Azure AD : Getting the UPN

I've been playing around with the custom SAML connection in Azure AD and the "claims transformations"  that you can do e.g. tolower.

My interest was Guest accounts.

The user screens don't show the UPN so I needed to do this with PowerShell.

connect-azuread -tenant tenantname

Get-AzureADUser -Filter "userType eq 'Guest'" -All $true | select Displa
yName,UserPrincipalName,Mail,Department,UserType,CreationType,RefreshTokensValid
FromDateTime,AccountEnabled

This displays:

DisplayName                    : Joe
UserPrincipalName              : joe@company.com#EXT#@tenantname
Mail                           : joe@company.com
Department                     :
UserType                       : Guest
CreationType                   : Invitation
RefreshTokensValidFromDateTime : 21/11/2018 11:13:58 p.m.
AccountEnabled                 : True

Or if you wanted the top 10:

Get-AzureADUser -Filter "userType eq 'Guest'" -Top 10 | select DisplayNa
me,UserPrincipalName,Mail,Department,UserType,CreationType,RefreshTokensValidFro
mDateTime,AccountEnabled

Or complex filter:

Get-AzureADUser -Filter "mail eq 'joe@company.com' and userType eq '
Guest'"

If you want to see the full list of Azure AD attributes with the complete schema, use:

Get-AzureADUser  -All $true | fl > allad.txt

Enjoy!

Azure B2C : Calling a web API from Azure AD B2C using data types

There is a good overview here.

In terms of the data types that you can pass, these can be:

• boolean
• date
• dateTime
• int
• long
• string
• stringCollection
• alternativeSecurityIdCollection

The above is the XML to define some of the claim types.

In terms of the JWT returned, the claims look like:

 Enjoy!

Misc - a busy day at the office!

Busy on the forums!

Enjoy!

stackoverflow : Top 1%

Finally got there:

There are over 9 million users on stackoverflow and currently I'm sitting at:

Now it gets into the decimals e.g. top 0.5 %

Enjoy!

Misc : My audience

Just out of interest, my audience as reported by Blogger.

Strange that Google has "Unknown Region"?

Chrome is way ahead on the browsers and Windows is way ahead on the OS.

Would have thought the iPad figure would be higher but maybe iPad users have no interest in Identity :-)

Enjoy!

C# : Invalid URI

The full message is:

"Invalid URI : The hostname could not be parsed".

I get this using the URIBuilder class.

Since it was complaining about the hostname I checked the DNS, I checked that I could ping it, I tried the IP address etc. etc.

Eventually worked out that it was because the password contained special characters.

You are apparently supposed to URL encode them.

Just changed the password to use letters and numbers and all was well.

Somewhat misleading error message :-)

Enjoy!

stackoverflow : Answered 1,000 questions

Achievement unlocked!

Most of these are in the Identity space and of course the problem is that in order to answer a question, someone has to ask it first.

It is somewhat of a niche category. I've been on stackoverflow for 9 years and 10 months (at time of writing) so it's taken a while to get here.

Looking at the tags e.g. ADFS:

What's also interesting about this is the other contributors.

Just calling out some of them:

Eugenio Pace and Matias Woloski are the founders of Auth0 and vibronet has recently joined them.

leastprivilege is one of the people behind identityserver.

Across the other tags:

I guess now I need to identify my next achievement!

And onto the next 1,000!

Enjoy!

Certificates : Displaying errors

Quite often, you can't connect to an SSL site because .NET will tell you that the certificate is invalid.

This openssl command shows you the certificate errors:

openssl s_client -connect company.co.nz:443|openssl x509 -text

The output looks like:

depth=2 CN = Company Root CA
verify error:num=19:self signed certificate in certificate chain
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:06:eb:c1:00:34:00:05:56:38
...

etc.

It also checks the intermediate and root CA certificate validation chain.

Enjoy!

Certificates : The remote certificate is invalid according to the validation procedure

I see this error so many times. It is generally on the client side as part of the .NET framework.

The root cause of this is:

• Your server certificate is self-signed
• You are using an incorrect host name to connect
• Your certificate is not trusted

The host name must match the subject name on the certificate e.g. company.com and orders.company.com both point to the same URL but the certificate has been issued to company.com. So that is the name you need to use to get to the web site. Or else you can add the other names to the SAN.

If the certificate is not trusted, you can add it to the "Trusted Root Certification Authorities". But be mindful of security.

I find it useful to log why .NET doesn't like it.

Just in case that article disappears, I've saved the config here.

Key info:

The Network Service account must be able to write to this log so give the account access to the directory. 

Change the log location.

e.g. initializeData="c:\Logs\Trace.log"

Now assume that company.com is not in the DNS and you have an IP address e.g. 124.40.60.80.

Now the URL is 124.40.60.80 but the certificate subject name is company.com. Bingo. You get the error.

The solution is to create a host file entry.

124.40.60.80 company.com

Now you can browse to company.com and the name will match.

Enjoy!

Visual Studio : You need to find somefile.cs to view the source

Debugging through some socket code and suddenly the debugger came up with the above when I tried to step into the .NET code.

It was asking for NetworkStream.cs , Socket.cs etc.

Trying to browse to the file wasn't helping.

So Mr. Google to the rescue.

The solution is:

Visual Studio / Tools / Options / Debugging / General / Enable source server support

Problem solved.

Enjoy!

C# : The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly

Busy doing some work with a SQL component.

To check all was well, I set VS to break-point on all CLR exceptions and suddenly it came up with the above error.

WTF?

Lots of discussions with Mr. Google and the usual ton of garbage but then I found this.

Run "cmd" as admin.

cd C:\Windows\Inf\.NET Data Provider for SqlServer

lodctr _dataperfcounters_shared12_neutral.ini

That did the trick.

BTW, lodctr "allows you to register or save performance counter name and registry settings in a file and designate trusted services".

Enjoy!

log4net: Why are all logs written to when I invoke just one?

I was trying to get log4net working and I wanted 3 logs:

• Console
• Text file
• Event log

So the config. looked like:

root
      !--level value="ALL" /
      appender-ref ref="ConsoleLog" /
      appender-ref ref="Log" /
      appender-ref ref="EventLog" /--
 /root

and then e.g.:

appender name="ConsoleLog" type="log4net.Appender.ColoredConsoleAppender"
      mapping
        level value="ERROR" /
        foreColor value="White" /
        backColor value="Red, HighIntensity" /
      /mapping
      layout type="log4net.Layout.PatternLayout"
        conversionPattern value="%date [%thread] %level %logger - %message%newline"/
      /layout
/appender 

and called via e.g. :

private static readonly ILog LogConsole = log4net.LogManager.GetLogger("ConsoleLog"); 

But when I tried e.g.

LogConsole.Info

all three logs were invoked and all three entries were written!

Turns out you need to remove the root level and use e.g.:

logger name="ConsoleLog"
      level value="ALL" /
      appender-ref ref="ConsoleLog" /
/logger

where the  "appender-ref" points to the correct log.

Then all works as expected.

Note: angle brackets removed for display purposes!

Enjoy!