Category Archives: Azure

Windows Azure Active Directory GA + Backup Service

Scott Guthrie has been announcing yesterday some really cool things about Windows Azure :

  • Windows Azure Active Directory (WAAD) is now GA, which means it comes with all platform availablility constraints that other Windows Azure Services comply to; GREAT!
  • Windows Azure Backup: enables you to backup your servers into the Cloud, and also restore them.
  • IaaS default disk size increase: in some cases, having a lot of installed binaries on the VM default disk was getting things complicated, not anymore !

These updates are effective since Scott’s annoucement, so go ahead and use them now :)

{“Message”:”An error has occurred.”} when deploying your Windows Azure Website

I was working these days on deploying a few sites built on MVC4 Web API, using Entity Framework along with Spatial types (Geometry and Geopraphy types).

Everything was fine on my dev box, unless I started to deploy the solution on Azure.

Most of my WebAPIs calls were giving me a {“Message”:”An error has occurred.”}

That comes from a miss in the binaries coming along with your site once deploying it; just open your Nuget Package Manager interface, search for the “Microsoft.SqlServer.Types” package and add it to your site project.

Tada :)

Join us for the Swiss Techdays 2013 in Lausanne!

Hi dear visitor,

This year Microsoft Techdays will be held at Conrès Beaulieu in Lausanne, on the 6th and 7th of November.

Yves Peneveyre and myself will be presenting a topic around SharePoint 2013 (in French :) )

As I will be available between sessions on the CTP booth, please feel free to come and visit us, and ask questions about our work and Windows Azure for example :)

See you there!

Access Control Service : create and use your own STS in Azure – Part 5

In this article series, I am going to address how to create you own custom Security Token Service (STS) to authenticate your users using claims, and using it through ACS to offer more  Identity Providers to your Azure app.

This article series is composed of:

  1. Build you STS as a Web App (and not a Website)
  2. Create and configure your certificates in your STS
  3. Understand the FederationMetadata.xml file
  4. Use your STS in the cloud through ACS
  5. Put your web app + your STS in Windows Azure ← You are here!

Continue reading

Access Control Service : create and use your own STS in Azure – Part 4

In this article series, I am going to address how to create you own custom Security Token Service (STS) to authenticate your users using claims, and using it through ACS to offer more Identity Providers to your Azure app.

This article series is composed of:

  1. Build you STS as a Web App (and not a Website)
  2. Create and configure your certificates in your STS
  3. Understand the FederationMetadata.xml file
  4. Use your STS in the cloud through ACS ← You are here!
  5. Put your web app + your STS in Windows Azure

4. Use your STS in the cloud through ACS

Now that the FederationMetadata.xml file is set, we need to  link our STS with ACS, so that ACS can transfert users to the new STS and also decrypt tokens coming from it.

The idea here is to set your STS Identity Provider behind ACS, so that your web apps have only to trust ACS as an IdP, which will then take care of transforming your STS IdP tokens (along with OOB IdPs such as Live ID or Google account) and send it to your app.

Continue reading

Access Control Service : create and use your own STS in Azure – Part 3

In this article series, I am going to address how to create you own custom Security Token Service (STS) to authenticate your users using claims, and using it through ACS to offer more  Identity Providers to your Azure app.

This article series is composed of:

  1. Build you STS as a Web App (and not a Website)
  2. Create and configure your certificates in your STS
  3. Understand the FederationMetadata.xml file ← You are here!
  4. Use your STS in the cloud through ACS
  5. Put your web app + your STS in Windows Azure

3. Understand the FederationMetadata.xml file

Now that the STS is built and the cretificates have been added to it, let’s now build the FederationMetadata.xml file.

But, what exactly is this FederationMetadata.xml file for?

This file serves multiple purposes:

  • gives the Endpoints of your STS for a Website or ACS using your STS as an identity provider (<fed:SecurityTokenServiceEndpoint> element),
  • gives the public key used to verify the issuer of received auth messages (providing a hash of the returned auth token validated by this public key) as the <KeyDescriptor use=“signing”> element,
  • gives the list of all returned claims from the STS, (namespaces and descriptions) in the  <fed:ClaimTypesOffered> element,
  • gives info on the provider of the service (company details, contact person).

Of course, what we see previously (especially the encryption part) is not part of the FederationMetadata.xml.

In our consideration of using ACS to offer our STS plus existing ones within ACS, the decrypting part configuration will be done in ACS directly when routing tokens.

So the real question is now: how do I build my FederationMetadata.xml to make it readable and usable by our ACS??

2 options:

  • Generating automatically the  FederationMetadata.xml upon a set of configuration items,
  • Generating it once and add it into your STS Azure package.

For the first solution have a look here.

For the second one please make sure to download Custom STS Metadata File Editor, which I copied on my blog as it was really hard to get :)

Going through this configuration tool, make sure not to modify the file manually once you created it, especially if you leave the Sign with Certificate default check when you selected your Certificate on the “Certificate” tab:

Looking at all variables that need to be put in place within the STS, please get inspiration from my FederationMetdata.xml file here, that contains all settings to get your STS ready:

Have a look at a part on this file here for the URLs that link back to your Azure STS deployment:

     <fed:SecurityTokenServiceEndpoint>
      <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
        <Address>https://mystsdemo.cloudapp.net/PassiveSTS.aspx</Address>
        <Metadata>
          <Metadata xmlns="http://schemas.xmlsoap.org/ws/2004/09/mex" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex">
            <wsx:MetadataSection Dialect="http://schemas.xmlsoap.org/ws/2004/09/mex" xmlns="">
              <wsx:MetadataReference>
                <Address xmlns="http://www.w3.org/2005/08/addressing">https://mystsdemo.cloudapp.net/PassiveSTS.aspx/mex</Address>
              </wsx:MetadataReference>
            </wsx:MetadataSection>
          </Metadata>
        </Metadata>
      </EndpointReference>
    </fed:SecurityTokenServiceEndpoint>
    <fed:PassiveRequestorEndpoint>
      <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
        <Address>https://mystsdemo.cloudapp.net/PassiveSTS.aspx</Address>
      </EndpointReference>
    </fed:PassiveRequestorEndpoint>

I am here especially pointing to the section that contains the URLs for your STS, that will help ACS to know where to forward the authentication request and get back the result (signing and encryption part).

There we go, next, configuring ACS our STS!

Access Control Service : create and use your own STS in Azure – Part 2

In this article series, I am going to address how to create you own custom Security Token Service (STS) to authenticate your users using claims, and using it through ACS to offer more  Identity Providers to your Azure app.

This article series is composed of:

  1. Build you STS as a Web App (and not a Website)
  2. Create and configure your certificates in your STS  ← You are here!
  3. Understand the FederationMetadata.xml file
  4. Use your STS in the cloud through ACS
  5. Put your web app + your STS in Windows Azure

2. Create and configure your certificates in your STS

Let’s see how we can create and use our certificates in our own Windows Azure STS; this includes:

  • generating test certificates for your STS to talkf with users in HTTPS,
  • generating encryption certificate la génération d’un certificat pour encrypter vos tokens envoyés depuis votre STS vers ACS.

Continue reading

Access Control Service : create and use your own STS in Azure – Part 1

In this article series, I am going to address how to create you own custom Security Token Service (STS) to authenticate your users using claims, and using it through ACS to offer more  Identity Providers to your Azure app.

This article series is composed of:

  1. Build you STS as a Web App (and not a Website) ← Your are here!
  2. Create and configure your certificates in your STS
  3. Understand the FederationMetadata.xml file
  4. Use your STS in the cloud through ACS
  5. Put your web app + your STS in Windows Azure

1. Build your own STS as a Web App (and not a Website)

Today, WIF templates are offering your to build your Security Token Service as a Website.

What we would like to do is to use this “Website” as part of our Azure project, but the issue is Azure SDK only support importing “Wep Application” type of projects…

No problem, let’s just create a Web Application from scratch you will see how simple it is to create a STS from that. Continue reading

Build you Azure solution using ACS without ADFS

You want to build up a solution based on ACS, but without having to run everything on a Server OS to use ADFS?

You don’t want to use your company’s ADFS, in order to test multiple Claims scenarios?

Your want to change those claims as easily as a click to test fast changes on your app?

All of this is totally possible :)

Follow me on all steps from this article and you’ll be able to do that.

Continue reading

How to deal with different environments in Windows Azure

Hi everyone,

For those of you who are working with Windows Azure and looking for flexibility in their different environments, here are a couple of points I have been using during my projects to help being flexible and fast.

Web.config transformations:

Since Visual Studio 2010, one can use XML transformations on web.config, to help getting different file versions when you build your app in Debug or in Release.

Here is a small example on how to do it for the SessionState:

In file Web.Debug.config:

<sessionState xdt:Transform="Replace" mode="InProc" />

In file Web.Release.config:

<sessionState xdt:Transform="Replace"
mode="SQLServer" allowCustomSqlDatabase="true"
sqlConnectionString="Server=tcp:mysqlserver.database.windows.net;Database=MyDB;User ID=admin;Password=password;Trusted_Connection=False;Encrypt=True; MultipleActiveResultSets=True;" />

You can then do the same for the DB connection you use to you SQL Azure back end when using Entity Framework.

The problem here is that transformations only apply to “built” config files (stored in bin or debug folders), so this doesn’t apply when debbuging locally your Web project!!

To do this, leave DEV related entries in the Web.config directly, so that transformations will only apply when building the Azure packages in Release using the Web.Release.config:

In file Web.config:

<add name="RMOPEntities" connectionString="metadata=res://*/Data.RMOP.csdl|res://*/Data.RMOP.ssdl|res://*/Data.RMOP.msl;provider=System.Data.SqlClient;provider connection string=&quot;data source=ariel.ctp-int.com\galatea;initial catalog=RMOP;integrated security=True;multipleactiveresultsets=True;App=EntityFramework&quot;" providerName="System.Data.EntityClient" />

In file Web.Release.config (to transform it when building package):

<add name="RMOPEntities"
connectionString="metadata=res://*/Data.RMOP.csdl|res://*/Data.RMOP.ssdl|res://*/Data.RMOP.msl;provider=System.Data.SqlClient;provider connection string=&quot;data source=wyopqjbi6s.database.windows.net;initial catalog=RMOP;;User ID=ctpadmin;Password=pass@word1;multipleactiveresultsets=True;App=EntityFramework&quot;"
providerName="System.Data.EntityClient" />

Conditional Symbols:

You certainly know already DEBUG and RELEASE constants (used with “#if DEBUG” in code).

You can also build you own, to address specific purposes; you can eevn build your own build configurations to include these conditional symbols or not.

Here is a sample of a Project properties set to use conditional symbols:

In that case I created a “NOAUTH” symbol to bypass user having to log in the application for debug purposes.

Verifying if you are  REALLY in Azure:

In certain cases (e.g. layout modifications) , you are not forced to run your whole project using the DevFabric.

To avoid this you can just run the WebApp project, but of course you won’t be able to leverage anything from Azure APIs like Storage.

You can then do it using Dummy Data to return through your layers to test more rapidly your application and keep on having it to work without Azure.

A small sample here:

if (RoleEnvironment.IsAvailable)
{
    return AzureBlobMaganer.GetDataItems();
}
else
{
    return new List<DataItem>() {new DataItem() {Label = "Test", Value = 12}};
}

Config Items in Roles:

The last point here is to play a bit with Azure connections; which on will we connect to: DevFavric or Azure ?

Here is a sample of an Azure project configuration:

The simple solution here is:

#if DEBUG
var account = CloudStorageAccount.FromConfigurationSetting("StorageDev");
#else
var account = CloudStorageAccount.FromConfigurationSetting("Storage");
#endif

A clever way would be to encapsulate this in a method to return the right storage account, or even a static property set to different variables depending on constant definition:

#if DEBUG
public const string CloudAccountName = "StorageDev";
#else
public const string CloudAccountName = "Storage";
#endif

Thanks for reading, and don’t hesitate to give me feedback!