ADFS : VS 2013 and FedUtil

In VS 2013, there was a wizard called FedUtil which handled the "binding" between your WIF project and ADFS, sorted out the web.config configuration etc.

In VS 2012, this wizard was called the "Identity and Access Tool"

In VS 2013, there was - oh that's right - nothing!

But, fear not, there is a way.

Using VS 2013 Update 2:

• Create an ASP.NET Web Application
• Click "Change Authentication"
• Select the "Organisational Accounts" radio button
• In the "Cloud - Single Organisation" drop down - select "On-Premises"
• Under "On-Premises Authority", enter the ADFS Metadata URL
• Under "App ID URI", type the identifier or leave blank for default
• Click "OK"
• Back on the "New ASP.NET Project" screen, Authentication should say "Organisational Auth (On-Premises)"
• Click OK
• Done

When the project is created, you'll see the web.config has been updated.

Enjoy!

Stackoverflow : 15,000 rep

Well, taken a while but just crossed that boundary!

So I can now:

"protect questions

Privilege type: Moderation privilege

Awarded at: 15,000 reputation"

Only one more privilege to get:

"trusted user

Privilege type: Milestone privilege

Awarded at: 20,000 reputation"

So just a small matter of another 5,000!

Why do I do it? - basically:

• I like helping people
• I try and evangelise Identity - and this is a good way to do it
• I learn something every time I research an answer

Most of the time, I pretty much know the answer but it's that quest for the "perfect" answer that leads to research which leads to me better understanding something.

Also, half the time when I try and explain something I realise I don't understand it as well as I thought I did or as well as I should!

See An Ode to Server Fault for a similar viewpoint.

Enjoy!

ADFS : Customising the screen for ADFS 2012 R2 or ADFS 3.0 or ADFS 2.2

Update:

More comprehensive write-up here.

Apologies for the title but there doesn't seem to be a standard for what the R2 version of ADFS is called so I included them all to ease the Google / Bing / Duck Duck Go search

If there's one question that has become flavour of the month lately this is it. There are many questions around customising the logon / login / sign on pages.

Some of them refer to customising the pages for Multi-Factor Authentication (MFA). Just remember that you can now do this with a Microsoft solution. Refer: Azure Multi-Factor Authentication. Note that this doesn't have to be cloud based. There is an on-premise variation.

In ADFS 2.0, the functionality was implemented as a web site running on IIS so you could customise to your heart's content changing the .aspx and the .cs pages.

My guess is that some people who didn't really understand the implications of what they were doing customised the pages in sub-standard ways and things went wrong and Microsoft copped the blame for pushing a crap product.

Remember - security in a web application is hard - writing a security application is even harder,

So in ADFS 3.0 this was all locked down. The biggest change was that it no longer uses IIS.

Refer: First Impressions – AD FS and Windows Server 2012 R2 – Part I

There are some PowerShell commands  you can use to customise the screens

Refer: Customizing the AD FS Sign-in Pages

and Advanced Customization of AD FS Sign-in Pages.

There are some good suggestions here:

adfs 2012 R2 forms authentication default login domain

Beware: one of the suggestions here is to modify the .dll. I would strongly suggest that you don't go down this particular rabbit hole!

And a good write up here:

Handling Expired Passwords in AD FS 2012 R2

Enjoy!

Visual Studio : Extending the user profile for organisational accounts in Azure

When you use VS 2013 and choose the web application option and then change the authentication options to use organisational accounts, you get a lot of template code which shows you some of the attributes in the user profile derived from Azure Active Directory (AAD).

You can see this if you click on the name of the logged-in user once the application is running and you have authenticated.

What if you want to extend this?

The first step is to find out what the attribute is called?

The easiest way to do this is to use the Graph Explorer.

Click "Use Demo Company" then "Get" then click on:

"https://graph.windows.net/GraphDir1.OnMicrosoft.com/users".

You'll get a list of the AAD schema attributes e.g if you want the user department, you'll see the name is "department".

In the VS project under "Models / HomeViewModels.cs" add another line e.g.

public string Department { get; set; }

Under "Views / Home / UserProfile.cshtml" add another line e.g.

<td>Department</td>
<td>@Model.department</td>

This uses Razor syntax - you may have something different but you get the general idea.

The key to this is under "Controllers / HomeController.cs" where:

UserProfile profile = JsonConvert.DeserializeObject(responseString);

 leverages the power of the JSON library to serialize the attributes you have defined.

Job done.

Enjoy!

Security : Secret Q & A

Came across an interesting idea for the answers to those ubiquitous secret Q & A they use for authentication.

If you see someone lives in NZ and the question is:

Where where you born?

a hacker could answer "Auckland" / Wellington" / "Christchurch" / "Dunedin" and that would cover about 80% of the possibilities since e.g. over 25% of the people in NZ live in Auckland.

So the suggestion is to use a random phrase to answer everything.

e.g.

"Where were you born"?  = Puddleduck
"Mother's maiden name"? = Puddleduck

and so on.

Enjoy!

Azure : Deploying a Java web site to Azure

Well, who would ever think that the words "Azure" and "Java" would be used in the same sentence?

I'm not talking about the Azure VM here; rather the Azure web site option.

As Mrs. Beaton would say "First catch your rabbit". For Java, this becomes "First catch your .war file".

You can create a simple Java web site in either Eclipse or NetBeans - whatever floats your boat.

Work through the following documentation:

Get started with Azure web sites and Java

Adding an application to your Java web site on Azure

I used the "Create a Java web site using the Azure configuration UI" option.

OK, but when you display the web site URL, you get the "This Java based application has been successfully created". So where's my index.jsp?

From the dashboard of the Azure web site, you'll see the FTP address. I use FileZilla.

Before you can use this, you have to set the credentials. There's a link under "Quick Glance" called "Reset your deployment credentials". So set them.

Assume your web site is called MyJavaWebSite.

So to get FileZilla to work, you use the FTP URL from the dashboard page, your user name is:

MyJavaWebSite\username

and the password is whatever you chose.

On the LHS menu, navigate to your war file. On the RHS, navigate to:

/site/wwwroot/webapps

Copy the war file over.

Now navigate to the actual Azure web site URL. Still shows the canned screen.

So append  /MyJavaWebSite/index.jsp to the URL.

Bingo.

Enjoy!

Stackoverflow : Neat set of badges

Seems somewhat symmetric ...

100 bronze badges - achievement unlocked :-)

Enjoy!

Azure : Web site FTP credentials

In an Azure web site, in the portal under the dashboard on the RHS, you'll see a whole link of links e.g. the link to the site, ftp links, log links etc.

To access these, you need credentials which you can set further up that page on the RHS i.e. "Reset your deployment credentials".

So you pick a name like "myftpusername" and a password.

Then you use something like FileZilla to FTP to the site using the FTP link, you type in the credentials and get "Access Denied"! WTF?

The reason is that you have to add the actual site to the user name. So if the site name is "AnAzureWebSite", then the user name needs to be:

AnAzureWebSite\myftpusername

Enjoy!

Misc : Zooming the ZoomIt window

ZoomIt is a fantastic tool for presentations. You'll find it at:

ZoomIt

But I've always battled to get it to display exactly where I want and tracking around the zoomed screen is a nightmare.

Then I figured out that before you hit "Ctrl / 1" to zoom, put the cursor at the middle of the section you want to zoom.

Then zoom.

You can make minor adjustments by moving the mouse, use the trackwheel to zoom in / out, click the left mouse button to "stabilise" and then you are in the "Ctrl / 2" window by default so "Ctrl / Shift" will draw an arrow etc.

And it would be remiss of me not to point out that you can do this in Windows via the built-in commands. In a browser, type "Windows key" and then "+" to zoom out and then  "Windows key" and then "-" to zoom back in. This is in fact the Magnifier tool.

Enjoy!

ADFS : Getting certificate data from metadata

A number of times I've needed to get information about the certificate e.g. to update the WIF thumbprint in the web.config and I've battled to extract this out of the metadata.

For ADFS, you'll find it at:

https://someserver/FederationMetadata/2007-06/FederationMetadata.xml

For Azure Active Directory, you'll find it at:

• Click on "Active Directory" in the menu on the LHS of the Azure Portal.
• Click on your tenant name.
• Click on the "Applications" tab at the top.
• Click on "View Endpoints" at the bottom.
• Then navigate to the "Federation Metadata Document" link.

Then I found an easy way to do this based on a post I read.

Open the metadata file in Notepad++ or whatever your particular flavour is and then search for the "X509Certificate" tag.

Copy all the information between that and the closing tag. It's base64 encoded so it will normally end with an "=" sign.

Copy / paste this into a new Notepad++ window. Remove all trailing spaces.

Save the file somewhere with a ".cer" suffix.

Then double-click on the file.

Viola - it opens up the certificate window and you can grab whatever you want.

The thumbprint is found under the "Details" tab - scroll down to the bottom.

Enjoy!

Visual Studio : Unable to locate NuGet.exe

Actual message is:

Error - Unable to locate 'C:\.....\.nuget\NuGet.exe'   

You sometimes get this when building a project that you cloned from GitHub.

Under .nuget/nuget.Targets in your project, change:

<DownloadNuGetExe Condition=" '$(DownloadNuGetExe)' == '' ">false ...

to 

<DownloadNuGetExe Condition=" '$(DownloadNuGetExe)' == '' ">true ...

Enjoy!

Windows : Ctrl - Alt - Del on a VM

If you use Remote Desktop a lot and you get a message about your password needing to change, you can't use:

Ctrl - Alt - Del

because that will change the password on your actual PC - not the box you are RDC'ing to.

All the documentation states:

Ctrl - Alt - End

but sometimes that simply doesn't work.

In such cases, in the RDC window, try Start - Run - OSK.

This pops up the On Screen Keyboard.

Than hold down Ctrl and Alt on your actual keyboard and then click Delete on the OSK.

Job done!

Enjoy!