When updating your Azure Function App storage account keys, if you specify the wrong key… You could get an error including the text:

Failed to update web app settings:  Bad Request  The storage URI is invalid ExtendedCode:04203 No valid combination of account information found

Fix

I found the older version of the key did not have the suffix listed.  When I generated the new key it did… thinking that it was invalid I removed it and then got this error.  Ensure that you copy and use the entire key as provided!

Example: DefaultEndpointsProtocol=https;AccountName=cs2d3de4593cb35x492dxa63;AccountKey=xxxxxxxxxxxxx==;EndpointSuffix=core.windows.net

Please drop me a note if you found this useful!

There are lots of ways to do things in Azure.  I could not find a current end to end sample of setting up and getting an Access Token using SSH on a Linux box.  I chose the latest Ubuntu image up in Azure Virtual Machines for this overview.  This is loosely based on this older blog which had you create a PEM certificate (which is no longer necessary) https://blogs.msdn.microsoft.com/arsen/2015/09/18/certificate-based-auth-with-azure-service-principals-from-linux-command-line/ .

Steps

Install Azure CLI 2.0

https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest

I am installing on Ubuntu: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-apt?view=azure-cli-latest

Login with an account that can create Service Principals using the interactive login (works with MFA): 

https://docs.microsoft.com/en-us/cli/azure/authenticate-azure-cli?view=azure-cli-latest#interactive-log-in

Select the Target Subscription:

In my case I have many subscriptions and I need to make active or select the one ending in ‘umption’.  Here are the commands to do that:

Create Service Principal with Certificate

https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli?view=azure-cli-latest

I used the default access and the  --create-cert option like this: az ad sp create-for-rbac -n "ForMyAutomationApp" --create-cert

Copy all this information as you will need it to login using this Service Principle (to test access).

Note that location of the .pem file.  Go there and you can list it out.  You will need information from this certificate later to verify the signature of this token:

Copy the public key which is the entire section after -----END PRIVATE KEY-----

Like this:

-----BEGIN CERTIFICATE-----
MIICoTCCA

…..

Y32P5WwcaOfX1hkzMtTj4DAmAAlhudWhnRmVBRUvSx7RmWMl1Fhe
+ufr0jY=
-----END CERTIFICATE-----

You will need this to test the signature of your JWT later.

Log out and test the Service Principal login (optional)

Using the information you copied when creating the service principal you can test access.  You may want to create your service principal with a certain role for access reasons.  The default is Contributor which is fine for me:

Sign the JWT Token

Note:  This is accurate at time of publication, but these are all 3rd party Open Source tools that may change.  Also I removed this service principal and PEM file before publishing file so this information won’t work for anything.

You will need to first get the certificate thumbprint.  You can get it using OpenSSL (which you may have to install) using this command.  You will need to enter the path to the PEM file you generated earlier:  echo $(openssl x509 -in /home/jsandersrocks/tmpgfr4s8q4.pem -fingerprint -noout) | sed 's/SHA1 Fingerprint=//g' | sed 's/://g' | xxd -r -ps | base64

The result is a small string which is the thumbprint: Pic3Y1tO/jwbLjppXwJdbiPAAro=

Create Token.js and run in node to create Signed JWT

I used VIM and created a file called token.js to create the signed JWT.  Choose appropriate values for your token based on the library documentation here: https://www.npmjs.com/package/jsonwebtoken 

In this script You need to add the highlighted portions from the data above to include the PEM file path to read the cert, the SHA1 thumbprint for x5t, the tenant ID in the aud field and finally the appId for iss and sub.

var jwt = require('jsonwebtoken');
var fs = require('fs');

var cert = fs.readFileSync('/home/jsandersrocks/tmpgfr4s8q4.pem');

var additionalHeaders = {

"x5t":"Pic3Y1tO/jwbLjppXwJdbiPAAro="

}

var myJwt = {

"aud": https://login.microsoftonline.com/72f988bf-XXXXXXXXXXXX-2d7cd011db47/oauth2/token,

"iss": "81ad91de-0844-4547-88ed-bffed69e45f1",

"sub": "81ad91de-0844-4547-88ed-bffed69e45f1",

"jti": "" + Math.random(),

"exp": Math.floor(Date.now()/1000)+7*8640000

};

console.log(myJwt);

var token = jwt.sign(myJwt,cert,{algorithm:'RS256', header:additionalHeaders});

console.log(token);

Install node.js if necessary and then the jasonwebtoken package using this command: npm install jsonwebtoken,

Finally run node pointing to your script file to generate the token!

Copy the Token and Verify the signature:

The signed token is the text above starting with “ey” and to the end of the string (in this case –SRg).

Go to https://jwt.io/ and paste your token into the first field.  Then past in the information from the public key (from the section above - Copy the public key ).

Next Steps

You can now use this JWT to get an access token and use this in REST APIs (see blog that inspired this in the opening statement). 

Here is an example of me generating a token and using it in curl to get an access token.  The actual access token is the field after “access_token” in the below output. 

Note that there are so many different ways to use this token and you can generate this many ways.  There are settings for expiration of this token and when it begins to be valid.  I leave that research to you as it is adequately documented.  A lot of these techniques are contained in the various libraries and APIs for different languages and I encourage you to use those whenever possible.

Please drop me a note if you found this useful!

I ran into an interesting error that I had to debunk where a customer thought with HTTP/2 on Windows Server 2016 which has IIS 10 installed, that this caused the error above.  That was not true!

Analysis

Looking at a network trace I could see that the client (Chrome) was advertising higher level encryption as accepted Cipher Suites but the server was coming back with Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) in the server hello reply

I spun up an Azure Cloud Service, ensured I could use HTTP/2 with no error and indeed, in my case I could see in the trace indeed, no error from Chrome and the Cipher Suite returned was: Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)

Knowing that SChannel will return the Cipher Suites in the order that they are prioritized, compared the unadulterated machine Cipher Suite order with the broken one and sure enough, the broken one had the wrong (non-default) order.  The way to check this is to run the following in a powershell command window:   get-tlsciphersuite  | foreach {$_.Name}.  For the broken case I saw the offending Cipher Suite listed as the 2nd item in the list.  Further queries revealed on startup them were manually setting the cipher suites due to some old requirements!

Solution

Don’t mess with the default cipher suite order as this is set correctly out of the box for the latest OS updates!  The default should serve you needs and is in the correct order.  ref: https://msdn.microsoft.com/en-us/library/windows/desktop/mt490158(v=vs.85).aspx is the listing for 2016

If this helped you, drop me a note!

Kudu is the .SCM interface for Azure App Services.  If you are running more than one instance of Azure App Services (for instance you have scaled out to 4 instances) and you need to get to the Kudu console to do something like kill a process, profile an instance or get a dump of a particular instance… you can use this technique.  This technique does not rely on ARRAffinity being set for the Application because that setting does not affect the Kudu site. 

Steps (with Instance Detective Extension)

Note that ASE is a special case and the Instance Detective Extension will not work.  You can use a powershell command to get the instances:  Get-AzureRmResource -ResourceGroupName <RG name>-ResourceType Microsoft.Web/sites/instances -ResourceName "<App Name>" -ApiVersion 2016-08-01 

In this example, I have a particular instance of my site (jsandersscale) that is problematic and I logged an error that point to Azure Instance ID 92294a.  I will use Chrome to ensure I am on the correct instance (1 of 4 allocated for this site) and profile that instance.

1. Download Publish Profile
   a.  From the Azure Portal, navigate to the Overview section of your app and download the publish portal from there by selecting ‘Get publish profile’ (make a note of where it downloads to so you can find it later:
   
2. Install Instance Explorer   
   a. Open you site’s Kudu page (https://<yourappname>.scm.azurewebsites.net) and select the ‘Site extensions’ section.  Click on the ‘Gallery’ tab then enter ‘Instance Detective’ in the search box and click on the ‘Search’ button.

          
   b. Click the ‘+’ icon to install the extension.  When it is done installing it tells you to ‘Restart Site’ so hit the ‘Restart Site’ button so you can use this:
   
   c.  From this (or the Installed tab) you can hit the Run Icon to start the extension.  The first time you run it, you need to supply the Publish Profile as pictured below.
   
   d.  Press the ‘Upload Publish Profile’ button and navigate to the publish profile you downloaded in step 1.

3. Use the Extension!
   Now the extension is loaded and you can connect to and perform various operations on the individual instances:
   

   

   
   

4. When finished you can uninstall the Extension
   Simply go back to the Installed Site extensions section and click on the ‘x’ icon to remove the extension:
   

Steps (without Extension)

In this example, I have a particular instance of my site (jsandersscale) that is problematic and I logged an error that point to Azure Instance ID 92294a.  I will use Chrome to ensure I am on the correct instance (1 of 4 allocated for this site) and profile that instance.

1. Identify the full Instance ID 
   a.  Go to Azure Resource Explorer (https://resources.azure.com), log in and click on the subscription node
   b.  Type the name of your site in search box and click on the app to navigate to it:
   
   c.  Click on the ‘instances’ node of your app to get a list of the instances and search for the partial Instance ID:
   
   d.  Copy the full “name” that starts with the partial instance id.  This is what we will use for the ARRAffinity Cookie.
   
   In this case it is: 92294a4eceea77fdf386fdf56832c40e0b95a40e7628c943f2f1ba5a62eec768
2. Set the ARRAffinity cookie in Kudu
   a.  Log into Kudu using Chrome and go to the Environment tab to see what instance you are currently on (it will be one of the instances you see in Azure Resource Explorer above).
   
   b.  Hit the F12 key (or right click on the page and choose ‘Inspect’) and click on the ‘Application’ Tab.  Then click on ‘Cookies’ and the page (<yourapp>.scm.azurewebsites.net) and find the ARRAffinity cookie (you will see in this example it is not the one I want… as expected):
   
   c.  Change the ARRAffinity cookie value to be the target by double clicking on the old value and pasting in the new.  Then Tab out of the field  In this case it is: 92294a4eceea77fdf386fdf56832c40e0b95a40e7628c943f2f1ba5a62eec768
   
   d.  Now refresh the browser and close the developer tools.  You can confirm you are on the correct instance by looking at that value in the Environment Tab once again:
   

Conclusion

That’s it!  Now you can profile or get a dump of a particular process (note the ‘SCM’ process is not your app but is the Kudu process that hosts this Kudu site).

Please drop me a note if you found this useful!

Links

ARRAffinity
    Disable: https://blogs.msdn.microsoft.com/appserviceteam/2016/05/16/disable-session-affinity-cookie-arr-cookie-for-azure-web-apps/  
     General Discussion:  https://azure.microsoft.com/en-us/blog/disabling-arrs-instance-affinity-in-windows-azure-web-sites/

Kudu https://github.com/projectkudu/kudu/wiki

Azure Resource Explorer  https://azure.microsoft.com/en-us/blog/azure-resource-explorer-a-new-tool-to-discover-the-azure-api/

[DirectoryNotFoundException: Could not find a part of the path 'E:\sitesroot\0\bin\roslyn\csc.exe'.]
   System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) +548
   System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) +1159
   System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share) +133
   Microsoft.CodeDom.Providers.DotNetCompilerPlatform.Compiler.get_CompilerName() +127
   Microsoft.CodeDom.Providers.DotNetCompilerPlatform.Compiler.FromFileBatch(CompilerParameters options, String[] fileNames) +832
   Microsoft.CodeDom.Providers.DotNetCompilerPlatform.Compiler.CompileAssemblyFromFileBatch(CompilerParameters options, String[] fileNames) +189
   System.Web.Compilation.AssemblyBuilder.Compile() +2038
   System.Web.Compilation.BuildProvidersCompiler.PerformBuild() +325
   System.Web.Compilation.ApplicationBuildProvider.GetGlobalAsaxBuildResult(Boolean isPrecompiledApp) +406
   System.Web.Compilation.BuildManager.CompileGlobalAsax() +47
   System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled() +366

[HttpException (0x80004005): Could not find a part of the path 'E:\sitesroot\0\bin\roslyn\csc.exe'.]
   System.Web.Compilation.BuildManager.ReportTopLevelCompilationException() +76
   System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled() +642
   System.Web.Compilation.BuildManager.CallAppInitializeMethod() +34
   System.Web.Hosting.HostingEnvironment.Initialize(ApplicationManager appManager, IApplicationHost appHost, IConfigMapPathFactory configMapPathFactory, HostingEnvironmentParameters hostingParameters, PolicyLevel policyLevel, Exception appDomainCreationException) +927

[HttpException (0x80004005): Could not find a part of the path 'E:\sitesroot\0\bin\roslyn\csc.exe'.]
   System.Web.HttpRuntime.FirstRequestInit(HttpContext context) +534
   System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context) +119
   System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) +726

Cause

Fix

PowerShell can and does use System.Net classes to communicate over the wire.  This example will cover capturing a System.Net trace of the Azure PowerShell Publish-AzureWebsiteProject command-let.

Setup

Close any running PowerShell instances.  PowerShell reads the .config file when you first start the executable. 

Locate the PowerShell (or PowerShell_ise) executable so you can alter the application .config file (or create it).

On my Windows 10 machine the location of the PowerShell executable is here:  C:\Windows\System32\WindowsPowerShell\v1.0

Note the ‘CONFIG File’ for PowerShell.exe.  If you have file extensions turned on in Windows Explorer it they look like this:

If there are no .config files, don’t panic!  You simply will create one.

Open (or create) the appropriate .config file.  In my case I will not be using the integrated editor so I need to edit powershell.exe.config.  This directory is protected however so if you simply open it with notepad and try and save it, you will get this error: You do not have permission to open this file.  See the owner of the file or an administrator to obtain permission.  (Note: depending on how your machine is configured, you may have to take ownership of this file – do this in the security tab of the properties).

Open notepad (or your favorite editor), right click on the icon and find Notepad.exe,  and choose: Run as administrator:

Copy the .config file for a backup and name it something like PowerShell.exe.backupconfig.  You can use this to restore the .config file later.

Alter the .config file to enable System.Net tracing. Copy the trace configuration from my blog: https://blogs.msdn.microsoft.com/jpsanders/2009/03/24/my-favorite-system-net-trace-configuration-file-dumps-process-id-and-date-time-information/ and add it to the existing config file or create a new one if it does not exist.

In my case the <configuration> section already exists so I simply need the section and everything inside the <system.diagnostics> </system.diagnostics> section from the above blog:

Find the section: initializeData="System.Net.trace.log" .  This section tells where to write the log and the name of the file.  We cannot write to this directory so, change that entry to initializeData="c:\temp\System.Net.trace.log"

Save the .config file.

Create the directory c:\temp on your machine and you are all set to trace!

Start powershell and run the command you wish to trace.   In my example I navigated to the directory where my WebDeploy package was and typed: Publish-AzureWebsiteProject -Name jspowershellpublish -Package .\PowershellPublish.zip

Exit PowerShell and restore the .config file.  If you didn’t have a config file previously simply delete the file you created.  If you did have one, copy your backup .config file over top of the one you altered.

Read your trace and enjoy!

Conclusion

This blog is not intended to help you solve you issue but simply give you a tool to collect the System.Net trace.  Using System.Net tracing to analyze the network traffic in PowerShell is a powerful tool.  I hope this blog helps you grab that trace easily.  If you found this blog useful, drop me a note!

Open a Terminal

• Go to Finder and press Command + Shift + U
• Select Terminal
• Type the following:   sysctl machdep.cpu.brand_string

This returns something like this: machdep.cpu.brand_string: Intel(R) Core(TM) i7-5650U CPU @ 2.20GHz

The BOLD part is the processor number so continue to follow the instructions starting at step 2 below: Does My Processor Support Intel® Virtualization Technology?

In my case, yes this process does!

As a short cut (don’t have to look up the processor number) simply type: sysctl machdep.cpu.features

and see if it contains VMX

I could not find a good walkthrough so here is one for you.  Disclaimer:  This is on the latest OS and Latest version of Fiddler Beta

Steps

Install Mono – You can do this many ways but I wanted to do Xamarin development so I downloaded and installed Visual Studio for Mac and installed Mono as part of that installation:

https://www.visualstudio.com/vs/visual-studio-mac

Download Fiddler - https://www.telerik.com/download/fiddler/fiddler-osx-beta

You did step 1 of the instructions on this page already if you installed Visual Studio.

Move the ‘fiddler-mac’ folder somewhere you have write access to.  I chose my Applications Folder.  Open in Finder:

and then just drag and drop it into Applications:

And here it is!

Next find the Terminal app in LaunchPad and run it:

Navigate to the Applications folder: cd /Applications/fiddler-mac/

Pre the instructions I ran this:  mono fiddler.exe

And got this error:

WARNING: The Carbon driver has not been ported to 64bits, and very few parts of Windows.Forms will work properly, or at all

Stacktrace:

  at <unknown> <0xffffffff>

  at (wrapper managed-to-native) System.Windows.Forms.XplatUICarbon.CGDisplayBounds (intptr) [0x00002] in <36fbc38531724d82b10aef6ebafea6e9>:0

And this error because I never ran/accepted the xcodebuild license :  Agreeing to the Xcode/iOS license requires admin privileges, please run “sudo xcodebuild -license” and then retry this command.

To fix this I first ran: sudo xcodebuild –license

and then used the correct 32 bit command to run mono and fiddler: mono --arch=32 fiddler.exe

You next have to allow changes to your networking so you will be prompted:

And Fiddler will start running!

When you start capture, again you need to enter your password to reset the proxy.

Conclusion

Pretty simple but like I said, I had no luck finding a good workaround and the fiddler instructions did not have the sudo xcodebuild –license, nor the mono --arch=32 fiddler.exe commands

Drop me a note if you found this useful!

The Azure Mobile Apps quickstarts can support Swagger.  What if you want to disable this?  This walkthrough shows you where the Swagger routes come from and how to remove them

Walkthrough – Node.js backend

The Node.js implementation is simply a property.  All you need to do is remove the attribute in your code.  For example, if you are simply developing in the portal you can use the App Service Editor.  In your app chose ‘App Service Editor’ and hit go (pro tip shortcut:  It is simply https://<the name of your app>.scm.azurewebsites.net/dev/  “

Then navigate to the wwwroot/app.js file and change the existing entry swagger: true to swagger: false (the change will automatically be saved and restart the app):

If you are using source control, simply make the change in app.js to set swagger: false and push you changes to the app!

Walkthrough – C# backend

C# does not include swagger by default so you would have had to added it.  If you need to remove it, simply remove the code configuring swagger.  Example remove the call to ConfigureSwagger highlighted below:

Conclusion

Swagger is useful but you don’t need it most cases.  Let me know if you found this useful!

C# sample using swagger Ref: https://github.com/Azure/azure-mobile-apps-net-server/tree/master/samples/SampleApp