Office Web Controls

I tried out something new and interesting today.  The Office Web Controls (OWC) let you embed interactive Office documents into HTML documents.  These are installed with Office 2000+, or can be downloaded separately if you don't have Office installed.  I had assumed that OWC just let you embed a document in Internet Explorer, something already possible since the Office tools can site in within any ActiveX container, but these are completely different.

My example contained an XML schema, the XML document mapped to a workbook, a PivotTable, and a corresponding PivotChart.  Exposing the chart via interactive HTML worked great -- once I figured out the security implications.  Because of the client-side code execution (including connecting to databases depending on the example), you need to have proper security settings.  Enable the add-in and Allow Blocked Content and it will run fine, but I did learn something.  I assumed that I could open the HTML directly from its folder into IE 7.  It failed miserably.

Even after clicking OK to trust the website, it came up with an error trying to load the underlying XML file containing the mapped data.  Apparently it's a trust issue.  Unfortunatly you can't really set My Computer security (My Computer doesn't show up in security zones anymore), so I can't see anyway to make it work.  I found some blog links to show the My Computer security zone, but even though it showed up, IE locked out any changes.

I understand the need for heightened security in Internet Explorer considering all of the exploits with client-side code execution, but I need the ability to override them!  Of course if you can override such safety settings, then many users will override them, thus negating the safety benefits.

The simple answer to the OWC issue was to copy the files to the local IIS instance first.  I didn't need to create a new site or application -- I just created a folder in wwwroot and moved the files in.  I still get prompted to OK the controls, but now I can fine-tune the settings as part of the Local intranet zone.  For deployment to any web server, this would work pretty well, though end-users would need coaching on what to enable.

All in all, they give you some nice interactivity directly within the browser.  If you want to host Office-based reports without flattening the data to static HTML, this may be a way to do it.  If you can run code on the server, the ReportViewer control would be my first choice, but these are a great fallback.