Technobytes https://docs.microsoft.com/archive/blogs/surajdixit/feed.xml More about technology.. Tue, 16 Apr 2019 05:32:22 GMT en-US hourly 1 Custom Module for ARR Reverse Proxy to Pass the logged-in user to back-end servers https://docs.microsoft.com/archive/blogs/surajdixit/custom-module-for-arr-reverse-proxy-to-pass-the-logged-in-user-to-back-end-servers Mon, 01 Oct 2018 01:41:24 GMT https://blogs.msdn.microsoft.com/surajdixit/?p=455 Client (logged in user) => ARR Reverse Proxy (IIS) (logged in user) => (logged in user) Apache What I did was pretty simple. I enabled windows authetication on the ARR server so that it gets logged in credentials. Once we get the logged in credentials, we have to set a Request Header with the value of the logged in credentials so that when the proxy makes a request to the backend apache server, this header will be passed and the backend server will be able to read the header and get the user credentials. For setting a header, I created a simple custom http module and configured it on the reverse proxy server. Below is the code for the module:
using System;
using System.Security.Principal;
using System.Web;
namespace Module
{
    public class HttpToHttps : IHttpModule
    {
        // In the Init function, register for HttpApplication events by adding your handlers.
        public void Init(HttpApplication application)
        {
            application.PostAuthenticateRequest += new EventHandler(this.OnAuthorizeRequest);
        }
        public void Dispose()
        {
        }
        public void OnAuthorizeRequest(object sender, EventArgs e)
        {
            HttpApplication httpApplication = (HttpApplication)sender;
            HttpApplication application = (HttpApplication)sender;
            HttpContext context = application.Context;
            IIdentity id = HttpContext.Current.User.Identity;
            if (null != id)
            {
                application.Request.Headers.Set("REMOTE_USER", id.Name);
            }
        }
    }
}
First we created a rewrite rule to point to the backend server then added this module and tested it out.  Basically what this module does is, as soon as the request arrives with the Kerberos/NTLM token on the reverse proxy, it extracts the logged in user information and sets a custom request header with the value of logged in credentials.  So when the proxy makes a request to the backend server based on the rewrite rule, this header will be passed in request and the backend server can read the header and get the user info. On testing, I could see the REMOTE_USER header in the outbound request from proxy. Below are the request headers for the request from the Client machine to Proxy server.
GET / HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Host: sudixi418vm
Authorization: NTLM TlRMTVNTUAADAAAAGAAYAJYAAABKAUoBrgAAAA4ADgBY<<trimmed>>
below are the request headers for the outbound request from proxy which is reaching the backend server containing the remote_user header with the logged in user value which was fetched from the custom http module configured on proxy server.
GET / HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Authorization: NTLM TlRMTVNTUAADAAAAGAAYAJYAAABKAUoBrgAAAA4ADgBY<<trimmed>>
Host: sudixi483vm
Max-Forwards: 10
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
X-Original-URL: /
REMOTE_USER: SUDIXI1\Administrator
X-Forwarded-For: 192.168.2.50:57639
X-ARR-LOG-ID: 1f5e738d-0172-4a8a-8151-7d30337802e9
Connection: Keep-Alive
Hope this helps! Happy Coding!!  ]]> Kerberos Configuration Manager for IIS Server https://docs.microsoft.com/archive/blogs/surajdixit/kerberos-configuration-manager-for-internet-information-services-server Wed, 07 Feb 2018 06:36:08 GMT https://blogs.msdn.microsoft.com/surajdixit/?p=85 Why is Kerberos painful at times?
  1. First, understanding Kerberos is quite tricky.
  2. Configuration takes a lot of time as we need to look at configuration of IIS server, Domain controller and Client side.
  3. Once a site breaks because of some configuration related issues, it’s really difficult to identify the exact cause because of the complexity.
Let’s see what exactly happens “Under the Hood”: At a high level, the following steps needs to be followed to configure Kerberos for a website: On IIS Server:
  1. Disable all the authentication methods except windows authentication
  2. In windows authentication section, in Providers we should see negotiate should be a priority
  3. ASP.NET Impersonation should enabled if you want to configure Pass-through Authentication(Kerberos double hop)
  4. Based on the Application pool credentials,
    • useAppPoolCredentials to true if we are using a custom account
    • useAppPoolCredentials to false and useKernelMode to true if we are using a machine account
On Domain Controller:
  1. Based on the Application pool credentials on the IIS we set Service Principle names on the DC.
    • If we use a Machine account, set SPNs on Machine account
    • If we use a custom account, set SPNs on custom account
  2. The above also depends on whether we are using a hostname or machine name to browse the website
  3. Delegation need to be enabled for the Application pool credentials if you want configure pass-through authentication (This tab will come up after we set the SPNs).
On Client Browser(Internet Explorer): Based on whether we use hostname or not, we need to add the host/machine name to Trusted sites/Local Intranet Zone. You can find more information regarding Configuration of Kerberos in the following blogs:
  1. https://blogs.msdn.microsoft.com/chiranth/2013/09/20/all-about-kerberos-the-three-headed-dog-with-respect-to-iis-and-sql/
  2. https://blogs.msdn.microsoft.com/chiranth/2014/04/17/setting-up-kerberos-authentication-for-a-website-in-iis/
Now just imagine if we can automate the above process through a nifty application which can help us troubleshoot/configure Kerberos in just a few minutes – Is it possible? The good news is that NOW IT IS POSSIBLE :) I have developed a simple troubleshooter “Kerberos Configuration Manager for IIS” which allows one to do the following tasks on the server:
  1. Review the current settings related to Kerberos for any specific website in IIS.
    • Checks and displays the site properties
    • Checks and displays Application pool properties like Application pool identity
    • Checks and displays Anonymous authentication properties
    • Checks and displays Basic authentication properties
    • Checks and displays Digest authentication properties
    • Checks and displays ASP.NET Impersonation properties
    • Checks and displays Windows authentication
      • whether Windows authentication is enabled or disabled
      • What are the Providers settings
    • Checks and displays Configuration editor settings for windows authentication
      • UseAppPoolCredentials settings
      • UseKernelMode settings
    • Based on the Application pool identity,
      • Checks for the existing SPNs for that identity and displays them
      • Displays the necessary SPNs required for Kerberos to work
      • Checks and displays existing Delegation settings in case you want to go with the Pass-through authentication.
      • Displays the necessary Delegation settings in case you want to go with the Pass-through authentication.
  1. Configures Kerberos for the affected website:
    • Disables Anonymous authentication if enabled
    • Disables Basic authentication if enabled
    • Disables Digest authentication if enabled
    • Disables ASP.NET Impersonation if enabled
    • Enables Windows authentication if disabled
      • Once the above is enabled, checks whether we have Negotiate on priority or no. If not, Negotiate is moved to the top
    • Based on the application pool credentials,
      • Either it will enable useAppPoolCredentials or disables it
      • Either it will enable useKernelMode or disables it
    • Based on the Application pool identity,
      • Checks for the existing SPNs for that identity and displays them
      • Displays the necessary SPNs required for Kerberos to work
      • Checks and displays existing Delegation settings in case you want to go with the Pass-through authentication.
      • Displays the necessary Delegation settings in case you want to go with the Pass-through authentication.
    • Generates the script for setting the required SPNs in the same directory if you want to configure single hop
    • Generates the script for setting the required SPNs and setting the delegation properties for the application pool identity in the same directory if you want to configure Pass-through authentication.
  1. It also has a provision to revert the changes made just in case there is a requirement.
  2. It also has a feature of auditing through a log file which would capture the below details:
    • Logged in user who used the tool and made changes
    • Timestamp when the changes were made
    • Review, Configure and Revert logs (All settings which were added/modified)
The good news is that we have released the Kerberos Configuration Manager v2.0 which supports reviewing and configuring the Kerberos Pass-through authentication also (Kerberos Double Hop). Whats new in Kerberos Configuration Manager v2.0 ?
  1. Double Hop Support - Delegation and Impersonation
  2. UI changes
  3. Scroll view for the text area
  4. Application can run as administrator without any intervention
  5. Bug fixes
Why should I use tool?:
  1. Troubleshooting Kerberos just becomes much simpler with this tool and it optimizes the time taken to troubleshoot from few hours to few minutes.
  2. You can review the Kerberos Configuration for any of your web sites and share the generated log files with support to save precious troubleshooting time.
  3. No need to install the tool -  it’s a standalone executable.
  4. Disk space utilization is minimal.
  5. Open source, free to download and modify.
  6. Auditing support which makes troubleshooting Kerberos easier.
Where do I get it from and how do I use it? The tool can be downloaded from the open source github repo: Latest release: https://github.com/SurajDixit/KerberosConfigMgrIIS/releases/download/v2.1/KerberosConfigMgrIIS.exe All releases : https://github.com/SurajDixit/KerberosConfigMgrIIS/releases The GUI has a fairly simple layout with the options to Review, Configure, Generate Script and Revert the Kerberos related configuration settings. Instructions for use:
  • Create a folder called KCMI on the server where IIS is installed and copy the executable file “KerberosConfigMgrIIS.exe”.
  • Run the executable “KerberosConfigMgrIIS.exe”.
  • When you execute the file, you will see the below screen:
  • Select the website from the drop down menu for which you want to configure Kerberos.
  • Now select from the Radio buttons whether you want to configure the website for Single Hop or Double Hop(Pass Through Authentication) and click on Review.
ddd
  • Once you click on the Review button you will see the current Kerberos configuration for the selected website.
  • In-between you will see the Dialogue which is shown below to ask whether we are making use of “Hostname” to browse the website?
  • If we click “Yes”,  we will see one more Dialogue box to input the hostname. If we click “No”,  we don’t see any dialogue box and execution will continue.
  • The Kerberos configuration would show all the recommended and non-recommended settings. Please review it carefully.
  • Once you have reviewed the setting and you are ready to “Fix” the problem, please click on “Configure” button to make the necessary changes.
  • Once the configuration is implemented, you will see 2 buttons enabled, One is Generate script and other is Revert. Also you will notice that the dropped down will be locked so that we don’t revert the changes for a wrong site by mistake.
  • Once you click the Generate Script you will see a .cmd file and .ps1 file (Only if you have selected Pass-Though authentication) in the current folder which has the commands to add SPNs and Set the delegation for the application pool identity user on the Domain controller.
  • In case you want to revert the changes, simply click on “Revert” button and all the changes which were made earlier will be reverted back with respect to IIS (Note: If you have executed the .cmd file, it will not be reverted).
  • As soon as you start the application, a Log file is generated in the same folder as the executable with the system date timestamp. This log file would capture the timestamp, logged on user and all the series of configuration changes implemented during the session.
  • In case you want to review changes for new website, Close the tool and reopen it as administrator and follow the above steps from step# 1.
And that’s all, you will have your site configured with Kerberos on IIS! Any pre-requisites?
  1. Operating System : Windows Vista & above
  2. .NET Framework  : 4.5.2 & above
  3. IIS Server Version : 7.5 and above
  4. All the modules should be installed related to Kerberos authentication like windows authentication module etc.
Feedback: If you have any feedback, inputs, bugs to report about the tool, please comment below. Happy Troubleshooting!]]> Drupal : PDOException: SQLSTATE[HY000][2002] on Azure PAAS https://docs.microsoft.com/archive/blogs/surajdixit/drupal-pdoexception-sqlstatehy0002002-on-azure-paas Wed, 09 Aug 2017 23:34:02 GMT https://blogs.msdn.microsoft.com/surajdixit/?p=66  I was trying to browse this site (https://technobytes.azurewebsites.net) which is a Drupal Website and is hosted on Azure as an App Service and  suddenly I could see the below exception. I kind of wondered what happened. I quickly checked that line of code mentioned in the exception but couldn't find much info about exception but I got a hint that cause might be hidden in the sites/default/settings.php I checked the php script and it had all the information about the SQL connection Now I checked its socket for connecting to the MySQL server and I could see 127.0.0.1:40456 So I quickly checked the data/mysql/MYSQLCONNSTR_localdb.txt to check the connection string and I could see a different port in the socket. I changed the port in the settings.php which is there in the connection string and the site started working as expected. What actually happened? MySQL runs on a process created on azure called mysqld.exe, due to some reason it was recycled i.e. in simple words the process was be killed and re-spawned, and Port was changed. And it was updated in the connection string file Resolution: Find out the new Port from data/mysql/MYSQLCONNSTR_localdb.txt file and update it in your sites/default/settings.php as below
$databases['default']['default'] = array( * 'driver' => 'pgsql', * 'database' => 'databasename', * 'username' => 'username', * 'password' => 'password', * 'host' => 'localhost:port', * 'prefix' => '', * );
I hope this helps you. Happy Coding !]]> C# module for HTTP to HTTPS redirection for custom ports by reading them from AppHost.config https://docs.microsoft.com/archive/blogs/surajdixit/c-sharp-http-module-for-http-to-https-for-custom-ports Sat, 29 Jul 2017 08:07:44 GMT https://blogs.msdn.microsoft.com/surajdixit/?p=25 A week back I was thinking if we can dynamically fetch the custom ports (other than 443) from apphost.config and use it to redirect the request without writing any URL Rewrite rules. Then I wrote a module which does the same job. In this article I will explain the module which I have written. I have written a class library which makes use of Microsoft.Web.Administration.dll and returns Port in integer format. I have referenced this library in the HTTP Module. You can find the code below. using System; using Microsoft.Web.Administration; public static class ServerMgr { public static int getPort() { using (ServerManager serverManager = new ServerManager()) { Configuration config = serverManager.GetApplicationHostConfiguration(); ConfigurationSection sitesSection = config.GetSection("system.applicationHost/sites"); ConfigurationElementCollection sitesCollection = sitesSection.GetCollection(); ConfigurationElement siteElement = FindElement(sitesCollection, "site", "name", @"site2"); if (siteElement == null) throw new InvalidOperationException("Element not found!"); ConfigurationElementCollection bindingsCollection = siteElement.GetCollection("bindings"); ConfigurationElement bindingElement = FindElement(bindingsCollection, "binding", "protocol", @"https"); if (bindingElement == null) throw new InvalidOperationException("Element not found!"); string combinedPort = (string)bindingElement["bindingInformation"]; serverManager.CommitChanges(); int port = Convert.ToInt32(string.Join(null, System.Text.RegularExpressions.Regex.Split(combinedPort,"[^\\d]"))); return port; } } private static ConfigurationElement FindElement(ConfigurationElementCollection collection, string elementTagName, params string[] keyValues) { foreach (ConfigurationElement element in collection) { if (String.Equals(element.ElementTagName, elementTagName, StringComparison.OrdinalIgnoreCase)) { bool matches = true; for (int i = 0; i < keyValues.Length; i += 2) { object o = element.GetAttributeValue(keyValues[i]); string value = null; if (o != null) { value = o.ToString(); } if (!String.Equals(value, keyValues[i + 1], StringComparison.OrdinalIgnoreCase)) { matches = false;/span> break;/span> } } if (matches) { return element; } } } return null; } } Below is the code for HTTP module which makes use of the above class library to get the port and redirect request. The module has registered to listen for one event called application.BeginRequest which does the trick when the first request begins. using System; using System.Web; namespace Module { public class HttpToHttps : IHttpModule { // In the Init function, register for HttpApplication events by adding your handlers. public void Init(HttpApplication application) { application.BeginRequest += new EventHandler(this.OnBeginRequest); } public void Dispose() { } public void OnBeginRequest(object sender, EventArgs e) { // Create HttpApplication and HttpContext objects to access request and response properties. HttpApplication application = (HttpApplication)sender; HttpContext context = application.Context; if (!application.Request.IsSecureConnection) { string serverName = HttpUtility.UrlEncode(application.Request.ServerVariables["SERVER_NAME"]); string filePath = application.Request.FilePath; int customPort = ServerMgr.getPort(); application.Response.Redirect("https://" + serverName + ":" + customPort + filePath); } } } } Just register this module in your web.config so that it is fired as soon as the request reaches the IIS server. You can do it from IIS manager as well. Below are the steps to register the module in your site.
  • Make sure all the 3 DLLs (Getport.dll, HttpToHttps.dll and Microsost.Web.Administration.dll) are in the bin folder of website location
  • Open IIS manager and select your site.
  • In the Connections pane, expand the server name, expand Sites, and then go to the Web site or application to which you want to add a managed module.
  • In the Home pane, double-click Modules.

  • In the Actions pane, click Add Managed Module.
  • In the Add Managed Module dialog box, enter the name of the managed module in the Name box, and then enter or select the module's .NET Framework fully-qualified type in the Type box.
  • Select the Invoke only for requests to ASP.NET applications or managed handlers option if you want the module to respond only to managed requests.

  • Click OK.
I have provided the link below to download both class library and HTTP Module in case if you want to test it. Code.zip Happy Coding !]]>