Create an Azure VM with a new Active Directory Forest

Create the Key Vault

Create the Virtual Machine Template

[code language='javascript' ]
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters":
  {
    "region":
    {
      "type": "string"
    },
    "vmName":
    {
      "type": "string"
    },
    "nicName":
    {
      "type": "string"
    },
    "vmSize":
    {
      "type": "string"
    },
    "vmAdminUsername":
    {
      "type": "string"
    },
    "vmAdminPassword":
    {
      "type": "securestring"
    },
    "domainToJoin":
    {
      "type": "string"
    },
    "domainUsername":
    {
      "type": "string"
    },
    "domainPassword":
    {
      "type": "securestring"
    },
    "ouPath":
    {
      "type": "string",
      "defaultValue": "",
      "metadata":
      {
        "description": "Specifies an organizational unit (OU) for the domain account. Enter the full distinguished name of the OU in quotation marks. Example: 'OU=testOU; DC=domain; DC=Domain; DC=com"
      }
    },
    "domainJoinOptions":
    {
      "type": "int",
      "defaultValue": 3,
      "metadata":
      {
        "description": "Set of bit flags that define the join options. Default value of 3 is a combination of NETSETUP_JOIN_DOMAIN (0x00000001) & NETSETUP_ACCT_CREATE (0x00000002) i.e. will join the domain and create the account on the domain. For more information see https://msdn.microsoft.com/en-us/library/aa392154(v=vs.85).aspx"
      }
    },
    "windowsOSVersion":
    {
      "type": "string",
      "defaultValue": "2012-R2-Datacenter",
      "allowedValues":
      [
        "2008-R2-SP1",
        "2012-Datacenter",
        "2012-R2-Datacenter",
        "2016-Datacenter"
      ],
      "metadata":
      {
        "description": "The Windows version for the VM. This will pick a fully patched image of this given Windows version. Allowed values: 2008-R2-SP1, 2012-Datacenter, 2012-R2-Datacenter."
      }
    },
    "storageSku":
    {
      "type": "string",
      "allowedValues":
      [
        "Standard_LRS",
        "Premium_LRS"
      ]
    }
  },
  "variables":
  {
    "OSDiskName": "[concat(parameters('vmName'),'osdisk')]",
    "imagePublisher": "MicrosoftWindowsServer",
    "imageOffer": "WindowsServer"
  },
  "resources":
  [
    {
      "apiVersion": "2016-04-30-preview",
      "type": "Microsoft.Compute/virtualMachines",
      "name": "[parameters('vmName')]",
      "location": "[parameters('region')]",
      "tags":
      {
        "displayName": "VirtualMachine"
      },
      "properties":
      {
        "hardwareProfile":
        {
          "vmSize": "[parameters('vmSize')]"
        },
        "osProfile":
        {
          "computerName": "[parameters('vmName')]",
          "adminUsername": "[parameters('vmAdminUsername')]",
          "adminPassword": "[parameters('vmAdminPassword')]",
          "windowsConfiguration":
          {
            "provisionVMAgent": true
          }
        },
        "storageProfile":
        {
          "imageReference":
          {
            "publisher": "[variables('imagePublisher')]",
            "offer": "[variables('imageOffer')]",
            "sku": "[parameters('windowsOSVersion')]",
            "version": "latest"
          },
          "osDisk":
          {
            "name": "[variables('OSDiskName')]",
            "managedDisk":
            {
              "storageAccountType": "[parameters('storageSku')]"
            },
            "caching": "ReadWrite",
            "createOption": "FromImage"
          }
        },
        "networkProfile":
        {
          "networkInterfaces":
          [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]"
            }
          ]
        }
      }
    },
    {
      "apiVersion": "2016-04-30-preview",
      "type": "Microsoft.Compute/virtualMachines/extensions",
      "name": "[concat(parameters('vmName'),'/joindomain')]",
      "location": "[parameters('region')]",
      "dependsOn":
      [
        "[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
      ],
      "tags":
      {
        "displayName": "JsonADDomainExtension"
      },
      "properties":
      {
        "publisher": "Microsoft.Compute",
        "type": "JsonADDomainExtension",
        "typeHandlerVersion": "1.3",
        "autoUpgradeMinorVersion": true,
        "settings":
        {
          "Name": "[parameters('domainToJoin')]",
          "OUPath": "[parameters('ouPath')]",
          "User": "[concat(parameters('domainToJoin'), '\\', parameters('domainUsername'))]",
          "Restart": "true",
          "Options": "[parameters('domainJoinOptions')]"
        },
        "protectedSettings":
        {
          "Password": "[parameters('domainPassword')]"
        }
      }
    }

  ],
  "outputs": {
  }
}
[/code]

Create the Deployment Template

[code language='javascript'  highlight='62,63,64,115,145,153']
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters":
  {
    "region":
    {
      "type": "string",
      "minLength": 1
    },
    "vmName":
    {
      "type": "string",
      "minLength": 1
    },
    "domainToJoin":
    {
      "type": "string",
      "minLength": 1,
      "defaultValue": "blueskyabove.local",
      "metadata":
      {
        "description": "The domain user alias to use when joining the machine to the specified domain"
      }
    },
    "domainUsername":
    {
      "type": "string",      
      "minLength": 1,
      "metadata":
      {
        "description": "The domain user alias to use when joining the machine to the specified domain"
      }
    },
    "domainPassword":
    {
      "type": "securestring",
      "minLength": 1,
      "metadata":
      {
        "description": "The password of the domain user to use when joining the machine to the specified domain"
      }
    }
  },
  "variables":
  {
    "existingVNETName": "adVNET",
    "existingVNETResourceGroupName": "ADDemo",
    "vnetRef": "[resourceId(subscription().subscriptionId, variables('existingVNETResourceGroupName'),'Microsoft.Network/virtualNetworks',variables('existingVNETName'))]",
    "subnetName": "adSubnet",
    "subnetRef": "[concat(variables('vnetRef'), '/subnets/', variables('subnetName'))]",
    "imagePublisher": "MicrosoftWindowsServer",
    "imageOffer": "WindowsServer",
    "imageSku": "2016-Datacenter",
    "OSDiskName": "vm1OSDisk",
    "storageSku": "Standard_LRS",
    "vmSize": "Standard_D2_v2",
    "nicName": "[concat(parameters('vmName'), 'NetworkInterface')]",
    "pipName": "[concat(parameters('vmName'), 'PublicIP')]",
    "domainJoinOptions": "3",
    "ouPath": "",    
    "keyVaultRef": "/subscriptions/678fbfe2-79a7-4689-839d-0a187e5b6b1a/resourceGroups/ADDemo/providers/Microsoft.KeyVault/vaults/ADDemoKeyVault",
    "usernameSecretName": "localAdminUsername",
    "passwordSecretName": "localAdminPassword"
  },
  "resources":
  [
    {
      "name": "[variables('nicName')]",
      "type": "Microsoft.Network/networkInterfaces",
      "location": "[parameters('region')]",
      "apiVersion": "2016-03-30",
      "dependsOn":
      [        
        "[resourceId('Microsoft.Network/publicIPAddresses', variables('pipName'))]"
      ],
      "tags":
      {
        "displayName": "vmNic"
      },
      "properties":
      {
        "ipConfigurations":
        [
          {
            "name": "ipconfig1",
            "properties":
            {
              "privateIPAllocationMethod": "Dynamic",
              "subnet":
              {
                "id": "[variables('subnetRef')]"
              },
              "publicIPAddress": {
                "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('pipName'))]"
              }
            }
          }
        ]
      }
    },
    {
      "apiVersion": "2016-02-01",
      "name": "vmTemplate",
      "type": "Microsoft.Resources/deployments",
      "dependsOn":
      [
        "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]"
      ],
      "properties":
      {
        "mode": "Incremental",
        "templateLink":
        {
          "uri": "https://2lgwchcjfghlgadsa.blob.core.windows.net/arm/newVM.json",
          "contentVersion": "1.0.0.0"
        },
        "parameters":
        {
          "region":
          {
            "value": "[parameters('region')]"
          },
          "vmName":
          {
            "value": "[parameters('vmName')]"
          },
          "nicName":
          {
            "value": "[variables('nicName')]"
          },
          "vmSize":
          {
            "value": "[variables('vmSize')]"
          },
          "vmAdminUsername":
          {
            "reference":
            {
              "keyVault":
              {
                "id": "[variables('keyVaultRef')]"
              },
              "secretName": "[variables('usernameSecretName')]"
            }
          },
          "vmAdminPassword":
          {
            "reference":
            {
              "keyVault":
              {
                "id": "[variables('keyVaultRef')]"
              },
              "secretName": "[variables('passwordSecretName')]"
            }
          },
          "domainToJoin":
          {
            "value": "[parameters('domainToJoin')]"
          },
          "domainUsername":
          {
            "value": "[parameters('domainUsername')]"
          },
          "domainPassword":
          {
            "value": "[parameters('domainPassword')]"
          },
          "ouPath":
          {
            "value": "[variables('ouPath')]"
          },
          "windowsOSVersion":
          {
            "value": "[variables('imageSku')]"
          },
          "storageSku":
          {
            "value": "[variables('storageSku')]"
          }
        }
      }
    },
    {
      "name": "[variables('pipName')]",
      "type": "Microsoft.Network/publicIPAddresses",
      "location": "[parameters('region')]",
      "apiVersion": "2016-03-30",
      "dependsOn":
      [
      ],
      "tags":
      {
        "displayName": "vmPIP"
      },
      "properties":
      {
        "publicIPAllocationMethod": "Dynamic"
      }
    }
  ],
  "outputs":
  {

  }
}
[/code]

Summary

Resources

Background

On January 1st this year, I decided to change my life.  I weighed 360 pounds, I was grossly out of shape, and I felt like time was running out.  I’d felt like this for a long time, to the point of near depression, but rather than try to get healthy I continued to make bad health decisions and continued gaining weight.  A few times I did try dieting, but I could never stick with anything long enough to see results.  Clothes no longer fit, and buying new clothes at a “big and tall” shop (you rarely see tall people in these) was infuriating due to the huge sizes that I had to purchase.

I love my wife, I love my kids, and I needed to be a better husband and father. My weight was in the way.

Make The Decision

I got the chance of a lifetime to go to Ireland for a business trip.  While I was there, I went to see a dear friend, Derek Noonan.  He took me out to see the sights, including a trip to the amazing Cliffs of Moher.  It was stunning.  We made the journey from Limerick to Burren in the morning.  We arrived at the the visitor’s center, and it certainly was beautiful, but to get a really good look you needed to walk up a fairly long path of stairs. I was winded from the first few stairs, and by the time we reached the observation deck I was spent.

Derek took me to a few other places that day. We climbed the inside of Bunratty Castle, and I couldn’t imagine walking one more step. He wanted to take me to see King John’s Castle in Limerick, but I was exhausted and couldn’t do it. Here I was, my first time to Ireland (I’ve wanted to visit my entire life) and I was too exhausted to see anything.

We talked that night at dinner about my friend’s wife had started a diet called keto.  I had seen Carl Franklin recently posting about a podcast he’d started (http://2ketodudes.com/) and the results he’d seen. More excuses, I tried Atkins and I couldn’t last but a few days, no thanks.

I was really excited for the flight home, I was able to get an international business class seat.  Traveling in style!  I sat down and… I didn’t fit. I could get my butt and torso in, but my arms were resting uncomfortably and wedged against the seat divider. It was uncomfortable as hell. It was on that plane ride that I’d made up my mind to do something, but I didn’t act on it for a few weeks.

My family purchased tickets to see my favorite football team, the Georgia Bulldogs, play in a bowl game.  We drove from Dallas, Texas to Memphis, Tennessee.  We rode in my wife’s car to get better gas mileage, and holy crap was it bad.  I was too fat to fit comfortably, with nowhere to put my arms.  We rented stadium seats, and they were worse than the bench seats because I was too fat to fit in them. I was too fat to sit with my family and had to sit one row in front of them to make sure my kids had enough room. If the plane flight home from Ireland was the decision point, this was the reinforcement.

I have a beautiful wife and two amazing kids, and I want to be here for a really, really long time. 

The point of this introduction… you have to make the decision, you have to find your motivation to start. Do not go into this with the mindset of “dieting”, which carries a temporary connotation. Think of this as deciding to change your lifestyle, changing the behavior that caused you to gain weight.  When you feel like giving up, you need to remember why you started, how you felt.

The Start

My employer (Microsoft) offers an employee benefit to stay healthy, providing $800 yearly to be used towards the purchase of exercise equipment or a gym membership.  You should see the upstairs of my home, it’s littered with dusty exercise equipment I’ve accumulated over the years.  I plunked the money down at a gym.  I’d had gym memberships before, hired personal trainers before, and never seen results. I’d try it one more time.

While I was at the gym buying my membership, they told me that you could not exercise your way out of a bad diet, weight loss was 80% diet and just 20% exercise. I thought about Carl’s podcast and the results he had seen in a short timeframe… it was time. I’m done with feeling like this, I’m tired of feeling sick, I’m tired of my weight stopping me from enjoying life.  I need to change the diet. I started researching keto more earnestly.

January 2nd, I woke and went to the gym. I scheduled a personal trainer session to force myself to actually go to the gym. It was embarrassing, to say the least. Simple exercises (step up, step down, 15 times) were nearly impossible. Planks? I could hardly hold myself up, and pushups were out of the question. I had to walk up a flight of stairs to go up to the cardio equipment, and I could barely make it up the stairs. I scheduled another personal trainer session, and he gave me homework. Total work out time was maybe 30 minutes, and I was exhausted.

I got home, slightly defeated, but determined. I started the keto diet by cooking eggs and bacon for breakfast, something I frequently ate, but this time no toast, no orange juice. Just black coffee. After breakfast, I started drinking water.  I hadn’t drank water except to cure a hangover in a long time, opting for diet sodas or fruit juices. I was exhausted and took a long nap. I woke and, to my family’s shock, I had a salad for dinner: iceburg lettuce, a bit of shredded cheese, a boiled egg diced, and a grilled chicken breast, salt and pepper.

I did this for a week. Get up, go to the gym for an hour, get home and eat eggs and bacon, then sleep. Get up, eat a salad, then sleep. I was sleeping around 14 hours per day. I was a zombie when I was awake, I had zero energy and felt disgusting. At the end of the week, I weighed myself.  Holy crap! I lost 10 pounds in ONE WEEK. It was water weight, I had read that others saw the same thing when they started keto, but wow. I can muscle through this and make it to week two.

I kept going to the gym, kept eating eggs and bacon in the morning with black coffee, chicken for dinner.  Usually dinner was a salad, but sometimes I would just have grilled chicken breast with broccoli+butter or asparagus+olive oil. Occasionally, I’d have a steak, but it was mostly chicken.

Progress

At the end of month 1, I had lost 25 pounds. I was done with my personal trainer sessions, but still going to gym almost every day. Workouts had greatly improved. I could walk up the stairs without the railing and without being winded, and my workout routine increased to lift weights for 1 hour then cardio for 30 minutes. I was already noticing a few changes: cardio wasn’t nearly as hard as it was when I started, I was increasing the amount of weight that I was lifting. The coolest thing was when I made it up the flight of stairs and wasn’t even winded. I could keep doing this. I posted to Facebook, and received overwhelming encouragement from friends and family. It was so cool, people were telling me I was inspiring them. I kept checking into Facebook, telling everyone I was at the gym. Honestly, that was more for me than it was for them. It was accountability.

At the end of month 2, I was down 50 pounds. I was working out at the gym when I traveled, sticking to my diet, and was starting to visibly see changes. I had moved from being confined to just the elliptical machine or stationary bike at the gym, I could now using the rowing machine and the Stairmaster. Thinking back to where I was when I visited the Cliffs of Moher, being able to last for 30 minutes on the Stairmaster was huge for me. I was no longer feeling exhausted during the day and could now make it through the day without a nap (well, during the week, but weekends I sometimes indulge).

At the end of month 3, I took my son with me to the gym. He works out nearly every day at school and is in amazing shape, so I struggled to keep up with him. We went to do pushups, and I said “sorry, buddy, I can’t do pushups, my gut is too heavy.” He said to just try, and I did.. and I did 12 pushups. I had no idea I could do them, I was so proud of myself. A very cool thing happened: My son was proud of me, too. I was overwhelmed thinking, “my kids are seeing me work this hard.”

End of month 4, I was down 85 pounds. I went from a size 5XL shirt down to a 2XL shirt, notched so many holes in my belt to tighten it that it wraps around to my back, even my shoes fit better.

Around this time, I hurt my arm at the gym (don’t overdo it, they say… well, pay attention, because it really effing hurts). I pulled or tore something in my forearm, now it hurts to lift a bottle of water, it hurts to push or pull anything, it hurts to walk and swing my arm. I stopped going to gym because it felt like I kept re-injuring it every time I went.  I stuck with my diet, but weight loss came to a screeching halt for a few weeks. I was frustrated. I went to do the thing that got me into this mess in the first place: I went to grab a beer. Remember that you aren’t doing a short-term diet, you are changing the behaviors that caused the weight gain.

I didn’t drink it, instead I went running.  RUNNING! Just a few months ago, I could barely get up a flight of stairs, and here I was running. I am still overweight, and I had to stop running to walk a few times. It took me about 20 minutes to run a mile.  Still, I ran most of it, and it felt amazing. The next day, I had some pent-up energy and asked my son if he wanted to go our bicycles around the neighborhood. I was so heavy before that I didn’t fit on the bike, but now I did and I could keep up with my son while riding around the neighborhood.  My daughter asked to ride bikes to the neighborhood pool, and we had a great time. Being lighter meant that I was enjoying more time with my kids.

Here we are, 5 1/2 months into this, and I am 100 pounds lighter. One hundred. When I started this, I couldn’t imagine losing 100 pounds, but then again, I couldn’t even imagine the first 10 pounds that I lost the first week. In the past, I’d always stopped a few weeks in when I didn’t see results. This time, I stuck with it. When I talk to people who want to lose weight, this is the part they are focused on: you lost so much weight! It didn’t happen overnight, it was a lot of trips to the gym, a lot of times eating a keto meal that I would much rather have had pizza and beer.

The point of this section is that it’s not just about losing weight, there are so many successes along the way to celebrate.

The Rules

The keys to losing weight are the same as they always have been: eat less, move more, drink more water.  The problem with eating less is that it can be freaking impossible to get out of your own head.  I use the keto diet and, admittedly, a lot of will power.  The keto diet has you consume a very low amount of carbs and high fat, which makes you less hungry so you eat less. Fasting helps kick your metabolism back into gear, as does regular strenuous exercise. Drinking water not only helps you avoid being hungry but flushes everything from your body.

My rules are simple:

• Less than 20g total carbs per day. Usually closer to 10g.
• Only eat when you are hungry.
• Stop eating when you are no longer hungry.
• Don’t eat after 7pm.
• Drink water.

To check carbs, I use an app called MyFitnessPal.com.  For many foods, you can scan the barcode and it will display the carbs for you, or you can search. It can even check the menu of the restaurant that you are at. There is a paid version, but the free version works fine for me. This is great, especially when you are getting started, to log the food to make sure you are actually staying under 20g carbs.

There is a calculator online at http://keto-calculator.ankerl.com.  Enter in weight, height, sex, protein, and carbs, and it will tell you how much you should be consuming based on your body type.  Here are my results:

The only one of these that I actually focus on is the carbs, but I do occasionally check protein, especially when weight loss stalls.  I rarely ever hit 1700 calories, usually I am much lower than that. 

Schedule

OK, the section some of you want to see since I get this one a lot… what the heck is your schedule?

My rule is that I don’t eat past 7pm and I don’t eat breakfast before 10am, providing a 15 hour fast every day.  Once every two weeks I do at least a 24-hour fast, occasionally I have done 48-hour fasts.  I am a royal jerk when I fast for that long, and I don’t wake up thinking, “I’m going to start a fast today.”  At breakfast, I ask myself if I am actually hungry, and if I’m not, I don’t eat then. At 2pm, I chug water to determine if I’m actually hungry or not. At dinner, I ask myself again if I am actually hungry. If I can make it through dinner and I am only a little hungry, I’ll push myself to wait until breakfast.

The first month or so, I frequently had to take a nap in the middle of the day. Part of that was because I was working out and my muscles were so sore that I didn’t sleep very well. Both of those passed, and I usually sleep 8-9 hours a night now, though I can still barely make it past 8pm.

Sample Recipes

Here is a sample of recipes that I usually eat.

Omelet and meat: 2 eggs and 2 tbsp whole milk, salt and pepper, scrambled, cooked in 1 tbsp butter.  4 strips of bacon (I don’t drain them, I keep them dripping with fat) or 4 sausage patties. Store the leftover meats for meals for the next 2 days.

1 8-ounce chicken breast, grilled. Cover in Frank’s RedHot sauce, top with shredded cheddar cheese.  Side of broccoli (a whole bag), topped with butter and salt.

Pork rinds covered in shredded cheddar cheese, put in the oven for 5 minutes to melt the cheese.  Add 1/4 to 1/2 cup taco meat (McCormick taco seasoning, no reason other than that’s the one I like). Add jalapenos and shredded iceburg lettuce. Add Frank’s RedHot sauce.

8oz steak. Side of asparagus cooked in olive oil and salt.

Large bowl of mixed greens salad. Add 6-8 ounces chicken, 1 hard-boiled egg, shredded cheddar cheese, bacon pieces, walnuts, salt and pepper.

Hamburger patties, usually 2 of them, with a very small amount of ketchup (remember that ketchup has carbs), topped with pickles and cheddar cheese. Wrap in iceburg lettuce instead of a bun.

8-10 oz grilled flank steak, cut into fajita strips, shredded cheddar, small amounts of picante (watch carbs!) wrapped in iceburg lettuce instead of tortillas.

Workouts

When I started working out, I hired a trainer for a few sessions just to get me started.   I knew I wasn’t going to be able to afford to have a trainer for very long, so I focused on developing a plan.  How many reps, how to stretch, how to increase over time.  What web sites to visit.  The trainer was helpful, but simply Googling with Bing for different workouts typically landed me at https://www.bodybuilding.com.  While I am no bodybuilder, it was helpful to get ideas for routines and even see videos of how to do the exercise correctly.

My workout routine is to do heavy lifting for about an hour, and cardio for 30 minutes. I don’t leave the gym until I’ve burned 1000 calories according to my Microsoft Band (or use a FitBit or Garmin or whatever works for you). The routine I've chosen is 6 days of strength training, alternating muscle isolation. Legs, lat/back, legs, triceps, legs, chest/biceps. 3 sets of 15 each exercise, 60-90 seconds between each set, with muscle failure on the 2nd and 3rd sets. I warmup, stretch, lift, do core exercises (planks, crunches, raises), then 30 minutes of cardio in the moderate range. The 7th day is a rest day. I had to build up to this routine, the first 2 weeks was primarily light weight with high repetitions to get my muscles used to moving. Stretching is key to avoid injury while improving flexibility.

In case you aren’t quite sure what to do, consider hiring a trainer for a few sessions. Another choice is to spend some time reading and watching videos. A fantastic place is https://www.bodybuilding.com/exercises/finder/lookup/filter/muscle/id/10/muscle, you can filter by muscle group and then see different exercises and how to do them correctly. This site also has a ton of different articles that suggest workout routines, compares one approach to another, etc. 

A variation for weightlifting that I sometimes do is called “10 to 1’s”.  Lift weight and hold for 10 seconds, lift again and hold for 9 seconds, again and hold 8 seconds… all the way down to 1. If your muscles fail, wait for just 15 seconds and start where you left off. 

Cardio is usually the elliptical machine or StairMaster. On the elliptical machine, I put it on level 13 and use the random program, and focus on keeping my heart rate in the 145-170 range.  I sometimes have to focus to increase my pace to force my heart rate up.  On StairMaster, I set it to level 3 to start for 1 minute, then up to level 7-9 for 2 minutes, back down to 3 for 1 minute, back up to level 7-9 for 2 minutes, etc. I usually don’t have to watch to keep heart rate up on StairMaster, it’s usually a matter of counting down seconds until I can rest on level 3 and catch my breath for a second.

The combination of heavy weight resistance training followed by cardio increases the fat burn. 

As I am typing this, I am also gathering my phone, headphones, Microsoft Band, and keys to go to the gym.

Summary

It hasn’t been easy. Sitting at dinner eating leftover chicken while my family has pizza, I’m not gonna lie… that sucks. Eating leftover vegetables while watching them enjoy french fries can be incredibly tempting. Going out to dinner and picking apart your meal to avoid the carbs can get really frustrating. Watching others drink beer or enjoy a dessert can be discouraging. My wife tries to plan meals that accommodate everyone, but often it’s a pain the ass to accommodate me.  I have to remind myself how awesome it feels to hit a milestone, to realize I can now do something I couldn’t before, to fit into something I haven’t for years, to feel better than I have in a very long time. 

I get terrible breath due to the ketones my body is expelling. No amount of teeth brushing or mouthwash seems to make it go away for long. I have to go to the bathroom very frequently, often at inconvenient times, because I drink so much water. I do get sick of not eating carbs, and walking through a grocery store is almost physically painful as you are literally surrounded by things you cannot enjoy, delicious breads and baked goods whose smell permeates the air. I miss sweets, and I really miss beer. No matter the downsides, nothing matters to me but feeling better than I used to, improving myself. Nothing tastes as good as losing weight feels.

My clothes don’t fit. My pants are now huge on me, I have to cinch my belt really tight. I have a few old shirts that I can now start fitting into again, but the majority of my wardrobe is way too big and looks like I borrowed someone else’s clothes. My belts look ridiculous as they wrap 1.5 times around me, with handmade holes demonstrating progress. It doesn’t make any sense to buy clothes now, I’m just going to have to buy more again soon as I continue to drop, and I can’t wait to buy them off the rack, at the mall, and not in a specialty shop for fat people.

This post is just as much a reminder to me as it is information for you. I post progress to Facebook partially to hear all the encouragement from friends, but more for accountability. I hear from so many people that I have inspired them, and friends ask how they might do the same. Living as a positive example is something I strive for but don’t often feel I live up to. This is something I can feel good about, and definitely can show my kids that hard work is required for the things you want in life.

I am now 100 pounds lighter, and it took me 5 months and 10 days to accomplish.

Challenge: when are you going to make the decision to start?

Resources

https://www.ketogenicforums.com – Forums to ask questions, see what others are going through, get recipe ideas, or just simply vent.

https://www.myfitnesspal.com – App to count carbs. You have to track all the carbs in everything from vegetables and meats to drinks and condiments.

https://keto-calculator.ankerl.com – Keto calculator. If you aren’t seeing progress, go fill this out and compare with what you are doing.

https://www.bodybuilding.com/exercises/finder/lookup/filter/muscle/id/10/muscle – Discover workout routines without hiring a personal trainer.

Background

A customer asked how they might use AAD-DS with SLES 11 SP4 to test their product.  I am very familiar with Windows but still very much a Linux novice, and there seems to be no easy documentation that shows how to walk through this end to end.  There are steps for Red Hat Enterprise Linux (https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-admin-guide-join-rhel-linux-vm), but I couldn’t find steps to do this on other Linux distros. The package managers are different (SLES uses zypper, RHEL uses yum, Ubuntu uses apt-get), and the packages to use and instructions for configuring are cryptic and archaic.  Turns out it’s really easy to domain join a machine using SLES.

What is Azure Active Directory Domain Services

The Azure Active Directory service does not directly provide NTLM, Kerberos, or LDAP, it provides WS-Trust, OpenID Connect, and OAuth capabilities.  Applications hosted in Azure virtual machines may need these legacy authentication capabilities but can’t afford the latency of communicating back to on-premises infrastructure, requiring domain controllers to be hosted in the cloud.  Many customers do not want to install their own domain controllers in cloud-hosted virtual machines, configure a VPN or ExpressRoute, and manage AD replication to on-premises domain controllers.  This is exactly what Azure AD Domain Services (AAD-DS) provides: a managed domain controller with the same users and groups as your AAD directory.  AAD-DS makes it easy to join a virtual machine to the managed domain so that your application can use NTLM, Kerberos, or LDAP with the same credentials that they use to log into Office 365 or Azure services.

Azure AD Domain Services will provision managed domain controllers into the Azure Virtual Network that you specify.  In this image, the managed domain controller virtual machines are greyed out, indicating they are there but you can’t access them or do anything with the virtual machine directly, you simply use the familiar Windows Active Directory Domain Services (ADDS) as a service. 

In this picture, AAD-DS is enabled for the directory, creating two virtual machines in the subnet of my choice.  My application server can now communicate with those domain controllers to domain join the machine and enable authentication and authorization.  Azure AD Domain Services works with either cloud-only or hybrid directories.  If there is an existing ADDS infrastructure on-premises, you sync users to the AAD directory using HTTPS to enable single sign on to cloud resources such as O365. 

Getting Started

The documentation to set up Azure AD Domain Services is pretty easy to follow, including screen shots.  Nothing to install on your machine, nothing to configure locally, just go to the Azure portal and follow the directions:

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-getting-started 

The result is an Azure classic virtual network with the settings you chose.

Editor:  At the time of this writing, AAD-DS only supports classic vnets.  I don’t have insight to the product team’s plans if they are going to enable ARM-based VNets, but I sure hope so.

If I need to add users or groups, I do this using Azure AD. 

I also have a group that contains the users who are administrators of the AAD-DS domain, enabling them to configure things like service principals and constrained delegation.

I can now add a Windows virtual machine to the same virtual network and join the machine to the domain blueskyabove.onmicrosoft.com.  Note that I am using a cloud-only directory, there are no users sourced from on-premises, so when I am prompted by Windows for the credentials to join a machine to the domain, I use my cloud-only account kirkevans@blueskyabove.onmicrosoft.com, and when I RDP to my new WIndows VM I use the same credentials.

Once logged in, open PowerShell and run the command:

Add-WindowsFeature -Name RSAT-ADDS-Tools

This command will add the Active Directory tools such as Users and Computers.  Now you can view the domain information from your new Windows virtual machine.

OK, enough Windows, let’s go look at the Linux stuff we promised in the beginning of the post!

Create a SUSE Linux Enterprise Server Virtual Machine

In the Azure portal, create a new SUSE Linux Enterprise Server virtual machine in the same VNet that you used previously.  Filter for “SUSE” and choose your starting image.  I chose SLES 11 SP4. 

IMPORTANT!!! Make sure to create a VM using the Classic deployment model so that it can be placed in the same VNet!

The next step enables you to provide your SSH login information and SSH public key (for more information, see https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys). 

Choose a size.  A DS1_v2 machine is plenty for my quick demo.

Create or choose a storage account and cloud service (I used the same cloud service I used with my Windows VM above).  The important point here is that you use the same virtual network that is configured for Azure AD Domain Services.

After a few minutes, the VM is created and I can SSH into it.  I am using the Windows Subsystem for Linux, just open a command prompt and type “bash” to open the bash shell, and then I can run my SSH commands.

Editor: I received a few weird errors while trying to provision the VM, mentioning something about a certificate thumbprint cannot be found.  I kept trying and it finally worked.  Sometimes I guess you have to click harder.

SSH Using Your Certificate

We haven’t yet joined the VM to the domain, so we will SSH using the details we provided when creating the Azure VM.  Once the VM is created, open the VM to see its public IP address.

Note that the public IP can change if you restart the Azure virtual machine.  Now, go to the Endpoints property of the VM to see which port to use for SSH.

Finally, SSH:  ssh -i azure_ssh myadmin@52.173.77.97 -p 60252

We’re in!

Domain Join SLES Using YaST

The last bit we need to do is to join to the domain controller that Azure AD Domain Services provides for us.  Since the VM is in the same VNet and we have updated the DNS settings for the VNet, the new Linux machine can locate the domain controller by name without any further configuration with “sudo /sbin/yast”.

This opens up the YaST control center.  Choose Network Services / Windows Domain Membership.

You are prompted to install the Samba client packages.

Next, provide your domain as all capital letters, and enable the settings in the top section to enable users to SSH to the machine using their credentials from Azure AD.  Note that I am using a cloud-only directory without a custom domain.  If you added and verified a custom domain, and have users from that custom domain in your AAD directory from a sync, then you should use your custom domain. 

Editor: Backspace doesn’t work for me, I had to use CTRL+H to backspace.  Dunno.

Once you are done, exit and reboot the VM. 

You may be wondering what the YaST tool just did for us.  For a comprehensive look at the files it edited and the values it used, see https://jreypo.wordpress.com/2012/02/01/how-to-integrate-suse-linux-enterprise-11-with-windows-active-directory/. 

You can now log in using the same credentials that you use to log into Azure AD.

ssh blueskyabove\\kirkevans@52.173.77.97 -p 62075

You can now SSH using your credentials from Azure AD and the user has a home directory that was created.

The user is not in the sudoers group.  It is possible to enable users from a particular Active Directory group to use sudo.

https://derflounder.wordpress.com/2012/12/14/adding-ad-domain-groups-to-etcsudoers/

For More Information

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-getting-started

How to create and use an SSH public and private key pair for Linux VMs in Azure

Join a Red Hat Enterprise Linux 7 virtual machine to a managed domain

https://jreypo.wordpress.com/2012/02/01/how-to-integrate-suse-linux-enterprise-11-with-windows-active-directory/

https://derflounder.wordpress.com/2012/12/14/adding-ad-domain-groups-to-etcsudoers/

Background

I’ve been a C# .NET developer for the past 17 years  Sure, I’ve coded with other languages (C++, Java, JavaScript, Pascal, F#, Visual Basic, Ruby), but given a deadline I would always use C# as that is what I am most productive in, and I am very comfortable with Visual Studio.  I recently decided to leave my comfort zone of Windows, .NET, and SQL to venture into Linux and Node.js.  I wanted to learn how to use various Azure services using Node.js, so the first that I picked was using Azure AD to secure a web application. 

I went to an article, Node.js web app sign-in and sign-out with Azure AD, followed the steps, and it didn’t work.  I went to GitHub and cloned a repository, https://github.com/AzureAD/passport-azure-ad, and it didn’t work.  After wasting a really long time trying to figure it out, I discovered that those two resources (as of today’s date) use Node.js version 4.x, which is the current Long Term Support (LTS) version of Node.  Following the instructions below, I ended up with Node version 7.4.0.  The versions are not backwards-compatible between major releases, which explains why I couldn’t get things to work.

You could get things to work by using a Node version manager.  A popular one is “n” which lets you interactively select which version of Node you are using.  The rest of this post assumes Node version 7.4.0.

This post is going to look scary long.  It’s actually not that bad, I am just verbose.  The completed solution is available at https://github.com/kaevans/node-aad. 

My Environment

I am not using a Linux desktop, just using it as a server.  I used vi in Linux enough to realize I prefer the productivity of menus and a mouse, so I have a Windows 10 desktop running Visual Studio Code.  However, I fell in love with Bash, so I enabled the Bash for Windows feature.  This lets me use the Bash shell for things like Node.js (including npm) and Express web server.  Once I code and test locally, I deploy the code to a Linux VM running in Azure.  If you are using a Mac, you can use the Bash shell natively and you can still install Visual Studio Code. 

Create an Azure AD Application

Go to the Azure portal, under Azure Active Directory / App Registrations and add a new registration.  Create it as a Web app / API with a sign-on URL of https://localhost.

Once created, go to the properties of your new app registration.  The App ID URI will have a GUID, you may wish to change that GUID to the name of your app (completely an optional step, but one that I prefer).

In this screen shot, item #1 is the application ID, also known as the client ID.  The App ID URI is also known as the Audience URI.  We’ll use those values in our configuration at the end of the post.

If your application will access other APIs, you will need a key.  To do that, go to the Keys setting of your app registration and add a new key.

Copy this value (you won’t be able to retrieve it later).  This key is also known as the client secret.

Install Node.js and Express Generator

I am going to assume that you already have Bash on Windows enabled (more details here), and you have Visual Studio Code installed.  Open a command line and just type “bash” to start the Bash shell.  This enables you to install Node.js using a package manager in Bash.  Since Bash on Windows uses Ubuntu, you need to choose the Ubuntu directions for installing Node.js. 

curl -sL https://deb.nodesource.com/setup_7.x | sudo -E bash -
sudo apt-get install -y nodejs
sudo apt-get install -y build-essential

Now that we have Node.js, we can use the Node Package Manager (NPM) to install dependencies similar to how we’ve used NuGet for packages in Visual Studio.  Let’s install the Express Generator that lets us quickly scaffold Node.js applications that use Express.  We use the “-g” switch to make this a global dependency.

npm install express-generator -g

So, where to keep our project?  Bash for Windows creates a mounted file system to access your Windows files, so wherever we keep them in Windows is accessible via Bash as well.  As an example, I created a directory “Source” under my user profile.

Just for completeness sake, I am showing the same directory using the old CMD shell in Windows to prove you can easily access those files in Windows.

Now close the CMD shell, we will only use the Bash shell during this post!

Create the Application

Now that we have a folder to keep our new application, we need to install some libraries.  Change directory to the Source directory and then use the Express Generator to scaffold the application.  In the Bash shell:

express node-aad

Open Visual Studio Code and then open the node-aad folder that was just created.

If you go to the debug menu in VS Code and hit Start, the application will fail with an error “Exception occured Error: Cannot find module 'express'”.  Yes, “occurred” is misspelled, but the more important thing to note is that the packages.json file contains a list of dependencies that haven’t been downloaded yet, kind of like NuGet package refresh.  This allows you to check your project into source control without all the dependency binaries.  To download the binaries, we go back to the Bash shell and change directory to our project’s folder.

npm install

The output shows all the binaries that were downloaded.

To test the application, in the Bash shell try to following:

npm start

Now switch to a browser and go to http://localhost:3000.  You will see your application.

Watch the Bash shell window to see the requests.

Hit Ctrl+C to stop the server.  We now have a working Node.js web application.  Let’s secure it with Azure AD.

Update Your Application to Use Azure AD with Passport

No, I don’t mean Passport as in the precursor to Microsoft Accounts (formerly Live accounts, formerly Hotmail accounts, formerly Passport accounts), I mean Passport the authentication middleware for Node.js.  Passport makes it easy to use different strategies for authenticating to services such as Facebook, Twitter, and more.  We will use the passport-azure-ad package that provides an OpenId Connect strategy for authenticating to Azure AD.  Go to the Bash shell and run the following.  This will install the packages method-override, express-session, passport, and passport-azure-ad, and the “—save” switch will update the package.js file to include the references.

npm install --save method-override express-session passport passport-azure-ad

Go check package.js and you will see that it has been updated.

Enable HTTPS

We are using OAuth, which means we are passing a bearer token in an HTTP header, which means using HTTPS is mandatory.  In fact, this is one of the things that didn’t work when I tried the directions for Node.js 4.x using Node.js 7.4.0… the sample I linked to in the opening paragraph allowed you to use HTTP but that doesn’t work with Node 7.4.0.  Creating an HTTPS server using Express is really simple.  Go to the Bash shell and create the signing key, certificate request, and certificate, then delete the request file.

openssl genrsa -out key.pem
openssl req -new -key key.pem -out csr.pem
openssl x509 -req -days 9999 -in csr.pem -signkey key.pem -out cert.pem
rm csr.pem

Now update app.js.  At the top of the file, add the require statements for https and fs.

At the bottom of the file, just before the last line of code, add the following:

To test, go to the Bash shell and use “npm start” to start the application, then open a browser to “https://localhost” to see your application now listens to port 443 instead of 3000.  You may get an unhandled error:

If that is the case, then try running it using the sudo command:

sudo npm start app.js

Note: this is using a self-signed certificate and is not secure for production use.

Using Passport for Authentication

In Visual Studio Code, add a new file called config.js. 

Notice that we do not put hard-coded values for variable items in this file, and we certainly never ever never ever put secrets (like client ID and client secret) into code. 

Add the following to the list of “require” statements in app.js.

Beneath the require statements, add the following:

Next, we create the app object and tell it what middleware to inject.

Finally we add our routes.

Making It Readable

We now turn to making it readable so someone can actually use our application.  Let’s update the controller for the Index view to pass both the user and the title to the view.

Now let’s update the view. 

Notice the Jade file starts with “extends layout”.  We can use this like a master page in ASP.NET (or a layout in ASP.NET MVC).  Update the layout.jade file.

In our app.js file, there’s a route for /account.  We need a view for that as well.  Add a new “account.jade” file in the views folder.

The last thing we need to do it to add a little styling so the navigation is easier to read.  Update style.css in the public/stylesheets folder to include padding.

Check It In

We want to commit the code to git, but we don’t need to commit all those dependencies.  In the root of the project, create a file “.gitignore” and add the following:

This will prevent checking in any files in the node_modules folder, the .vscode folder (will be created in the next step), the certificates for the HTTPS server, or any log files.

In VS Code, you can now go to the Git tool and initialize the repository and check your changes in.

Test It Out

Our config.js file uses a lot of environment variables.  We need a way to pass those into our program when debugging locally.  One way is to use the Bash command:

sudo CLIENT_ID=YOUR CLIENT_ID CLIENT_SECRET=YOUR_APP_SECRET_KEY REDIRECT_URL=https://localhost/auth/openid/return node app.js

Replace the placeholders for client ID and app secret with the values from your Azure AD app. 

Another way to do this is to set the environment information within VS Code.  Go to the debugging tab, then click Settings. 

That will create a .vscode/launch.json file that makes it easy for you to configure the environment variables necessary for debugging your application without creating a script or actually setting those variables for your environment.  Replace with the values for your Azure AD application.

In VS Code, you can now click the Debug button to start debugging, giving you access to breakpoints, step-through, watch locals, etc.

Now open a browser in InPrivate (Internet Explorer) or Incognito (Chrome) to ignore existing cookies.  Navigate to https://localhost and you will see your new application!

Click Log In and see that you are prompted to log into Azure AD.

Once you log in, the UI changes to indicate you are logged in.

Click Account to see details about the claims in your token.

Git the Source

If you weren’t able to follow along or just want to download the source, the completed solution is available at https://github.com/kaevans/node-aad.  At a command line:

git clone https://github.com/kaevans/node-aad.git

To run the application, you will need to complete a few steps:

1. The node modules are not checked into source, but are referenced in the package.json file.  Just change directory to the project root and use the command “npm install” to download all of the dependencies so that you can debug locally.  Checking these into source would bloat your repository needlessly. 
2. The certificates are not checked into source (these are secrets).  Follow the directions above for using openssl to generate the certificates.  Do not check these into source!
3. The .vscode/launch.json is not checked into source (it has secrets in it).  Follow the directions above for creating/modifying the .vscode/launch.json file.  Do not check this into source!

For More Information

Bash on Windows

Creating an HTTPS server using Express

https://github.com/kaevans/node-aad – Completed source code

Node.js web app sign-in and sign-out with Azure AD – instructions to build a Node.js 4.x application, some changes required for a 7.x application.

https://github.com/AzureAD/passport-azure-ad – Completed sample for a Node.js 4.x application, some changes required for a 7.x application.

Today, I had another one of those days.  I don’t often share personal stuff via my blog, but this one is one to remember. 

My son, Carson, picked up guitar this summer.  I was standing in his room watching him play Guitar Hero, showing me he could get through the expert levels.  While I have a lot of respect for fake plastic rock, I couldn’t help but point out that if he could keep up with the game on expert level, he could read tab and learn to play a real guitar.  An obsession was born, because I was right… he was playing songs that he knew within the first few days, and by end of summer he has surpassed any playing that I ever did.

This summer, my kids went to church camp at Allaso Ranch (just pointing out, my summer camp experience was never like this!), and was amazed by the teens playing in a praise band.  He was really moved by the music that kids his age were playing!  He really, really wanted to be part of the creative team at church.  However, this is Fellowship Church, a mega church in Texas.  He decided he wanted to get serious about guitar and get good enough to join the creative team.

He got in.  Tonight, he passed the tryout and is now a part of the creative team.  I love that he set his sights on something, worked for it, and achieved it.  He achieved one of his goals, and I am so proud!

It doesn’t end there.

My daughter, Avery, has been a competitive cheerleader since she was 5 (that’s 9 years).  She is amazing.  For those who aren’t familiar, there are really two sports in Texas:  football and cheerleading.  The football you probably know.  The cheerleading is not pom poms or the silly dance you see the Cowboys cheerleaders do.  Nope, this is gymnastics floor routines rivaling some of what you see in the Olympics coupled with team stunts that send my daughter 20 feet in the air as she performs full twists and flips.  She’s worked so hard at this, cheering for Spirit of Texas competitively and traveling all over the US competing (one of the top teams in the nation!) 

She is a freshman at the local high school, and she joined the high school cheerleading squad.  Hebron Hawks!  She has worked all summer on this as well, making sure she was ready for the squad. 

Today, my daughter text me. 

My daughter is captain of the cheerleading squad for 9th grade!  She has worked so hard, and I am so completely proud to see her achieve her goals!

Today is a great day to be a Dad.

Background

I was working through the example Authenticating to Azure AD in daemon apps with certificates and I saw this:

makecert -r -pe -n "CN=TodoListDaemonWithCert" -ss My -len 2048 TodoListDaemonWithCert.cer -sv TodoListDaemonPrivateKey.pvk

Easy to read, right?  I mean, anyone can read that and understand it will create a self-signed certificate where the private key is exportable and store it in the current user’s personal certificate store, right?

Inevitably, when I tell someone to “just use a self-signed certificate”, I inevitably get a question asking something like “Makecert.exe is not on my computer, where do I get it from?”  You need to download the Windows SDK in order to obtain it, but that’s a pretty large tax for what seems like a simple function, creating a self-signed certificate.  The sample then goes on with some more code to read a .CER file using PowerShell, using the .NET X509Certificate2 class:

$cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cer.Import("TodoListDaemonWithCert.cer")
$bin = $cer.GetRawCertData()
$base64Value = [System.Convert]::ToBase64String($bin)
$bin = $cer.GetCertHash()
$base64Thumbprint = [System.Convert]::ToBase64String($bin)
$keyid = [System.Guid]::NewGuid().ToString()

It struck me that this is fairly complicated for something that should have just been 1 line of code.

Working With Certificates in PowerShell

If you Google with Bing you’ll see a whole bunch of blog posts that show fairly long-winded examples of creating self-signed certificates using the .NET X509Certificate2 class.  Turns out it’s so much simpler than that.  The equivalent of the above command is:

That’s it.  No need to install the Windows SDK. 

The cmdlet returns the certificate object (which is actually a System.Security.Cryptography.X509Certificates.X509Certificate2 .NET type).  So you can just use a variable to store it:

Since you have an X509Certificate2 object, you can easily interrogate its properties:

Need to get an existing certificate by a property such as its Subject?  You can use the Get-ChildItem cmdlet and specify the path to the certificate store.

Need to exporting the public key?  Straightforward.

What about the private key?

How about removing a certificate?  Also very simple.

Summary

I’m guilty, I have been doing this a long time and stuck in my ways.  I default to makecert.exe because that’s what I know, but it’s useful to have tools that are far easier to read and understand. 

The code is available for download at https://github.com/kaevans/BlyncLightAddin. 

Background

A few years ago, Andrew Connell and Scott Hanselman posted about getting a USB presence indicator for Lync (Lync + BusyLight = Great Solution for the Home Office, Is Daddy on a call? A BusyLight Presence indicator for Lync for my Home Office).  I received a Blynclight as a speaker gift for speaking at a conference a few years ago and it’s just sat on my desk, turning various colors as my Skype for Business presence changes. 

I am on the phone in meetings, so this does come in handy.  I started thinking that this could be really useful to tell someone I am currently coding and don’t wish to be disturbed as well.  If I am debugging, do not disturb!  Hence, the BlyncLightAddIn, where you can control what color should be shown on the Blynclight when Visual Studio starts and what color should be shown when debugging. 

The code is available for download at https://github.com/kaevans/BlyncLightAddin. 

Download the SDK

I downloaded the Blynclight SDK from the Blynclight Developer Forum (http://blynclight.proboards.com/thread/2/blync-sdk-create-own-applications).  It required registration in order to download the SDK, but once you download it you can see the binaries, a sample application, and a Word doc that contains information on the API. 

Next, I created a Visual Studio 2015 Extensibility project.  I didn’t have the extensibility tools installed, so I was prompted to install the Visual Studio SDK.  Took awhile, but finally I had a few new project template options in Visual Studio. 

Create a Custom Tool Window

Once you have the extensibility tools installed (Visual Studio prompts you to install these if you haven’t already), create a new VSIX project in Visual Studio.

Right-click the project and choose Add / New Item, then add a new Custom Tool Window.

Visual Studio generates a bunch of files, including a Command class that provides a menu command item to open the custom tool window and a WPF control to define your custom tool window.  It also generates a file, *Package.cs, that loads all the stuff for your add-in.  This is where you set the default window position for your custom tool window.

Notice line 4 where the custom tool window is loaded, we provide the style as tabbed, meaning it will be a tab in an existing window, and the window is docked to the Solution Explorer window (the GUID value is the GUID of the Solution Explorer).  To see where I stole this code from, see https://msdn.microsoft.com/en-us/library/cc138567.aspx. 

If you hit F5 right now, you have a functional yet boring addin.  Go to the View / Other Windows menu item to load your custom tool window.

Your custom tool window is opened, docked to the Solution Explorer window.

Add Blynclight Functionality

Now that the shell of our add-in is working, we can create our custom tool window.  You previously downloaded the SDK which includes Blynclight.dll.  This file is not signed, so you won’t be able to load it.  However, there is a workaround as shown in the post Sign a .NET Assembly with a Strong Name Without Recompiling.  You basically create a strong-named key using sn.exe, disassemble the DLL to intermediate language (IL) using ILDASM.exe, then assemble the IL into a DLL including your strong-named key using ILASM.exe.

Following these steps, I then add a reference in Visual Studio to the signed assembly.

We can now program against the Blynclight!

Is Visual Studio the Active Window?

If I have Visual Studio open, I usually don’t want to be disturbed.  We can cheat this by registering for a callback any time the active window is changed.  Once changed, we can look at the title of the window and decide if we want to change the light’s color or not. Registering the callback is very simple, especially when someone on Stack Overflow has done the hard lifting for us!  See the post Detect active window changed using C# without polling.  I’ll be the first to admit, this is an amateurish approach to just look for a hard-coded string “Microsoft Visual Studio”… but that’s the beauty of open source, right?  Just fork the repo and implement the rest that I was too lazy to finish.

Is Visual Studio Debugging?

This one was a little harder to solve, but turned out so much easier to implement.  I wanted to know if Visual Studio was actively debugging something.  If it is, then changing windows doesn’t matter (debugging usually means that new windows are popping up all over the place), just show the status as busy. 

Using the IBlyncWatcher Interface

Using our two implementations above is really simple.  I defined the interface, IBlyncWatcher, that both implement.

In the BlyncLightControl.xaml.cs file, you can see how easy it is to use the interface and the concrete classes.

Again, I could have made this more user-driven, even provided a UI for the developer to choose what color happens when, if the light blinks or not, and even support multiple devices.  The Blynclight SDK comes with a sample called BlyncLightTest that is a Windows Forms solution that you can grab some inspiration from. 

Summary

This was cathartic for me.  I really just wanted to know how to code a VSIX extension and to spend some time in Visual Studio doing something other than Azure.  I coded this in about a day (gotta love editor inheritance from Stack Overflow). 

The code is available for download at https://github.com/kaevans/BlyncLightAddin. 

For More Information

Adding a Tool Window

Lync + BusyLight = Great Solution for the Home Office

Is Daddy on a call? A BusyLight Presence indicator for Lync for my Home Office

Blync SDK – Create Your Own Blync Applications (requires free registration)

Sign a .NET Assembly with a Strong Name Without Recompiling

Detect active window changed using C# without polling

The code is available for download at https://github.com/kaevans/BlyncLightAddin. 

Background

I am working on a project that requires two Azure virtual networks to connect together.  I have done this so many times, typically through CLI scripts or PowerShell, but didn’t find the time to create an ARM template to demonstrate how to do this until today.  The result is very simple:

Note that I use this for quick and dirty deployments since everything is in a single resource group.  For a production deployment, I would split each VNet into a separate resource group and I would apply network security group rules to each subnet to control the traffic allowed in or out.  I’d script the connection between the VNets rather than put it in an ARM template.  In other words, this is not a complete and representative example of a production deployment.  For the recommended “golden path” to follow for a production scenario, see the Patterns & Practices guidance on Implementing a secure hybrid network architecture in Azure. 

Show Me the Code

Again, this is a quick and dirty example, for a production scenario see Implementing a secure hybrid network architecture in Azure. 

One of the things I like about this approach is how everything is parallelized.  The VNets and Public IPs are created in parallel, then both gateways are created in parallel.  This is a huge timesaver because each gateway creation takes around 30 minutes for each.. doing this in parallel reduces the time to just over 30 minutes total (my last deployment was just 33 minutes). 

Summary

It’s a neat template and all, but not something that I would recommend for a production deployment.  Instead, I would likely approach this with two different resource groups, and then use script (CLI or PowerShell) to connect the VNets together as shown in the article Configure a VNet-to-VNet connection by using Azure Resource Manager and PowerShell.  That said, I will probably use it often for quick and dirty tests across VNets since it’s easier to manage all the resources at once.

Acknowledgement

I have to thank Devin Lusby from Avanade who showed me how to create the Microsoft.Network/connections resource. 

For More Information

Implementing a secure hybrid network architecture in Azure

Configure a VNet-to-VNet connection by using Azure Resource Manager and PowerShell

The code is available for download at ClientCertDemo. 

Background

Many customers have implemented client certificates for older web applications and are looking at Azure Web Apps to move their code.  A common question is how to leverage client certificates in Azure Web Apps.  This demo shows one possible solution to validating the certificate.

The client application will add the client certificate to the HTTP request.  We will update the Azure Web App to enable client certificates, and the client certificate will be available using the X-ARR-ClientCert HTTP header.  We can then parse this as an X509Certificate2 class to read the properties of the certificate and perform validation.  Note that Azure Web Apps do not perform any validation on the certificate, this is up to the application to implement.  That’s what this post shows.

The source code for the web application is available at https://github.com/kaevans/ClientCertDemo. 

Create the Certificates

There’s nothing special about the certificate used in this demo, we’ll use self-signed certificates.  In fact, I am going to reuse the self-signed certificate that I used for creating a point-to-site VPN connection.  I am using makecert.exe, which is easy to find if you have Visual Studio 2015 installed… just load the “VS2015 x64 x86 Cross Tools Command Prompt”.

First, generate the root cert.

Next, generate a client certificate that references the root certificate.

Now open certmgr.msc to verify the certificates are there.

Double-click on the client cert that you just created and see its properties, we’ll need these properties in a moment.

Now that we have the certs, create the project.

Create the Web Application

Create a new ASP.NET Web Application.

Use the ASP.NET 5 Web API template, and choose host in Azure Web App.

You are prompted to create the Azure Web App.

Enable Configuration

Update the dependencies in the project.json file to include Microsoft.Extensions.OptionModel.

Update appsettings.json with the values from your certificate, taking care to remove spaces from the values (I lost a bit of time troubleshooting that one!)

Add a class to hold the configuration values.

Now update the ConfigureServices method in Startup.cs to use services.AddOptions and register your custom class with the dependency injection system.

Add Some Middleware

Add a middleware class.

The middleware class will request the configuration class via the Options model, and will also request logging via dependency injection via its constructor.  We add an overload to the extensions class to add the options model in the constructor.  When the HTTP request is received, the Invoke method is run for every request, and the configuration and logging types are passed to our middleware.  The Invoke method will validate the certificate that is passed.  The validation code is borrowed from the article How To Configure TLS Mutual Authentication for Web App with a few slight modifications to enable using the configuration system and adding logging.

To enable logging when deployed to Azure, modify the web.config file and change the stdoutLogEnabled value to true.

When deployed to Azure, this will write the log files so that you can troubleshoot when things aren’t working.

Finally, we need to register our middleware in the Configure method in Startup.cs.

That’s it!  We have now created the middleware needed to validate the certificate. 

Update the Azure Web App

The Azure Web App needs to be updated in order to allow client certificates.  There are instructions at How To Configure TLS Mutual Authentication for Web App that show how to use ARMClient to update the web app.  Note that you could do this at deployment time if you were deploying using an ARM Template with web deploy. 

The PUT request that you need looks like:

The ARMClient tool requires your subscription ID, resource group name, and web app name.  An easy way to get this information is to go to the Azure portal and go to your web app’s properties, looking at the resource ID.

Create a local file, enableclientcert.json and use your web app’s location in the file.

Run ARMClient.exe with the PUT URL and the output will look similar to the following.

Publish the Web Application

Right-click the project and choose Publish to publish the web application to Azure.

When the publish is complete, you’ll get an error page in the browser with a 403 error. 

I opened an incognito window in Chrome and changed to the HTTPS URL for my Web API controller.  I am prompted for a client certificate.

I provide it and now I can access the values.

Create a Client Application

For an extra bonus, I created a client application to test things out.  It uses the HttpClient API to make a request to Azure.  Make sure that you are using the SSL URL, else the certificate will not be sent.

Just like in the web page, the client works, too.  The source code for the web application is available at https://github.com/kaevans/ClientCertDemo. 

For More Information

How To Configure TLS Mutual Authentication for Web App

https://github.com/kaevans/ClientCertDemo