Azure World!

WCF Federation with ACS v2

Zafar Mohammed - MSFT — Fri, 12 Aug 2011 13:19:00 GMT

Recently I worked on WCF Federation with ACS v2. The developer who approached me was trying to authenticate the WCF service (on-premise/azure hosted) using Azure Appfabric Access Control (ACS ). He wanted to use an Identity provider (Windows LiveID or Facebook) as listed in the msdn magazine article below.

Re-Introducing the Windows Azure AppFabric Access Control Service - https://msdn.microsoft.com/en-us/magazine/gg490345.aspx

By Design, ACS supports active (WCF) federation with 3rd party identity providers such as ADFS, however LiveID does not offer an active endpoint. You can only do LiveID authentication through ACS using passive (browser redirect based) based federation. This works great for ASP.Net but not for WCF due to the design limitation mentioned.

(Source: https://social.msdn.microsoft.com/Forums/en-NZ/windowsazuresecurity/thread/f3bc5461-cdfe-4f69-a3ac-9a743d12ca85)

So the only option that WCF has for federation is to using ACS Service. Zulfiqar has a good blog on this - https://zamd.net/2010/10/05/web-services-federation-with-acs-v2/

With the help from this blog, I was able to use ACS hosted STS and authenticate to on-premise WCF service using ACS Service Identities (username/certificate) as the client credentials. You will basically pass through all the claims. All you have to do to switch between different client authentications is change bindings for ACS STS, which is listed under secureConversationBootstrap in customBinding section for the on-remise/azure
WCF service as explained in the above blog. As you can see below, I've enabled username authentication.

https://alphawif.accesscontrol.windows.net/v2/wstrust/13/username bindingConfiguration="https://alphawif.accesscontrol.windows.net/v2/wstrust/13/username"
binding="ws2007HttpBinding" />

Here's the binding that will be picked to connect to ACS in order to authenticate with username.

                                       https://alphawif.accesscontrol.windows.net/v2/wstrust/13/username"
                                       closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00"
                                       sendTimeout="00:01:00" bypassProxyOnLocal="false" transactionFlow="false"
                                       hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288"
                                       maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8"
                                       useDefaultWebProxy="true" allowCookies="false">

                                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />

Zulfiqar's blog explains username authentication, certificate authentication is no different. You have to add a certificate for the client authentication as shown in the screenshots below.

Once everything is set, you provide the client credentials like you do to while calling any other WCF service.

Username Authentication:

var client = new ServiceReference1.ServiceClient();

client.ClientCredentials.UserName.UserName = "user";

client.ClientCredentials.UserName.Password = "pwd#123";

Console.WriteLine(client.GetData(33));

Certificate Authentication:

var client = new ServiceReference1.ServiceClient();

client.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindBySubjectName, "DefaultApplicationCertificate");

Console.WriteLine(client.GetData(33));

I tried issued token (symmetric - https://alphawif.accesscontrol.windows.net/v2/wstrust/13/issuedtoken-symmetric) but ran into some issue. I still have to figure out how to make it work , hopefully will come in my next blog part for this topic.

The sample is uploaded for your convenience. Otherwise, the blog (https://zamd.net/2010/10/05/web-services-federation-with-acs-v2/ ) itself let's you create a sample yourself very quickly.

Note: alphawif is my ACS namespace, this is something you need to take care of when you use the sample.

WCFFederation-ACSv2.zip

Securing Azure hosted ASP.Net/WCF with SSL

Zafar Mohammed - MSFT — Fri, 05 Aug 2011 11:06:00 GMT

The exercise below details the steps to secure azure with SSL really well.

Exercise 4: Securing Windows Azure with SSL

https://msdn.microsoft.com/en-us/gg271302

In the exercise above, it uses self-signed certificates. Everything should work smoothly until developer decides to use certificate issued by certificate authorities in production. When using certificates from certificate authorities, you might see certificate errors like below in the browser when accessing the web site if all the certificates are not installed at the required certificate stores.

The security certificate presented by this website was not issued by a trusted certificate authority.

The security certificate presented by this website was issued for a different website's address.

When you view the certificate, it might show up something like this.

What the above error means is that the certificate chain building failed as it is not able to locate its issuer details and trust the certification authority.

You can avoid this error by simply making sure that all the certificates are deployed/installed on the azure VM. This can be done by adding all the relevant certificates in the "Certificates" tab for the web role in cloud project before deploying to azure as shown below.

Azure DiagnosticMonitor - Custom Logs

Zafar Mohammed - MSFT — Thu, 28 Jul 2011 09:36:00 GMT

Azure Diagnostics custom logs are not moving to the storage account. I've configured the diagnostics as follows for custom logs.

Code in OnStart method:

// Get the default initial configuration for DiagnosticMonitor.

DiagnosticMonitorConfiguration diagnosticConfiguration = DiagnosticMonitor.GetDefaultInitialConfiguration();

// Set scheduled transfer interval for infrastructure logs to 1 minute

diagnosticConfiguration.DiagnosticInfrastructureLogs.ScheduledTransferPeriod = System.TimeSpan.FromMinutes(10);

// Specify a logging level to filter records to transfer

diagnosticConfiguration.DiagnosticInfrastructureLogs.ScheduledTransferLogLevelFilter = LogLevel.Error;

// Create a new DirectoryConfiguration object.

DirectoryConfiguration directoryConfiguration = new DirectoryConfiguration();

// Add the name for the blob container in Windows Azure storage.

directoryConfiguration.Container = "wad-custom-logs";

// Add the directory size quota.

directoryConfiguration.DirectoryQuotaInMB = 2048;

// Add the log path for the role using RoleEnvironment.GetLocalResource().

directoryConfiguration.Path = RoleEnvironment.GetLocalResource("MyCustomLogs").RootPath;

// Add the directoryConfiguration to the Directories collection.

diagnosticConfiguration.Directories.DataSources.Add(directoryConfiguration);

// Schedule a transfer period of 5 minutes.

diagnosticConfiguration.Directories.ScheduledTransferPeriod = TimeSpan.FromMinutes(5.0);

diagnosticConfiguration.Logs.ScheduledTransferPeriod = System.TimeSpan.FromMinutes(10);

// Start the DiagnosticMonitor using the diagnosticConfig and our connection string.

DiagnosticMonitor.Start("Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString", diagnosticConfiguration);

Configuration in Service Definition file:

ServiceConfiguraiton.csfg content:

As you can see above, everything is configured correct but the logs do not move to the storage account.

- Through some research, I was able to find that there are some permission issues in SDK 1.3 and 1.4 which would not let the diagnostics read the logs and move it to storage account.

- I used CACLS in the startup task to resolve the issue, basically gave everyone full rights on Resources folder.

CACLS C:\Resources /E /T /C /G "Everyone":F

CACLS in startup task can be used as a workaround until the problem is resolved in future versions of Azure SDK.

Hosting ASP.Net Application Services in Azure and Implement ClientApplicationServices

Zafar Mohammed - MSFT — Thu, 28 Jul 2011 08:50:00 GMT

ASP.NET application services are built-in Web services that provide access to features such as forms authentication, roles, and profile properties. These services are part of a service-oriented architecture (SOA), in which an application consists of one or more services provided on the server, and one or more clients.

Client applications for ASP.NET application services can be of different types and can run on different operating systems. These include these following types of clients:

AJAX clients. These are ASP.NET Web pages (.aspx files) that run in the browser and that access application services from client script. AJAX clients typically use JSON format to exchange data. For more information, see Using Web Services in ASP.NET AJAX.
.NET Framework clients. These are .NET Framework Windows applications that access application services over HTTP by using the provider model infrastructure, and that use JSON protocol to exchange data. For more information, see Client Application Services Overview.
SOAP clients. These are clients that can access application services through SOAP 1.1. This is useful for clients that are running on other operating systems or using other technologies, such as Java applications. For more information, see Walkthrough: Using ASP.NET Application Services.

Hosting ASP.Net application Services in Azure is no different from hosting in on-premise server. The scenario that I've discussed in this blog is ASP.Net Client Application Services set-up and it's handling of cookies.

Set up Membership Database in SQL Azure - https://support.microsoft.com/kb/2006191/
Set up ASP.Net Application Services in Azure: Add/Edit the web.config (before deploying it to Azure) for the web role project to enable authentication and role service.

enablePasswordReset="true" enablePasswordRetrieval="false" passwordFormat="Hashed"

maxInvalidPasswordAttempts="5" minRequiredPasswordLength="7"

minRequiredNonalphanumericCharacters="0" requiresQuestionAndAnswer="false"

requiresUniqueEmail="false" passwordAttemptWindow="5" passwordStrengthRegularExpression=""

name="SqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" />

Confiugre Client Application Services (Windows Forms Client) as per the MSDN documentation - https://msdn.microsoft.com/en-us/library/bb384312.aspx
With the above three steps, you are all set to use the ASP.Net application services from a Windows Forms Client. Now comes the most interesting part, how do we handle authentication cookies in ClientApplicationServices? If it were ASP.Net client, when the cookie expires the application would automatically be redirected to the login page. There's no way windows forms application using client application services would have some functionality like that. However, there's a solution that exists and documented well on MSDN.

There are two steps to it, first make sure that cookie timeout is properly set in the forms element as shown below.

Note: slidingExpiration should be set to false. Otherwise, for every successful login (like user validation) attempt by the user - last activity time and hence cookie time out gets reset. For more information, read MSDN documentation here.

The next step is to check for the cookie expiration and one of the ways to do it is to call GetRolesForUser for the logged in user. The key to this is that all the valid users should be assigned to roles. If no roles are returned, the login has expired. For more information, read MSDN documentation here.

Here's some sample code:

System.Security.Principal.IIdentity identity =

System.Threading.Thread.CurrentPrincipal.Identity;

// Return if the authentication type is not "ClientForms".

// This indicates that the user is logged out.

if (!identity.AuthenticationType.Equals("ClientForms")) return;

try

{

ClientRoleProvider provider =

(ClientRoleProvider)System.Web.Security.Roles.Provider;

String userName = identity.Name;

// Determine whether the user login has expired by attempting

// to retrieve roles from the service. Call the ResetCache method

// to ensure that the roles are retrieved from the service. If no

// roles are returned, then the login has expired. This assumes

// that every valid user has been assigned to one or more roles.

provider.ResetCache();

String[] roles = provider.GetRolesForUser(userName);

if (roles.Length == 0)

{

MessageBox.Show(

"Your login has expired. Please log in again to access " +

"the roles service.", "Attempting to access user roles...");

}

if (provider.IsUserInRole(userName, "Power Users"))

{

MessageBox.Show("User is still active");

}

catch (System.Net.WebException)

{

MessageBox.Show(

"Unable to access the remote service. " +

"Cannot retrieve user roles.", "Warning",

MessageBoxButtons.OK, MessageBoxIcon.Warning);

}

Note: Some developers would try IsInRole method of the role service to check for expiration but it doesn't work always. The IsInRole method will always return false if the user login has expired. This will not occur if your application calls the IsInRole method one time shortly after authentication.

The sample project that I used is available for download!

ASPNetAJAXAuthentication.zip

Azure Deployment Aborted - DiagnosticMonitorConfiguration.OverallQuotaInMB

Zafar Mohammed - MSFT — Fri, 22 Jul 2011 14:49:00 GMT

I ran into an interesting issue today while configuring custom log directory in Azure Diagnostics. The role was aborting with the following code in OnStart method.

public override bool OnStart()
{
// Get the default initial configuration for DiagnosticMonitor.
DiagnosticMonitorConfiguration diagnosticConfiguration = DiagnosticMonitor.GetDefaultInitialConfiguration();

// Create a new DirectoryConfiguration object.
DirectoryConfiguration directoryConfiguration = new DirectoryConfiguration();

// Add the name for the blob container in Windows Azure storage.
directoryConfiguration.Container = "wad-custom-logs";

// Add the directory size quota.
directoryConfiguration.DirectoryQuotaInMB = 2048;

// Add the log path for the role using RoleEnvironment.GetLocalResource().
directoryConfiguration.Path = RoleEnvironment.GetLocalResource("MyCustomLogs").RootPath;

// Add the directoryConfiguration to the Directories collection.
diagnosticConfiguration.Directories.DataSources.Add(directoryConfiguration);

// Schedule a transfer period of 30 minutes.
diagnosticConfiguration.Directories.ScheduledTransferPeriod = TimeSpan.FromMinutes(30.0);

// Start the DiagnosticMonitor using the diagnosticConfig and our connection string.
DiagnosticMonitor.Start("Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString", diagnosticConfiguration);

return base.OnStart();
}

The code itself is pretty straight forward and you wouldn't expect any kind of failures in deployment. However, it failed. After several hours of troubleshooting, I thought of checking what would happen if I use development storage, so changed the DiagnosticMonitor.Start from DiagnosticMonitor.Start("Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString", diagnosticConfiguration) to DiagnosticMonitor.Start(CloudStorageAccount.DevelopmentStorageAccount, diagnosticConfiguration)

The local deployment failed with the below exception:

System.ArgumentException was unhandled

Message=OverallQuotaInMB is 4080MB but sum of requested sub-quotas is 5120MB.

Parameter name: initialConfiguration

Source=Microsoft.WindowsAzure.Diagnostics

ParamName=initialConfiguration

StackTrace:

at Microsoft.WindowsAzure.Diagnostics.DiagnosticMonitor.StartWithExplicitConfiguration(DiagnosticMonitorStartupInfo startupInfo, DiagnosticMonitorConfiguration initialConfiguration)

at Microsoft.WindowsAzure.Diagnostics.DiagnosticMonitor.Start(CloudStorageAccount storageAccount, DiagnosticMonitorConfiguration initialConfiguration)

at WebRole1.WebRole.OnStart() in D:\VS Projects\Visual Studio 2010\Projects\CustomLogDiagnostics\WebRole1\WebRole.cs:line 64

at Microsoft.WindowsAzure.ServiceRuntime.RoleEnvironment.InitializeRoleInternal(RoleType roleTypeEnum)

at Microsoft.WindowsAzure.ServiceRuntime.RoleEnvironment.InitializeRole(RoleType roleType)

at Microsoft.WindowsAzure.ServiceRuntime.Implementation.Loader.RoleRuntimeBridge.b__0()

at System.Threading.ExecutionContext.runTryCode(Object userData)

at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)

at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)

at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)

at System.Threading.ThreadHelper.ThreadStart()

It was a good breakthrough after several hours of troubleshooting. I then checked the documentation for OverAllQuotaInMB for diagnostic monitor and found it to be default value of 4GB as stated in the exception.

https://msdn.microsoft.com/en-us/library/microsoft.windowsazure.diagnostics.diagnosticmonitorconfiguration.overallquotainmb.aspx

Looking at the exception, you would think I can increase the OverAllQuotaInMB for the diagnostic monitor and resolve the issue. However, that's not it. The catch is OverallQuotaInMB can only be set to a lower value but not higher. The actual solution lies in the service definition file under LocalResources section. Here's a service definition configuration that should work.

How to restrict unwanted IPs to access your site in Azure environment?

Zafar Mohammed - MSFT — Thu, 21 Jul 2011 15:52:00 GMT

This is a very frequently asked question, not just in the Azure world!

How to restrict unwanted IPs to access your site in Azure environment?

There are two parts to it, as listed below:

1. Static IP Restriction - where you know the list of IPs that you would like to restrict.

Follow this blog - https://www.iis.net/ConfigReference/system.webServer/security/ipSecurity

Command script to enable static IPSecurity on Azure role:
@echo off
@echo
Installing "IPv4 Address and Domain Restrictions" feature

%windir%\System32\ServerManagerCmd.exe -install Web-IP-Security
@echo
Unlocking configuration for "IPv4 Address and Domain Restrictions" feature

%windir%\system32\inetsrv\AppCmd.exe unlock config
-section:system.webServer/security/ipSecurity

2. Dynamic IP Restriction - where you would be able to monitor the unwanted IPs actively and then apply the restriction

Follow this blog - https://learn.iis.net/page.aspx/548/using-dynamic-ip-restrictions

Hosting PHP/ZEND Framework applications in Windows Azure Web Role (Full IIS)

Zafar Mohammed - MSFT — Wed, 20 Jul 2011 12:01:00 GMT

Symptom: Unable to host application using ZEND framwork and PHP. The role gets started but runtime issues occur. Here's one of the errors logged in the application event log & browser indicating PHP prcess in crashing.

Log Name:      Application
Source:        Application
Error
Date:
4/21/2011 9:12:11 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:
N/A

Computer: RD00155D38277C
Description:
Faulting
application php-cgi.exe, version 5.3.1.0, time stamp 0x4b06c42f, faulting module php-cgi.exe, version 5.3.1.0, time stamp 0x4b06c42f, exception code 0xc0000005, fault offset 0x0000191a, process id 0x618, application start time 0x01cc0068c7d3bcdd.

Upon running processmon, found out that ZEND framework files were not being located. Process monitor basically complained about not finding the path for zend specific files. I could see that, F:\approot\php\php.ini (configuration file) is where it has configured all the paths listed below. I would expect them to be directed somewhere under F:\approot\php directory instead.

29:20.3 php-cgi.exe 2324 CreateFile C:\xampp\php\extras\ PATH NOT FOUND

29:20.3 php-cgi.exe 2324 CreateFile C:\xampp\php\ PATH NOT FOUND

29:20.3 php-cgi.exe 2324 CreateFile C:\xampp\php\extras\browscap.ini PATH NOT FOUND}

Here's a good video and corresponding blog that lets you put PHP on IIS.

https://channel9.msdn.com/posts/php-azure

https://rhizohm.net/irhetoric/post/2011/04/18/How-To-Do-PHP-Deployment-To-Windows-Azure.aspx

Just go through the above video and blog, find the section where it talks about copying the files using the Start-up task. Since the issue is with not being able to find the zend framework specific files and folders as indicated above, you can also create a startup task to copy all the files and folders under “c:\xampp\php” to “F:\approot\php”

Here’s how you can do it:

My research led me to conclude that the ZEND framework is generally installed at C:\xmapp\php (at least in case of using apache server, it could be a different location if installing for IIS), copy all the files and sub-folders under “C:\xmapp\php” or any relevant location to a folder call “putmoduleshere” within your application folder on the development machine like explained in the blog/video above. You can then use a similar startup task of copy files and do an xcopy as below.

xcopy "..\putmoduleshere\*.*" "%approot%\PHP\"

WCF Tracing in Windows Azure SDK 1.3 or higher

Zafar Mohammed - MSFT — Wed, 20 Jul 2011 11:41:00 GMT

WCF Tracing in on-premise servers - https://msdn.microsoft.com/en-us/library/ms733025.aspx
WCF Tracing in on-premise servers with intermittent failures – Enable Circular tracing: https://msdn.microsoft.com/en-us/library/aa395205.aspx
WCF Tracing in Azure:

As most of you already know, WCF Service Web Role implements WCF tracing by default and puts it in the local storage. However, it's disabled by default. All you have to do to enable is to uncomment certain configuration in web.config as shown below.

Change tag from:

name="AzureDiagnostics">

And add the diagnostics tag in

……………………

Now, what if you decided to deploy the WCF service web role without enabling WCF trace in the local storage? The answer is, we can still enable WCF tracing like any other non-Azure application and write it on the web/worker role. Here’s the configuration:

name="xml" />

name="AzureDiagnostics">

maxMessagesToLog="300"

logMessagesAtServiceLevel="true"

logMalformedMessages="true"

logMessagesAtTransportLevel="true" />

…………………………

However, the trace will not be generated just with the above configuration. If you run procmon, you would see “Access Denied” on CreateFile for “C:\CTS\WCFTrace.svclog” that I’ve in the configuration for logging WCF trace. Open up task manager and you would see w3wp.exe (remember – it’s full IIS) running under Network Service account. This account needs to have permissions to write on the folder configured to store WCF traces. Just give “Everyone” write permissions on the folder and get it to work!!

Since regular tracing works, I don’t expect any issues running circular (rolling) tracing in the Azure environment.