Misc : On asking questions

 

Jon Skeet wrote a very good article : Writing the perfect question.

I’m active on stackoverflow and the MSDN forums and I wish more people would read this article.

Recently there was a question and I replied waxing voluble about how to do something using WIF and the dude replied:

“Actually it’s a Java application”.

FFS dude, why didn’t you put that minor piece of information in the question?

The quality of the answer is directly related to the quality of the question.

And for God’s sake, spell check it!

Enjoy!

Visual Studio : Cannot import the following key file

 

When you have a signed project in TFS, every time a new person gets it out, they have this problem. So they create a new certificate, check it all in and the next person has the same problem. WTF.

The error is:

“Cannot import the following key file: xxx.pfx. The key file may be password protected. To correct this, try to import the certificate again or manually install the certificate to the Strong Name CSP with the following key container name: VS_KEY_blah”

Mr Google to the rescue. Found a number of “solutions” but then stumbled across one that worked.

In the project properties under “Signing”, click the dropdown arrow and click on the pfx file name. This invokes the password dialogue so you can type in the new password and Bingo!

All then compiles.

Enjoy!

Stackoverflow : What can I say?

Taken a while but I finally got there!

 



Enjoy!

ADFS : Exclusive Canonicalization transform error

 

Busy trying to get ADFS v2.0 to work with a third-party SAML implementation and got this weird error:

System.Security.Cryptography.CryptographicException: ID6005: Exclusive Canonicalization transform does not support the algorithm 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315'.

“IDxxxx” as an error normally implies it comes from WIF so trawl through that and it turns out that the only transform it accepts is:

http://www.w3.org/2001/10/xml-exc-c14n#

The transforms .NET works with are all listed in:

System.Security.Cryptography.Xml.SignedXml

So I had to get the third party code changed to conform with ADFS.

What is the point of all this, you may ask.

This is all connected with signatures e.g. your sp.xml looks like:

SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"

Because XML can have many forms e.g. whitespace or none, CR or CR/LF etc. you need to convert the XML to an agreed format before you sign it. Otherwise the other side may be checking the signature on a “different” document. These “agreed formats” are the canonical transforms. They are all W3C standards.

So e.g. it may state:

The canonical form of an XML document is the physical representation of the document produced by the method described in this specification. The changes are summarized in the following list:

• The document is encoded in UTF-8
• Line breaks normalized to #xA on input, before parsing
• Attribute values are normalized, as if by a validating processor
• Character and parsed entity references are replaced
• CDATA sections are replaced with their character content
• The XML declaration and document type declaration (DTD) are removed
• Empty elements are converted to start-end tag pairs

etc.

Enjoy!

C# : & in the XML

 

If you have an XML string (e.g. the appSettings in web.config) that contains an “&” it won’t compile e.g.

<add key="URL" value="http://example.com?ID1=abc&ID2=123"/>

The solution is to escape it with the Unicode number i.e.

<add key="URL" value="http://example.com?ID1=abc&#038;ID2=123"/>

Enjoy!

IIS : Could not load file or assembly

 

So I had a website – .NET Framework 4 / IIS 7.5 - working perfectly on my PC.

Moved it to another box and got the error with one of my dlls.

“Could not load file or assembly ‘xxx’ or one of its dependencies. An attempt was made to load a program with an incorrect format”

WTF!

Mr. Google to the rescue. Normal battle with the ten tons of shite but then one link rang a bell.

My original box was 32 bit whereas the new one is 64 bit.

What you have to do with the ApplicationPool is:

In IIS 7 Manager:

• Click ApplicationPools
• Select the one for your application.
• Click “Advanced Settings” on the right
• Under “General” at the top, set “Enable 32-bit Applications” to be “True”

Bingo – problem solved.

Enjoy!

ADFS : I want to see the SAML data

There are a number of ways to see the SAML data.

Fiddler is one way.

You can use the TextWizard to URL decode and SAML decode. Refer my update on this - SAML : Encoding / decoding a trace

Refer Using Fiddler to trace a SAML IDP Request from ADFS 2.0

Dominick Baier wrote a Fiddler Inspector for Federation Messages.

Also described here : Viewing SAML/Federation response in Fiddler.

Also, the Troubleshooting WS-Federation and SAML2 Protocol tool. 

There's also the Feide SAML 2.0 Debugger.

And a URL Decoder/Encoder.

And another SAML 2.0 debugger.

But my favourite way is to use the:

SAML Tracer

which is a FireFox add-on..

Or Auth0 SAML tool

Or the Chrome SAML extension:

SAML Chrome extension 

And there are some more tools here:

Collection of Useful SAML Tools

Enjoy!

ADFS : IDP / IP and SP Initiated flows

This confuses some people so some ADFS v2.0 screen shots might be helpful.

SP Initiated is the more normal flow. The user navigates to the application, WIF (or whatever) redirects to ADFS and you get the normal login screen:



After the user is logged in, the application gets the SAML token.

IDPInitiated in ADFS only works for SAML bindings.

The ADFS IDPInitiated URL is:
https://xxx/adfs/ls/IdpInitiatedSignOn.aspx



ADFS looks through all the configured RP to find any with a SAML binding and then displays them all in the dropdown.

The user can either sign in first using the first option and then navigate directly to one of the dropdown applications or first select a dropdown entry using the second option and then sign in.

After the user is logged in, the application gets the SAML token.

The SAML token is the same for both IP and SP initiated.

Enjoy!

ADFS : General SAML problems

 

From experience, make sure you:

• Map email in a transform rule to “NameID – Transient”
• Use SHA1 not SHA 256 (In the RP Advanced tab).

Enjoy!

ADFS : NameID / qualifier in claims

 

Firstly, there’s an excellent write-up here:

ADFS – SAML 2.0 Identity Provider and SaaS Service Providers

I was busy configuring a SAML provider in ADFS v2.0 when I got this error:

“The SAML Single Logout request does not correspond to the logged-in session participant.
Requestor: sp_test
Request name identifier: Format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient, NameQualifier: http://xxx/adfs/services/trust SPNameQualifier: sp_test, SPProvidedId: 
Logged-in session participants:
Count: 1, [Issuer: sp_test, NameID: (Format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient, NameQualifier:  SPNameQualifier: sp_test, SPProvidedId: )] 

This request failed.

User Action
Verify that the claim provider trust or the relying party trust configuration is up to date. If the name identifier in the request is different from the name identifier in the session only by NameQualifier or SPNameQualifier, check and correct the name identifier policy issuance rule using the AD FS 2.0 Management snap-in.”

I had a custom claims rule:

c:[Type == "http://mycompany/internal/sessionid"]
=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",  Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] = "sp_test");

So I had the sp_test part but not the http://xxx/adfs/services/trust part. The key was in the “User Action” message above. As my two messages only differed by NameQualifier, I needed to expand my rule to:

c:[Type == "http://mycompany/internal/sessionid"]
=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/namequalifier"] = http://xxx/adfs/services/trust, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] = "sp_test");

Enjoy!

ADFS : Beware the FedUtil shortcut

 

Running FedUtil is a PIA.

I find it much easier to save the web.config, deploy the application and then use WinMerge to copy over the relevant pieces from the saved web.config to the deployed one.

But beware.

There is also the metadata directory.

If ADFS is setup to update from metadata and you redeploy it, it drags over the new (and probably incorrect) metadata into the RP section. So if you were testing on your PC i.e. “localhost” suddenly all hell breaks loose because ADFS will throw an exception. I’ll bet your application is not on the ADFS box, right?

So save the metadata as well.

And always run a smoke test after a redeploy.

Enjoy!

Windows : File names that start with a period

 

If you play around with Java on your Windows box, sooner or later you are going to hit the problem where you need to create a file that starts with a period (aka. dot or full stop) e.g. “.keypass”.

Explorer won’t let you do this.

The solution is to create a file called keypass (no period) in Explorer and then use the command prompt to run a DOS command:

ren keypass .keypass

“ren” = “rename”

Good, old DOS to the rescue!

Enjoy!