Random thoughts and collisions

Tuesday, September 11, 2012

Firefox : Displaying the SAML content

The SAML Tracer add-on is a really useful tool to display the SAML message flow during SSO and logout with ADFS.

(Ain’t gonna help you with WIF though because that’s WS-Federation through and through and there ain’t no add-on for that).

Neat!

Enjoy!

Wednesday, September 05, 2012

Visual Studio : XML comments

Also called programmatic comments or xml documentation.

If you have a method like:

public void blah (String a, int b)
{
            
}

and you want the comments, just type /// on the line before and you get:

/// <summary>
/// 
/// </summary>
/// <param name="a"></param>
/// <param name="b"></param>
public void blah (String a, int b)
{
            
}

If you have ReSharper, put the cursor over the method name i.e. “blah” and press Ctrl / Shift / F1.

You get a neat popup window.

Enjoy!

Friday, August 24, 2012

ASP.NET : reCaptcha with proxy

If you need reCaptcha in your project, this is a really good one to use. it’s also available as a NuGet package.

The only problem is that it doesn’t use a proxy. There is a Proxy attribute in the control but it inherits from IWebProxy and I couldn’t figure out how to set it.

So (with the help of TortoiseSVN) I grabbed the source and added this code to

public RecaptchaResponse Validate() in RecaptchaValidator.cs

//if (this.proxy != null)
//{
      //request.Proxy = this.proxy;
      IWebProxy rProxy = WebRequest.GetSystemWebProxy();
      string login = ConfigurationManager.AppSettings["reCaptchaLogin"];
      string password = ConfigurationManager.AppSettings["reCaptchaPassword"];
      if (!String.IsNullOrEmpty(login))
             rProxy.Credentials = new NetworkCredential(login, password);
      else
             rProxy.Credentials = CredentialCache.DefaultCredentials;
      request.Proxy = rProxy;
//}

and then I added an appsettings to the web.config in the Tests directory

<appSettings>
    <!-- Needed to get past proxy -->
    <add key="reCaptchaLogin" value="" />
    <add key="reCaptchaPassword" value="" />
</appSettings>

Problem solved!

Enjoy!

Thursday, August 16, 2012

WIF : Migration from 1.0 to 4.5

Interesting interview with Dominick Baier to discuss his new course Introduction to Identity and Access Control in .Net 4.5. The link is here.

To quote:

“ [Dominick] Yeah, that’s a good question. So, as I just said, Microsoft basically injected these new base classes. And they were really careful that they didn’t break compatibility with existing systems. So, if you are used to using the IIdentity.Name property, for example, what they do under the covers is they go to the clams collection and search for a name claim and give you back that value. So, from the outside, this thing works the same, under the covers, it uses claims. If you are used to use–IsInRole for example, or like the existing like the authorization module in ASP.NET, then what under the covers is happening is that is in role search, it’s for a role claim and to look if that is part of your claims collection. So, in other words, if you haven’t done any heavy customization of .NET built-in security system, things should just work in 4.5. That means, you don’t take advantage of the new system but you don’t break your application just by compiling against 4.5. That also means that you can gradually move into this claims-based world. So you can make use of this new property called Claims which is a collection of statements that you can attach to a user. And yeah, for existing applications, things shouldn’t change at least not from the outside. If you are investing in a new system, or you are not happy with what you have so far, then it’s definitely worth to look like trying to make use of the claims-based infrastructure right from the start. But, I guess the good news is that your systems shouldn’t break, at least if you haven’t done anything radical to .NET built-in infrastructure.”

So hopefully things will just work as normal after the migration.

You can see the class diagram changes at Identity in .NET 4.5–Part 1: Status Quo (Beta 1).

Enjoy!

Monday, August 13, 2012

ADFS : Problems with wevtutil

When you are trying to turn on the debug logging for ADFS and you Google it, you will find some entries that tell you to run wevtutil as follows:

wevtutil.exe sl “AD FS 2.0 Tracing/Debug” /L:5

The problem is that you then get an error:

“Too many arguments are specified. The parameter is incorrect.”

To fix this, run:

wevtutil sl “AD FS 2.0 Tracing/Debug” /L:5

Enjoy!

Tuesday, August 07, 2012

AD : Programmatically getting password policy

On Windows Server 2008, this doesn’t seem possible. There doesn’t appear to be an API that gives you all the details of the current user’s password policy.

Why does this matter?

Because when the user needs to pick a password and they get it wrong, the standard message is:

“The password you have chosen does not meet corporate policy. Please contact the help desk”.

The standard wrt. complexity is normally:

“The password contains characters from three of the following categories:

Uppercase letters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters)
Lowercase letters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters)
Base 10 digits (0 through 9)
Non-alphanumeric characters (special characters) (for example, !, $, #, %)
Any Unicode character that is categorized as an alphabetic character but is not uppercase or lowercase. This includes Unicode characters from Asian languages.”

However, you can summarise the above and then get the pieces of the puzzle individually. To do this, you would have to get each attribute from AD.

Refer Windows Domain Password Policies

msDS-PasswordSettingsPrecedence
Establishes what takes precedence in situations where a user has membership in multiple groups with different password policies.

msDS-PasswordReversibleEncryptionEnabled
Toggles whether reversible encryption is enabled.

msDS-PasswordHistoryLength
Determines how many intervening passwords must be unique before one can be reused.

msDS-PasswordComplexityEnabled
Establishes the number and type of characters required in a password.

msDS-MinimumPasswordLength
Establishes the minimum length of a password.

msDS-MinimumPasswordAge
Determines how long a user must use a password before changing it.

msDS-MaximumPasswordAge
Determines how long a user can use a password before being required to change it.

msDS-LockoutThreshold
Determines how many failed password attempts will be allowed before locking out user account.

msDS-LockoutObservationWindow
Determines the time after which the bad password counter will be reset.

msDS-LockoutDuration
Determines how long the account will be locked out after too many failed password attempts.

So the message could be something like:

“Your password must be <msDS-MinimumPasswordLength> characters long, you cannot use one of your previous <msDS-PasswordHistoryLength> passwords and you will have to change it every <msDS-MaximumPasswordAge> days”.

Enjoy!

Monday, August 06, 2012

ADFS : Some of the content in the federation metadata was skipped

If you configure ADFS on a regular basis, you are pretty much guaranteed to get this message.

The full text is that it is not supported by ADFS and you should review carefully.

The first step is to get the RP metadata as a file and have a look at it.

The number one reason in my experience is that the connection is http rather than https.

ADFS REQUIRES https – no exceptions.

The number two reason is that the federation has SAML1 stuff e.g.

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location=https://xxx index="1"/>

will throw the warning.

Enjoy!

ADFS : Restricting access to an application

Most of the available documentation talks about ADFS as a claims-provider and the RP (the application) uses the set of claims to decide on access and functionality.

However, there are claims which restrict access at the ADFS level.

These are the permit / deny claims.

Refer:

Create a Rule to Permit or Deny Users Based on an Incoming Claim

An ADFS Claims Rules Adventure

Introduction to Token Issuance Authorization in AD FS 2.0 RC

If you set these rules up correctly, you will get an “Access Denied” error from ADFS.

Because this is all controlled by the claims rules language, you can have complex IF – AND – OR – NOT scenarios to decide whether or not the user gets access to the application.

Enjoy!

Thursday, July 12, 2012

AD : Adding the extension attributes

Quite often when you work with AD, you need some extra attributes to store customer specific information. I normally use the extensionAttributes (1 through 15) for this.

The problem is that they are not in AD out-the-box.

They are part of the Microsoft Exchange Server schema. The schema is the only part you have to install. You do NOT have to install Exchange.

Refer Prepare Active Directory and Domains

I used Exchange 2010 SP2. I guess you could download the trial version if you don’t have the DVD to hand?

To install, just run “Setup /PrepareSchema” to have the additional extension attributes added.

Note that you need to be a “Domain Admin” & “Schema Admin” & “Enterprise Admin” in order to run this script.

Enjoy!

Friday, July 06, 2012

ADFS : List of claims types

There’s a number of lists all over the place.

This one comes from SelfSTS.

You are free to construct any claim type you wish e.g.

http://schemas.company.co.nz/identity/claims/teamidentifier

Enjoy!

Friday, June 29, 2012

Powershell : Setting credentials for a web request

Trying to get through a proxy and getting the dreaded “407 – Proxy Authentication Required.
The solution is to use:

$wcl = New-Object Net.Webclient
$wcl.Credentials = new-object Net.NetworkCredential("login", "password", "domain")
$wcl.Proxy.Credentials = new-object Net.NetworkCredential(("login", "password", "domain");

And suddenly we’re through the proxy and all is good!

Enjoy!

Thursday, June 21, 2012

ADFS : Sending groups as claims

When you are configuring the claims rules in ADFS, you have a number of options for sending AD groups.

You can send them all at once – “Send LDAP Attributes as Claims” or you can send then individually – “Send Group Membership as a Claim”.

In the latter case, you get to “clean” the name up.

e.g. you can have a group called “TN-W2008-Test-Marketing-Editor” because of some company naming convention but you can configure the claim to be of type:

http//schemas.microsoft.com/ws/2008/06/identity/claims/role with a value of “MarketingEditor”.

The downside with this is that if the groups are deleted or renamed, you have to manually reconfigure ADFS.

For the former, ADFS simply sends the whole lot. If a group is renamed, it simply sends the new name.

There are a number of options for the groups i.e.

Token-Groups as SIDs

Token-Groups - Qualified by Domain Name

Token-Groups - Qualified by Long Domain Name

Token-Groups - Unqualified Names

If you gave a group called Editor with a SID of S-1-5-21-3794324387-748717723-962058466-1466 and a domain of company.com (and assuming you map them all to a type of “role”) then the four different types result in:

…identity/claims/role = S-1-5-21-3794324387-748717723-962058466-1466

…identity/claims/role = company\Editor

…identity/claims/role = company.com\Editor

…identity/claims/role = Editor

Note that you get a role claim per group. If the user is a memberof 6 groups, they will get six separate claims of type “role”. This includes the default claim of “Domain Users”.

Enjoy!