREPOINT

Last but certainly not least:

http://blogs.devhorizon.com/reza