Visual Studio : Could not write lines to file xxx Access to the path yyy is denied

Using Visual Studio 2012, checked a project into TFS and got the above error.

WTF?

Mr. Google to the rescue and the majority view was either:

• Make the file readable i.e. no readonly
• Delete the /bin and /obj directories and rebuild

The file was R/W already so went for option 2 and the error disappeared.

All good!

Enjoy!

AD : Locked accounts in Active Directory (AD)

This is truly a curved ball.

Once upon a time, there was an attribute in AD called:

  userAccountControl - ADS_UF_LOCKOUT = 16 (d) 10 (h)

However, in later versions of Windows Server (e.g. 2008), this was moved to:

  msDS-User-Account-Control-Computed - UF_LOCKOUT = 16 (d) 10 (h).

BUT there was a slight problem. As the name implies this is a computed attribute i.e. it doesn't actually exist. Rather it is computed on the fly. The implication is that it can't be used in a standard search query.

Hence the curved ball.

Some blogs suggest you can use:

filter = "(&(objectClass=user)(lockoutTime>=0))"  

This works in the sense that it refines a potentially huge list to a much smaller one.

However, it is not sufficient. When a user is locked out and then unlocked, this attribute can be set to zero (as opposed to the previous time that was stored). 

Easy enough, change the filter to:

filter = "(&(objectClass=user)(lockoutTime>0))"  

Dream on - that's not a valid filter query language construct.

So this first list has to be iterated through again to check that the user is actually locked.

Lots of code out there to do this e.g.

UserPrincipal oUserPrincipal = GetUser(sUserName); 

userPrincipal.IsAccountLockedOut();

or if you want to get fancy - refer c# LDAP check user is locked or not

string attribName = "msDS-User-Account-Control-Computed";

user.RefreshCache(new string[] { attribName });

const int UF_LOCKOUT = 0x0010;

int userFlags = (int)user.Properties[attribName].Value;

if ( (userFlags & UF_LOCKOUT) == UF_LOCKOUT)

{

    // if this is the case, the account is locked out

    return true;

}

return false;

To unlock - refer Everything in Active Directory via C#.Net 3.5 (Using System.DirectoryServices.AccountManagement).

UserPrincipal oUserPrincipal = GetUser(sUserName);
oUserPrincipal.UnlockAccount();
oUserPrincipal.Save();

To unlock via ADUC, click the Account tab on the user's Properties and then check the "Unlock Account" check box.

Note: You cannot lock an account either programmatically or through ADUC.

The system will lock the account based on the user's password policy e.g. user will be locked out after x invalid attempts. The policy may state that the user many never be locked out.

Enjoy!

Misc : The blog clocks up 100,000 page views

Whoop de do!

100354 pageviews and counting!

Enjoy!

ASP : WTF happened to my asp:Menu in .NET Framework 4.5?

Going through the upgrade exercise I mentioned in my previous post.

All good but my menu is now poked - all bunched up to the left. Still works but looks really munged!

Mr. Google to the rescue!

Menu.RenderingMode Property

The reason is that:

"The value of the RenderingMode property determines how the menu control renders markup for the Menu control.

In ASP.NET 3.5 and earlier versions, the Menu control uses HTML table elements and inline styles to specify the appearance of the menu in a browser. In ASP.NET 4 and later versions, by default the Menu control uses HTML listitem elements and cascading style sheet (CSS) styles."


Enjoy!

WIF : Migrate from WIF 3.5 to WIF 4.5 and VS 2010 to VS 2012

Been going through this exercise lately and thought I would document for others.

Some references:

http://msdn.microsoft.com/en-us/library/jj157091.aspx
http://msdn.microsoft.com/en-us/library/jj157089.aspx
http://msdn.microsoft.com/en-us/library/hh873305.aspx
http://msdn.microsoft.com/en-us/library/hh987037.aspx

Copy project to another directory, make all files R/W and then open with VS 2012. Check migration report.

Remove source control references if applicable.

Under Properties / Application / Target Framework, change to 4.5.

Remove Microsoft.IdentityModel from References

Add System.IdentityModel and System.IdentityModel.Services to references.

Change “using Microsoft.IdentityModel.Claims” to “using System.Security.Claims”

Change IClaimsPrincipal to ClaimsPrincipal

Change IClaimsIdentity to ClaimsIdentity

Change claim.ClaimType to claim.Type. Similarly for ClaimValue etc.

'FederatedPassiveSignInStatus' control has been removed. Remove all references. This includes the
<%@ Register assembly="Microsoft.IdentityModel"
namespace="Microsoft.IdentityModel.Web.Controls" tagprefix="wif" %>
in the aspx pages.

Add STS / FedUtil functionality has been removed. You need to download the “Identity and Access Tool” (available via NuGet).

Running the tool makes “different” changes to the web.config e.g. adds sections for system.identityModel.and a ida:FederationMetadataLocation section.

Comment out all the microsoft.identityModel sections in the web.config.

Update:

<modules runAllManagedModulesForAllRequests="true">
<!-- <add name="WSFederationAuthenticationModule" type="Microsoft.IdentityModel.Web.WSFederationAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler" />-->
<!-- <add name="SessionAuthenticationModule" type="Microsoft.IdentityModel.Web.SessionAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler" />-->
<add name="WSFederationAuthenticationModule" type="System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
</modules>

Enjoy!

SAML : SAML connectivity / toolkit

This is an update to try and categorise this in terms of SAML stacks.

Note that this concerns the SAML protocol not to be confused with SAML tokens or SAML products.

The links in the original article are still valid.

SAML is complicated. Getting the security right is difficult. My advice is not to roll your own.

Note: I personally haven't tried all of these. This is just a list that may be of use.

C#

The WIF Extension for SAML 2.0 is now deprecated and the links have been removed. It is only applicable for .NET 3.5 and is buggy.

There is NO official Microsoft C# client-side SAML protocol stack.

OneLogin's Open-Source SAML Toolkits and Github.

(Libraries for .NET, Python, Ruby, PHP, Java, node and others).

The Kentor stack is now deprecated.
Use Sustainsys - for .Net Core 2 use this version.

Owin.Security.Saml

Using Fedlets in .NET Applications

OIOSAML

SAML2

Safewhere SAML 2 for WIF

Owin.Security.Saml

Java

OpenSAML

Good book on this - Guide to OpenSAML V3.0 and an earlier version Guide to OpenSAML v2.0

Using Fedlets in Java Web Applications 

OneLogin's Open-Source SAML Toolkits

Spring security SAML

OIOSAML

auth10-java

MITREid Connect

PHP

simpleSAMLphp

LightSAML

OneLogin as above.

Ruby

OneLogin as above.

Python

OneLogin as above.

Commercial

Componentspace

Ultimate .NET SAML

Rock Solid Knowledge
This is for .NET Core 2 and is a plugin for Indentityserver 4. 

Identity aaS (as a service)

Auth0 - They do some really neat stuff. Lots of documentation e.g. SAML configuration. See the article at the end of this post

Other

nugetmusthaves for SAML

SAML articles in this blog

Disclaimer

I do not work for any of the above commercial companies.
------------------------------------------------------------------------------------------

There are two previous posts concerning SAML and libraries:

SAML : A SAML stack

WIF : Is there a Java Equivalent?

which are very much focused around the Microsoft / ADFS / WIF scenario.

But there’s tons of stuff out there concerning this so this is just a collection of links – for me as much as for everyone else!

OpenSAML - C++ / Java – open source

Performing a SAML Post with C#

Single Signon with SAML

SAML Single Sign-On (SSO) Component Suite for .NET – commercial

.NET SAML Component - Single Sign-On for C#, VB.NET & ASP.NET – commercial

onelogin SAML Toolkit – C#, ASP.NET, Java, PHP, Python, Ruby

Libraries and toolkits to develop SAML actors and SAML-enabled services

Working with SAML Assertions

Announcing the WIF Extension for SAML 2.0 Protocol Community Technology Preview!

Collection of Useful SAML Tools

authNauthZ  - A Swiss army knife for Graph API / SAML / OAuth

SAML2 for Thinktecture IdentityServer 3 with Kentor.AuthServices

Auth0 - This is essentially Identity aaS. They do some really neat stuff. Lots of documentation e.g. SAML configuration.

(I wrote up an example here using Auth0 -SAML : ASP.NET MVC application talking to SAML IDP.
The service is free until you go into Production and it's not locked down in any way - you have access to all the features).

Enjoy!

ADFS : “Problem” with “Token-Groups–Unqualified Names”

 

ADFS has this clever feature where if you select this mapping in the claims rules and map it to Roles, you will get a set of roles claims that contain all the groups for the authenticated user e.g.

http://schemas.microsoft.com/ws/2008/06/identity/claims/role  Role1

That’s well and good when the groups are “flat” i.e. the groups are not memberOf other groups.

If they are, then this mapping will work it’s way up the hierarchy and display ALL the groups.

So if Joe is a memberOf Role1 and if Role1 is a memberOf Role2, then ADFS will construct:

http://schemas.microsoft.com/ws/2008/06/identity/claims/role Role1

http://schemas.microsoft.com/ws/2008/06/identity/claims/role Role2

Now that’s fine if that’s what you want but if Joe has 20 roles and all these roles are at the bottom of a whole pile of other roles you end up with many, many claims and a complete mess!

So what to do if you only want the bottom layer i.e. the actual memberOf.

If you go have a look via ADUC, guess what? memberOf is not displayed as an attribute!

WTF!

To see it as an attribute in the attribute list, you need to click the “Filter” box (bottom right) in “Attribute Editor” and then select “Backlinks”.

OK – so what if we set up a claims rule mapping memberOf to Roles?

So we type memberOf into the LDAP attribute field (it is actually editable) and note that it displays as “Is-Member-Of-DL”.

Problem!

What we get back is the whole CN e.g.

CN=Role1,OU=Sales,OU=company,DC=com

when what we got before was just Role1.

Enter stage left Joji Oshima. He da man!

Refer: AD FS 2.0 Claims Rule Language Part 2.

and have a look at “Problem 1” which is exactly the scenario described above.

Problem solved!

Enjoy!

WIF : Is there a Java Equivalent?

Been asked this question a million times and now I have an answer of sorts.

If by WIF, you mean WS-Federation, then mosey on over to:

Apache CXF Fediz: An Open-Source Web Security Framework
 
This supports:

• WS-Federation 1.0/1.1/1.2
• SAML 1.1/2.0 Tokens
• Custom token support
• Publish WS-Federation Metadata document
• Role information encoded as AttributeStatement in SAML 1.1/2.0 tokens
• Claims information provided by FederationPrincipal interface

However, if by WIF by mean the FAM / SAM / CAM functionality then the jury is still out.

There is no direct Java replacement library for WIF.

Update:

Came across  auth10-java.

• This library speaks the WS-Federation protocol and SAML 1.1 and 2.0 tokens. It interops fine with Microsoft-related products like ADFS, Windows Azure Active Directory and Windows Identity Foundation. 

Update:

Also  OIOSAML.

Enjoy!

SAML : A SAML stack

I answer this question so many times, I’m writing it up as a blog entry.

You have an application – .NET, JAVA whatever.

You want this to be a SP and need to connect to an IDP – ADFS, OpenAM, simpleSAMLPHP …

Look at Announcing the WIF Extension for SAML 2.0 Protocol Community Technology Preview! (.NET).

Warning: This has not been updated in a while.

Warning: This is based on WIF 3.5. It is not compatible with WIF 4.5.

Also the OpenSSO Fedlet – this has components for both .NET and Java.

Or the OpenAM equivalents:

Using Fedlets in Java Web Applications and
Using Fedlets in .NET Applications

Or the Spring Security - SAML Extension (Java).

Or   OIOSAML. (.Net and Java).

Or auth10-java.

• This library speaks the WS-Federation protocol and SAML 1.1 and 2.0 tokens. It interops fine with Microsoft-related products like ADFS, Windows Azure Active Directory and Windows Identity Foundation.

Or Kentor.AuthServices

• A SAML2 Service Provider for ASP.NET. Built to mimic the WSFederationAuthenticationModule in .NET 4.5, but using SAML2 instead. The module works with the claims model of .NET 4.5 and uses the present infrastructure for claims translation, session authentication cookies etc.

Or SAML2

• NuGet package - A .NET implementation of the SAML 2.0 specification for SP integrations. 
• "Install-Package SAML2" from the Package Manager Console  

Or Safewhere SAML 2 for WIF

• SAML 2.0 for WIF is a new DLL component that extends the WIF with native support for the SAML 2.0 protocol. (.NET)

Or take your pick from this list:

SAML-based products and services

Enjoy!

ADFS : Setting up a proxy

If you are planning to set up a proxy in the future, do NOT install ADFS as a single instance, non farm development only instance.

If you do this, you will not be asked for the service account.

When you set up the proxy, it will ask you for this!

Rather install ADFS as a single instance farm – even if you have no intention of ever extending the farm.

WID or SQL – makes no difference.

In this scenario, you are asked for a service account. So you know what to type when the proxy install asks you.

Obviously, you need to set up the service account beforehand – a normal account with no special privileges is fine.

The point being that the install needs to create a SPN for the federation service name and it needs a service account to hold the value!

Enjoy!

ADFS : The remote certificate is invalid according to the validation procedure

So playing around with the proxy and using self-signed certificates and get the above error.

WTF?

So Mr. Google to the rescue and there’s much discussion about disabling the chain revocation checking on the certificate on the ADFS server. This can be done through the PowerShell commands.

But there doesn’t seem to be a command to do this for the proxy.

So pull hair out and then found an entry that suggested that the key was to import the certificate of the ADFS server to the proxy but import it to the Computer Account instead of the “my user” aka “personal” aka “local” account.

Job done!

Enjoy!

ADFS : using the WAUTH parameter

In ADFS, you can alter the default authentication chain by changing the order of the local authentication types.

<localAuthenticationTypes>      
    <add name="Integrated" page="auth/integrated/" />
    <add name="Forms" page="FormsSignIn.aspx" />    
      <add name="TlsClient" page="auth/sslclient/" />
      <add name="Basic" page="auth/basic/" />
</localAuthenticationTypes>

But what if your WIF application wants to do something different e.g. the ADFS 

above wants Integrated but you want Forms?

The trick is to alter the application’s web.config.

<federatedAuthentication>
  <wsFederation passiveRedirectEnabled="true" issuer="https://xxx/adfs/ls/" 

realm="https://xxx/app/" authenticationType="urn:oasis:names:tc:SAML:1.0:am:

password" requireHttps="true" />  <cookieHandler requireSsl="true" />
</federatedAuthentication>

The allowable types for authenticationType:

Windows integrated authentication:
urn:federation:authentication:windows

User name/password authentication i.e. Forms:
urn:oasis:names:tc:SAML:1.0:am:password

SSL client authentication:
urn:ietf:rfc:2246

As for the WIF claims:

Windows integrated authentication:

http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod =
http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/windows


User name/password authentication i.e. Forms:

http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod =
http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password


Also refer:
Windows Identity Foundation (WIF): How to Utilize the WS-Federation WAUTH Parameter to Specify an Authentication Type.

Enjoy!