1. Reza Alirezaei, SharePoint MVP /MCTS Development Horizon, Corp. http://blogs.devhorizon.com/reza Twitter: @rezaal Turning Chaos into Order: Best Practices for Developing SharePoint Applications

2. Who am I? Microsoft MVP – SharePoint (2007, 2008) – SQL Server Reporting Services (2006) Microsoft Certified Technology Specialist – MOSS 2007 Configuration – MOSS 2007 Application Development Top 20 Contributor to MSDN Wiki 2006, 2007,2008 International SharePoint Professional Association Regional Evangelist (Canada) Architect/Instructor/Speaker – Enterprise level SharePoint application – Large scale Integration Projects

3. Agenda Dev Tooling Experience Configuration Performance Security Some Architectural Decisions

4. Prerequisites Good Understandings of SharePoint Dev Definitely Not a 101 session

5. Why do I care? Anti best practices: “I suppose it is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail.” Abraham Maslow

6. Most Popular Tools – WSPBuilder (Community) http://www.devhorizon.com/go/100 – STSDEV (Community) http://www.devhorizon.com/go/101 – VSeWSS (Microsoft) http://www.devhorizon.com/go/102 – Old School way Microsoft endorsement on VSeWSS Cleanup code is your responsibility SharePoint Uber Dev Tools

7. A Survey by Todd Bleeker (MVP)

8. DEMO Quick Overview of all three tools VSeWSS Solution Generator – VSeWSS WCF endpoint

9. Four most common solutions: – Settings in Solution Manifiest – SPWebConfigModification class – SharePoint List – Configuration From Web Services – Property bags (SPWebApplication.Properties) SPWebConfigModification’s Top 6 Issues http://www.devhorizon.com/go/103 Scope at Web Application, not Site collection Note: Persisted attributes in SPPresistedObject class as BLOB XML Configuration Management Strategy

10. DEMO

11. ONLY one slow Web Part… ONLY one slow Process…. No ASP.NET Async Luxury – No Async Page Directive – How many Web Parts on one page – How many instances of your Web Part on one page So, what are my *pure SharePoint* options? – Create a Worker Class to handle Async code – SPLongOperation Class – Use Built-in Functionalities -ed Event handlers Workflows CQWP DFWP “Execution in Parallel” is King!

12. Workflow or Event Handler? Cancel?Cancel? Event Receiver WorkflowWorkflow Human Interference ? Human Running > 5 min High Volume Yes

13. DEMO Asynchronous Dev

14. – MSDN Paper http://www.devhorizon.com/go/104 – Roger Lamb’s Blog http://www.devhorizon.com/go/105 –. Net Rule for Disposing Objects – Edge –Cases!! – SPDisposeCheck http://www.devhorizon.com/go/106 Memory Leaks

15. Edge Case -1 public class MyFeatureRec : SPFeatureReceiver { public override void FeatureActivated(SPFeatureReceiverProperties properties) { //Does the following reference to SPSite leak? SPSite site = properties.Feature.Parent as SPSite; }

16. Edge Case -2 public class MyClass: SPItemEventReceiver { public override void ItemUpdated(SPItemEventProperties properties) { //Does the following reference to SPWeb leak? SPWeb web = properties.OpenWeb(); }

17. Edge Case -3 public class MyClass: SPWebProvisioningProvider { public override void Provision (SPWebProvisioningProperties props) { //Does the following reference to SPWeb leak? SPWeb web = props.Web; }

18. My $0.02 Don’t Dispose in Edge Cases

19. DEMO SPDisposeCheck Edge Cases

20. How about this one? SPWeb oWeb = SPContext.Current.Web; //Does the following reference to SPSite leak? SPSite oSite = oWeb.Site; Say No To Disposing Of objects hanging off SPContext

21. IIS IIS Custom WPs/Procs MOSSMOSS WSSWSS CRL/Native APIs MDACMDACLDAPLDAP BDC Audience ExcelSrv Forms CMS Analytics Search Profiles All of these technologies must fit in a single 32-bit process MOSS is a Ecological System

22. x64 Issues – Many of the current dev tools run in WOW – Some tools don’t support x64 bit (STSDEV) – Infrastructure Cost – Not ISV friendly – VS 2008 WF Templates (Seq and State) not supported, but who cares?! x86 Issues Last slide + A lot more issues! Go hybrid & Build “ Any CPU” Artifact/WP development - don’t matter Protocol handlers/iFilters/ Document Convertors

23. App Pool Best Practices – Say No to Web Gardening Not supported Breaks Blob Cache (Wrong Header) – Leave App pools in Legacy Mode (a.k.a worker process isolation mode) – Most of the time, leave App Pool settings as it is – Stick to reasonable upper bounds of RAM utilization (850 Mb on x86 or 1.2Gb on x64)

24. List Capacity Planning Working with Large List Paper MSDN http://www.devhorizon.com/go/107 Recap of the MSDN paper on my blog http://www.devhorizon.com/go/108 Bottom Line is :  2000 items per list limit is …..  SPList w/DataTable or SPList w/for/each ……..  Escalation of SQL Server Lock on Lists Table is serious  Be cautious about using Collections & Avoid Using Indexes on each Call

25. Properly Working With Collections // BAD way SPWeb web = SPContext.Current.Web; string tasksID = web.Lists[“Tasks”].ID; string tasksTitle = web.Lists[“Tasks”].Title; // GOOD way SPWeb web = SPContext.Current.Web; SPList tasksList = web.Lists[“Tasks”]; string tasksID = tasksList.ID; string tasksTitle = tasksList.Title;

26. What is wrong with this code? SPList bigList = web1.Lists[“BigList”]; foreach(SPListItem item in bigList.Items) { if(item[“MyColumn”] == “Foo”) { Console.WriteLine(“Found One!”); }

27. SPList.Items gets a collection with ALL list items – Terrible for big lists – Lots of memory needed – Lots of SQL I/O – Lots of network – Lots of CPU Instead use SPList.GetItems – Takes a CAML query Working with SPList Say No To

28. – Content Query Web Part (QueryOverride Prop) – Data Form Web Part with FullTextSqlQuery Object – PortalSiteMapProvider Class Primarily used for navigation controls Optimized to query data not only across lists, but across webs Scope limited to the current site collection Limitations : – Not good for infrequent queries – Not good for frequently changed data – Uses the same shared caching facility in your site collection – MOSS Only

29. Options for Querying SP Data

30. Avoid Reporting directly off of SharePoint Databases Use OM Web Services RPC Calls (Remote) Use innate capability of your reporting tool – Lists or Database?

31. DEMO Reporting against Lists Aggregating of Content

32. Know your threat model and what security context your code runs on behalf of. http://www.devhorizon.com/go/110 GAC or BIN? – Event Receivers – Workflows – Provision Handlers – Web Parts if they’re being manipulated programmatically permcalc -Show utility in.Net Framework 2.0 http://www.devhorizon.com/go/111 NEVER raise the trust level in Web.config to FULL – NEVER! System Account = Application Pool Identity Elevation of Privilege – do it the right way! Security is NOT a Joke

33. DEMO Elevating the security context *Properly*

34. Only WSP deployment, but…. – Use timer Jobs to Sync up thing in your entire farm CKS:IEE http://www.devhorizon.com/go/109http://www.devhorizon.com/go/109 Don’t touch file system on a server directly Don’t touch file system by System.IO either Don’t use LOCK in timer jobs if targeting the farm Think Farm, NOT Standalone

35. Per-Customer Customization System Files ALL in WSP Package!

36. DEMO System.IO Love (Well, not really!)

37. References Professional SharePoint 2007 Web Content Management Development by Andrew Connell http://www.devhorizon.com/go/112 Francis Cheung (Microsoft patterns & practices) http://www.devhorizon.com/go/113 http://www.devhorizon.com/go/113 Patterns & Practices SharePoint Guidance http://www.devhorizon.com/go/114

38. THINK SHAREPOINT Last but certainly not least: http://blogs.devhorizon.com/reza