DEV290 Building Office Solutions with Visual Studio Eric Carter Lead Developer Developer Platform & Evangelism Microsoft Corporation

Our Challenges Today’s IT situation Deployment and maintenance issues favor Web applications Security concerns limit the use of Office solutions Today’s developer situation Web UI is “limiting” It’s hard to develop a rich Web UI Inconsistent user experience is common No offline support Developers typically use VBA to customize Office applications and now want to use Visual Studio

Our Goals Incorporate the richness of client Office apps with the benefits and advantages of Visual Studio Make smart client application development on the Office System: Secure More reliable Easier to deploy, maintain and upgrade Faster to develop Make Office a first class development scenario in Visual Studio Make Visual Studio a first class tool for building Office solutions

Visual Studio Tools for Office Extends.NET development to Office 2003 Developers using Visual Studio 2003 can write code to run behind Word and Excel documents Write code in VB.NET or C# In beta now msdn.microsoft.com/vstudio/office MSDN Developer and Subscriber Downloads RTM in mid-2003

Writing Code Behind Excel Part 1 demo demo

Developer Productivity Developer uses the Visual Studio IDE Choice of languages – VB.NET or C# Robust code model based on.NET Framework Powerful access to data and XML Via ADO.NET and system XML classes Support for the latest XML Web service specifications WS-Security, WS-Routing, WS-Attachments Existing Office development knowledge carries forward

Office Integration CLR loader is part of Word and Excel It installs with Office Pro and above Doc properties point to the assembly Same directory, SharePoint site, UNC, etc. Assembly calls into Office via COM Interop Uses PIAs (Primary Interop Assemblies) delivered with Office Requires FullTrust, but 3rd party code can be restricted

Review: How Does It Work? Developer writes code Creates assembly Sets document properties Deploys assembly to centralized location Designer formats document for end users End user opens document Office uses document properties to locate and download assembly CLR verifies assembly is OK to run CLR runs code

Deployment Developer can store solutions on a trusted corporate network Code is downloaded locally when a user opens a Word or Excel document Users get updates to code automatically with no action required on their part Users must have CLR on their machine Note: Don’t rely on Office shipping CLR

Writing Code Behind Excel Part 2 demo demo

Managed Code Loading Process User opens document Custom Props? Trusted doc? Trusted code? New / Open event fires No Doc Only No Doc Only Download assembly No Unload AppDomain Fail Hook up events Yes FailYes Create AppDomain Fail Load CLR Yes Fail

Assembly Security Office “High, Medium, Low” macro dialog box and “managed add-in proxy shims” don’t apply to these assemblies Local machine’s.NET Framework 1.1 security policy governs the assemblies You can set security two ways.NET Framework Configuration (UI version) caspol.exe (command-line version)

.NET Framework Configuration

Trusted Code Default CLR policy trusts all code on local machine Not a good idea for Office documents! Office loader removes all Zone permissions My Computer: FullTrust  Nothing Also removes “All Code” permissions Must explicitly trust assemblies Location is easy, but relatively weak We recommend using publisher or strong name Visual Studio trusts code in development Automatically trusts assembly location

Trusted Documents Helps prevent malicious re-use of trusted code By default Documents on the local machine are trusted Documents on the network are not trusted attachments are not trusted Assign trust through.NET policy Use URLs to trust locations Use MSOSEC (Microsoft Office Security) to trust documents This provides a form of document-based evidence that the CLR will understand

Dealing with Malicious Code What happens when someone changes the custom doc properties to point to potentially malicious files? By default, no code runs A user must consciously decide to trust code What happens when someone tries to swap a trusted assembly with a potentially malicious assembly? A hacker needs the appropriate permissions to replace the assembly at the given location What can you do to prevent these types of situations? Only trust assemblies you know come from safe sources Consider using more robust security methods such as publisher, strong name, or digital signature

Security and Deployment demo demo

Summary Build Word 2003 and Excel 2003 solutions with Visual Studio 2003 Visual Studio provides improvements in productivity.NET Framework provides improvements in deployment, maintenance and security Existing investments move forward

Ask The Experts Get Your Questions Answered I will be available in the ATE area after this session

Community Resources MS Community Sites List of newsgroups microsoft.public.vsnet.vstools.office microsoft.public.word.programming microsoft.public.excel.programming microsoft.public.office.developer.vba Attend a free chat or webcast Locate a local user groups Community sites

Suggested Reading And Resources The tools you need to put technology to work! TITLE Available Today Microsoft ® Windows ® Server 2003 TCP/IP Protocols and Services Technical Reference Kit Active Directory ® for Microsoft ® Windows ® Server 2003 Technical Reference Today Microsoft Press books are 20% off at the TechEd Bookstore Also buy any TWO Microsoft Press books and get a FREE T-Shirt

Community Resources Most Valuable Professional (MVP) Newsgroups Converse online with Microsoft Newsgroups, including Worldwide User Groups Meet and learn with your peers

evaluations evaluations

© 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.