I am moving on. I am leaving Microsoft and joining Caradigm, a Microsoft/GE joint venture, as security engineer. I won’t be updating this blog going forward. I will keep blogging on my personal blog at www.PracticeThis.com.

I was with Microsoft for 8 years, 6 years as a Principal Consultant with MCS (Microsoft Consulting Services) in the field working with enterprise customers and 2 years as Senior Programming Writer in Server and Cloud Division creating content for identity related technologies – WIF, AD FS, ACS, Graph API – and how they fit in the cloud dev story.

Here are few highlights related to my tenure at Microsoft.

Principal Consultant at Microsoft Consulting Services (2004 - 2010)

• On-hire took on struggling big project (hundreds of billable hours) and drove to customer’s success and as a result signing up for another three years retainer.
• Created and delivered Security Engineering delivery kit, generated pipeline to allow to hire two more security consultants.
• Created and delivered Performance Engineering delivery kit, generated pipeline to help another consultant to get off the bench beyond my utilization and capacity.
• Received WW Services CTO award for services community contribution in security engineering space.
• 6 years of utilization consistently above the target without burnout. This is how (slides avail here).
• Contributed for several patterns&practices guides: Improving Web Services Security, Team Development with Visual Studio Team Foundation Server, A Guide to Claims-Based Identity and Access Control (2nd Edition)
• Made ton of friends at Microsoft, with Customers, and within the Industry.

Sr. Programming Writer at Server and Cloud Division (2010 - 2012)

• Developed Information Architecture (IA) for developers content. Applied the IA for WIF, ACS, Graph API, AD FS SDK and RMS SDK content.
• Developed and applied Agile Content Engineering practices.
• Drove delivery and created original content for ACS 2.0.
• Drove delivery and created original content for WIF 4.5 through BUILD, Beta, and RC milestones.
• Drove AD FS SDK content improvements.
• Drove delivery and created original content for Graph API.
• Created original content for Windows Azure Security Guidance.

Things I Have Learned

This is partial list of things I have learned during my tenure at Microsoft:

• How to apply proven engineering practices
• How to ask cutting questions
• How to ask for effective feedback and give one
• How to assess architecture, code, and deployment of an app
• How to avoid paralysis by analysis
• How to be ahead of the pack
• How to be aligned with business
• How to be always prepared to move on
• How to build a knowledge map
• How to build commitments and deliver on it
• How to build network of v-peers using WIIFM
• How to carry out a simple message to the masses about complex topic
• How to coach/mentor and be coached/mentored
• How to cope with tough people
• How to cope with tough situations
• How to deliver value incrementally
• How to discover latent needs
• How to distinguish doing vs. achieving and focus on the later
• How to drive execution forward
• How to effectively communicate on emails and verbally
• How to get in the game quickly
• How to give effective presentation
• How to hold effective meetings
• How to identify and avoid drainers and stick with catalysts
• How to invest time in technology that matters
• How to know what’s hot and what’s not
• How to listen to customer needs
• How to manage conflict
• How to manage emails
• How to manage energy
• How to manage information
• How to manage time
• How to manage up (vs. kiss up)
• How to win hearts and minds optimizing around usefulness and usability
• How to plan and deliver daily, weekly, monthly, and annually
• How to prepare to interview (as interviewer and interviewee)
• How to read the signs time to move on
• How to reduce friction
• How to sell an idea to difference audiences
• How to set clarity on vision, mission, values, deliverables, execution
• How to share information effectively
• How to use social media to collect feedback and drive adoption
• How to write sample code that others can use effectively and efficiently
• How to write effective guidance

Thank you, Microsoft, and thank you all who helped and inspired me along the way.

My LinkedIn profile is here. Connect with me. Recommend me.

• Download the code sample: Authenticate and Read and Object From Windows Azure AD

It demonstrates the following key features:

• How to request JWT token from Windows Azure AD Access Control using symmetric key.
• How to authenticate with the JWT token to Windows Azure AD using Graph API.
• How to read Windows Azure AD Object using Windows Azure AD Graph API.

It effectively reflects on the following scenario:

• Creating Enterprise Applications by Using Windows Azure AD Graph

I have used the following resources to implement the sample:

• Sample Application for Azure Active Directory Graph API (RESTful API). I cannibalizes code from this sample.
• Windows Azure Active Directory Graph Prerequisites. I have used this content to sign up for Office 365 which effectively gives me a Windows Azure AD subscription.
• How-to: Authenticate To Windows Azure AD Graph Using Windows Azure AD Access Control. I have used this sample to request JWT token. The difference is that in the How-To Client Certificate is used as a credential and in my sample I use symmetric key as a credential.
• How-To: Implement Role-Based Access Control When Using Windows Azure AD Graph. I have used this How-To to create Service Principal and add it to a proper role. If I don’t add the Service Principal to a proper role then the request for the JWT token will result in the insufficient privileges exception.
• How-to: Read Windows Azure Active Directory Objects Using Windows Azure AD Graph. I have used this How-To to request actual data from Windows Azure AD using Windows Azure AD Graph API.

Subscribe to Office 365 to get your Windows Azure AD subscription, grab the sample and start programming against it using the sample and the How-To’s.

Related

• Windows Azure Active Directory (AD) Graph API and Hybrid Cloud Identity
• Windows Azure Security Guidance – Focus on Identity and Access
• Office 365 With Federated Authentication, Identities In Active Directory

Here are key sections of the guidance:

• Windows Azure Active Directory Graph Overview
• Getting Started With Windows Azure Active Directory Graph
• Windows Azure AD Graph Features
• Windows Azure AD Graph Scenarios and Solutions
• Troubleshooting Windows Azure AD Graph
• Windows Azure AD Graph How-to Procedures Index
• Windows Azure AD Graph Code Samples Index
• Windows Azure AD Graph Entities Reference

Related

• Windows Azure Active Directory (AD) Graph API and Hybrid Cloud Identity
• Windows Azure Security Guidance – Focus on Identity and Access
• Office 365 With Federated Authentication, Identities In Active Directory

Scott Guthrie mentioned Graph API in his keynote (01:03:10). There is also drill down session during Teched by Ed Wu:

Session Code: SIA322

Directory Graph API: Drill Down

Speaker(s):

Edward Wu

Thursday, June 14 at 4:30 PM - 5:45 PM in S310E

This session introduces the new Directory Graph API, a REST-based API that enables access to Windows Azure Active Directory (Directory for Office 365 Tenants and Azure customers). We review the data directory model, the Graph API protocol (based on Odata V3 protocol), how authentication and authorization is managed, and demonstrate an end-to-end scenario. We walk through sample code calling the Directory Graph API. A roadmap is also reviewed. #TESIA322

With the introduction of Graph API the hybrid (public/private) cloud identity story becomes even better:

• Deploy your app anywhere – Windows Server, Windows Azure.
• Manage your identity anywhere – Windows Server AD or Windows Azure AD, and they sync!
• Authenticate and query user’s profile from on-prem/private and public cloud.

Consider the following high level model to help embracing the idea of the hybrid cloud organization identity:

Related:

• Windows Azure Security Guidance – Focus on Identity and Access
• Office 365 With Federated Authentication, Identities In Active Directory
• Windows Azure Active Directory on MSDN

Hybrid Identity for Developers.vsd

• ASP.NET Web Form Application with Federated Authentication. In this scenario you control access to your ASP.NET Web Forms app using either Internet identity such as Live ID / Microsoft Account or corporate identity managed in Windows Server Active Directory.
• WCF (SOAP) Service with Federated Authentication.In this scenario you control access to your WCF (SOAP) service using Service Identities managed by Windows Azure AD Access Control.
• WCF (SOAP) Service with Federated Authentication, Identities in Active Directory. In this scenario you control access to your WCF (SOAP) web service using identities managed by corporate Windows Server Active Directory.
• WCF (REST) Service With Federated Authentication.In this scenario you control access to your WCF (REST) service using Service Identities managed by Windows Azure AD Access Control.
• WCF (REST) Service With Live ID / Microsoft Account, Facebook, Google, Yahoo!, Open ID. In this scenario you control access to your WCF (REST) service using Internet identity such as Live ID / Microsoft Account.
• ASP.NET Web App to REST WCF Service Using Shared SWT Token. In this scenario you have distributed application with front end ASP.NET web app and downstream REST service and you want to flow end user’s context through physical tiers.
• Role-Based Access Control (RBAC) Authorization In Claims-Aware Applications and Services. In this scenario you want to implement authorization logic in your app based on roles.
• Claims-Based Authorization In Claims-Aware Applications and Services. In this scenario you want to implement authorization logic in your app based on complex authorization rules.
• Windows Azure Storage Service Identity and Access Scenarios.In this scenario you need to securely share access to Windows Azure storage blobs and containers.
• Windows Azure SQL Database Identity and Access Scenarios.SQL Database supports only SQL Server Authentication. Windows Authentication (integrated security) is not supported. Users must provide credentials (login and password) every time they connect to SQL Database.
• Windows Azure Service Bus Identity and Access Scenarios.In this scenario you need securely access Windows Azure Service Bus queues.
• In-Memory Cache Identity and Access Scenarios.In this scenario you need to securely access data managed by in-memory cache.
• Windows Azure Marketplace Identity and Access Scenarios.In this scenario you need to securely access Windows Azure Marketplace datasets.

Give it a try. Consider leaving comments and suggestions how to improve it in the comments section at the end of the topic or through this blog. Huge thank you goes to Mike Howard for the shout out, the man and the legend and the author of epic book Writing Secure Code. Mike is now principal architect in Cybersecurity team in the field continuing to fight a good fight in the trenches.

Just published the article for the following scenario:

• ASP.NET Web App To REST WCF Service Delegation Using Shared SWT Token

Scenario:

In this scenario you are developing distributed application that includes front end ASP.NET web app and the backend REST WCF service. You are interested to use public identity providers, such as Live ID, Google, Facebook, Yahoo!, and OpenID 2.0, to authenticate users. You are also interested to flow the original identity of the end users down to the backend REST WCF service for authentication and authorization purposes at the backend.

Solution Approach:

Windows Identity Foundation (WIF) and Windows Azure Access Control Service (ACS) is used to solve this scenario. The approach is to have one relying party configured in ACS that issues SWT token. This SWT token is used with both front end ASP.NET web app and downstream REST WCF service. The signing keys shared with all three - ACS, ASP.NET RP, REST WCF RP.

Resources:

• Code Sample: ASP.NET Web App To REST WCF Service Delegation Using Shared SWT Token
• Visio Diagrams: ASP.NET to WCF (REST) Delegation With Live ID, Google, Facebook Using SWT.vsd

ASP.NET to WCF (REST) Delegation With Live ID, Google, Facebook Using SWT.vsd

This is second part following the first part, ASP.NET: Authentication With SWT Token Using Windows Azure ACS and WIF Custom Token Handler, of the overall scenario that should answer the following question:

How I can flow security context of end user through tiers between ASP.NET web app and the downstream REST WCF service?

Just published code sample on MSDN Code Gallery for the REST WCF part. Bits are here:

• REST WCF With SWT Token Issued By Windows Azure Access Control Service (ACS)

It largely follows the instructions available here:

• How To: Authenticate to a REST WCF Service Deployed to Windows Azure Using ACS

Next is to connect both parts and enable the scenario of flowing the security context of end user through the tier. The challenge will be to make the original SWT token that was issued for the front end ASP.NET web app available to the backend REST WCF service. Will outline in the third and final part of these series of blog posts.

Related

• Identity Flow Through Physical Tiers - ActAs Delegaton
• Calling REST Service On Behalf Of End User - OAuth 2.0 Delegation
• ASP.NET Relying Party to WCF (SOAP) Relying Party Delegation With Windows Live ID

How I can flow security context of end user through tiers between ASP.NET web app and the downstream REST WCF service?

Uploaded sample code to MSDN Code Gallery that shows how to use SWT token issued by Windows Azure Access Control Service (ACS). The bits are here:

• ASP.NET Security: SWT With Windows Azure ACS and WIF Custom Token Handler

The plan is next to add another Visual Studio Project to the solution based on the following walkthrough:

• How To: Authenticate to a REST WCF Service Deployed to Windows Azure Using ACS

The idea is simple – create one relying party in Windows Azure ACS and share the issued SWT token between the ASP.NET app and REST service. The challenge here is that WIF does not come with ready to use SWT token implementation and SWT token handler. To solve this scenario the code sample implements custom token handler, cannibalized from the following sample:

• Code Sample: Windows Phone 7 Application

Related

• Identity Flow Through Physical Tiers - ActAs Delegaton
• Calling REST Service On Behalf Of End User - OAuth 2.0 Delegation
• ASP.NET Relying Party to WCF (SOAP) Relying Party Delegation With Windows Live ID

Custom STS using WIF and ACS are used to solve this scenario, read the whole story here - ASP.NET Relying Party to WCF (SOAP) Relying Party Delegation With Windows Live ID

Related

• Identity Flow Through Physical Tiers - ActAs Delegaton
• Calling REST Service On Behalf Of End User - OAuth 2.0 Delegation

    If you are happy owner of Amazon Kindle reader you can now read www.PracticeThis.com blog on it.

    It’s a digital information age and it’s a thrill to experiment with what’s possible especially when the entry bar is so low.

Enjoy reading Practice This on Amazon Kindle.