SharePoint: Rendering inside iframes

October 31, 2014 - 16:35, by Steven Van de Craen - 32 Comments

This post is a revision of an old blog post on rendering Excel Services in an iframe on a different domain. This is prohibited because a HTTP response header X-FRAME-OPTIONS: SAMEORIGIN is added to the response. The issue isn’t limited to Excel Services but is applicable to any SharePoint-hosted page that you want to visualize in an iframe.

Consider the following:

  • SharePoint 2013 will always render the X-FRAME-OPTIONS header, even for regular pages. Adding an AllowFraming control to the page fixes that, but doesn’t cover all situations
  • You can’t add the AllowFraming control to Office Web Apps or InfoPath Forms Server (“FormServer.aspx”)
  • Clicking on (pdf) documents in a Document Library in the iframe will fail to load them because the document is a different request
  • You have a basic “integration” between different systems (like Dynamics CRM) and SharePoint content that uses iframes

This content cannot be displayed in a frame


This is a HttpModule that can be activated per Web Application by Web Application Feature and will ensure that all pages will render inside an iframe. The module will set values that will prevent SharePoint from trying to inject the header in the first place, but for some exceptions (Office Web Apps 2010, XLViewer 2013) it is still required to actually remove the header at the end of the request.

Please visit the Codeplex Repository to read more about this addon and for installation instructions:

Excel REST API not refreshing data

February 20, 2014 - 07:00, by Steven Van de Craen - 0 Comments

We’re using the Excel REST API in SharePoint 2010 to visualize some graphs directly on a web page. The information is stored in an Excel workbook in a document library and that had connections to backend data stores. The connection settings inside the workbook were configured with credentials inside the connection string. However we noticed that the graphs on the web page would not update unless we opened and saved the workbook.

Trusted File Locations

There’s a setting in your Trusted File Locations (in the configuration of the Excel Service Application) that you have to check, in order to have the REST API update the connections.

Allow External Data Using REST 

Unattended Service Account

Even if you have credentials inside the connection string, you’ll still need to configure an Unattended Service Account because the ECS engine will impersonate that user to “open” the workbook.

This is quite accurately logged in the ULS logs, but somehow we missed it at first:

02/10/2014 10:50:59.25  w3wp.exe (0x2268)        0x0540  Excel Services Application            Excel Calculation Services             c35r                Medium               CredentialsProvider.GetCredentials: the following exception occurred when trying to acquire the unattended account credentials: Microsoft.Office.Excel.Server.CalculationServer.Interop.ConnectionException: Exception of type 'Microsoft.Office.Excel.Server.CalculationServer.Interop.ConnectionException' was thrown.     at Microsoft.Office.Excel.Server.CalculationServer.SecureStoreHelper.GetSecureStoreCredentials(Request request, String secureStoreApplicationId, Boolean delegateUser)     at Microsoft.Office.Excel.Server.CalculationServer.UnattendedAccount.GetCredentialsFromStore(Request request)     at Microsoft.Office.Excel.Server.CalculationServer.UnattendedAccount.GetCredentials(Request request)     at Microsoft.Office.Excel.Server.CalculationServer.CredentialsProvider.GetCredentials(Request request, ConnectionInfo connInfo, String dataConnectionName, Credentials& credentials)            38a5d8ad-09a0-45eb-af89-ebf908bee2fc

02/10/2014 10:50:59.25  w3wp.exe (0x2268)        0x0540  Excel Services Application            External Data     3237       Information                Unable to establish connection using only the connection string. If a username and password are saved in the connection string, they may not be correct, or the Unattended Service Account may not be configured. [Session: 1.V23.619PvoW1uPgVeMNVtZtgxpi90.5.en-US5.en-US73.-0060#0000-10-00-05T03:00:00:0000#+0000#0000-03-00-05T02:00:00:0000#-006036.227417de-0d92-42c3-ad24-3f32334d87e21.N User: 0#.w|domain\user1]         38a5d8ad-09a0-45eb-af89-ebf908bee2fc

Configuring an Unattended Service Account is a matter of setting up a Secure Store Service Application and Target Application, and then configure the Excel Service Application to use that Application ID for Unattended Service Account.

Secure Store Service Application

Excel Unattended Service Account

Now we finally have up-to-date graphs on our web page without opening and saving the workbook.

SharePoint 2007: December Update

December 29, 2008 - 12:16, by Steven Van de Craen - 0 Comments

This update really combines all previous updates so installation order is simplified.

  1. WSS SP1 (+ for all language packs)
  2. MOSS SP1 (+for all language packs)
  3. WSS December Update: x86 - x64 (separate downloads !)
  4. MOSS December Update: x86 - x64 (separate downloads !)

More info about that here: Announcing December Cumulative Update for Office SharePoint Server 2007 and Windows SharePoint Services 3.0

If you're extracting the MOSS December Update for 64 bit (368073_intl_x64_zip.exe) you might run into this error:

An error occurred while unzipping. One or more files were not succesfully unzipped. The error code is 110.

A workaround is to extract the archive using WinRAR ( and it will extract the files (you still need the password from the email of course).

Infrastructure Update, August Update, October Update, Service Pack 2

October 30, 2008 - 13:43, by Steven Van de Craen - 3 Comments

update (December Update):

The December Update was released recently and is a real cumulative update which simplifies installation quite a bit. Read more about it here: SharePoint 2007- December Update


It's hard to keep up with the updates for SharePoint these days.

Only yesterday I upped one of our servers to August Cumulative Update (link) and the very same day a post about the October Cumulative Update (link) appears.

Can't wait for Service Pack 2 (link) to bundle all previous fixes into a single package.


Figured I'd post my own rundown on this (compiled using the information from the above links) and a screen of the corresponding hotfixes. Don't worry about the 6 different languages; that's just because some of our setups have them as language pack.

Installation order

01. WSS 3.0 SP1 (x86, x64)
    > Language Pack SP1 (x86, x64) is advised for all LPs

02. MOSS 2007 SP1 (x86, x64)
    > Language Pack SP1 (x86, x64) is advised for all LPs

03. The WSS 3.0 Infrastructure Update (x86, x64)
    > not language specific (the download is identical for all languages)

04. MOSS 2007 Infrastructure Update (x86, x64)
    > not language specific (the download is identical for all languages)

05. KB953397: Excel Server Security Update (Global) (x86, x64)
    > not language specific

06. KB955586: Document Lifecycle Workflow Update (x86, x64)
    > not language specific (even though filename mentions en-US)

07. KB956057: August Cumulative Update for WSS 3.0 (Global) (x86 only)
    > not language specific

08. KB957109: August Cumulative Update for WSS 3.0 (Local) (x86, x64)
    > must be installed for each SKU or LP language

09. KB956056: August Cumulative Update for MOSS 2007 (Global) (x86 only)
    > not language specific

10. KB957691: October Cumulative Update for WSS 3.0 (Global) (x86 only)
    > not language specific

11. KB957693: October Cumulative Update for MOSS 2007 (Global) (x86 only)
    > not language specific

12. KB958567: October Cumulative Update for MOSS (Local) (x86, x64)
    > must be installed for each SKU or LP language

13. KB958569: October Cumulative Update for MOSS 2007 Workflow (Global) (x86 only)
    > not language specific


Q & A

Q. Is the WSS Language Pack a prerequisite for the MOSS Language Pack ?
A. No, the WSS Language Pack is required only for standalone WSS installations. Yes, as cleverly noted in the comments by Peter Depoorter the following article (link) mentioning this requirement. Thanks Peter !

Q. Do all Language Packs need to be the same level (eg. SP 1) as each other or the main product ?
A. You can mix different levels of Language Packs but needless to say it is best to have the latest version of all.

Q. Is there an Infrastructure Update or Cumulative Update for Language Packs ?
A. At current the latest Language Pack level is SP1. There are no IU, ACU or OCU updates for the Language Packs yet.

Q. Some hotfixes are only for 32bit (x86) so where can I find the 64bit variant ?
A. If there's no 64bit version listed then it only applies to 32bit setups.

Q. I'm getting "The expected version of the product was not found on your system" when running update X ?
A. We've seen this twice and it was due to Language Packs not having SP1 applied. So make sure all (both WSS and MOSS) language packs are updated to the latest version.

Hope this clears things up a bit !

Excel Services Trusted Locations and Alternate Access Mappings

December 20, 2007 - 12:10, by Steven Van de Craen - 0 Comments

Yesterday I discovered that Excel Services' Trusted Locations don't use the Alternate Access Mappings collection from MOSS 2007 to grant or deny access to a workbook inside a SharePoint Document Library.

I did a search on the Web and apparently it is already a known issue:

Excel Services will not load workbooks from sites that are mapped to internal sites that are listed as trusted locations in SharePoint Server 2007


This issue has NOT been fixed in Service Pack 1