I have a Web Deployment publish profile in my visual studio project.
I have multiple environments, which in one I use NTLM provider and on the other I user Negotiate:Kerberos provider on the windows authentication mode.
My question is: How can I set the parameters.xml "match" value in order to set the right provider when using msdeploy.
The provider tag is as follows:
<add value="NTLM" />
Or instead:
<add value="Negotiate:Kerberos" />
Is it even possible to pull this of via parameters.xml only?
If not what is the right way of doing so?
Found a workaround.
At the parameters.xml I created a <parameter> element with the following:
<parameterEntry kind="XmlFile" scope="\\web\.config$" match="/configuration/system.webServer/security/authentication/windowsAuthentication/providers/add/#value" />
This parameterEntry will match the providers.
Afterwards, at the deploy time, the value that will be replacing the matched value in the parameterEntry will be: Negotiate:Kerberos.
In this way, I managed to replace the values. Currently it's kind of problematic to place multiple providers, but I think it can be accomplished with matchers and the parameters.xml by changing it a little bit.
Related
Presumably there are lots of companies who are facing the same struggle we are.
For any microservice, before running a dotnet restore we need to first ensure we've successfully configured our ADO package feeds with an active token.
To achieve this we have a script which downloads and runs the CredentialProvider.VSS.exe (as suggested by Microsoft), using the output to build credentials which then register the feeds on the user's computer. This needs to happen daily as the tokens generated will expire.
The script above is ugly and worse yet, every repository needs it in order to ensure feeds are configured with active tokens. Even if we moved the ugly script to a PowerShell module for example, how would we authenticate against the PS feed in order to download that module?
I don't see why the CredentialProvider is neccessary, why can't nuget just prompt us for credentials whenever our token expires? Has anyone come up with a cleaner solution out there which manages authentication to ADO feeds across multiple repositories?
How to cleanly automate authentication for Azure Devops feeds?
To authentication for Azure Devops feeds, you could try to use the NuGet authenticate task, which configure NuGet tools to authenticate with Azure Artifacts and other NuGet repositories.
Then we could create a new NuGet service connection with PAT:
You can use a longer-term PAT for certification, so you don't have to change certification every day.
another approach using nuget.confg as below
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<add key="AzureDevOpsFeed" value="https://pkgs.dev.azure.com/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/index.json" />
<add key="nuget" value="https://xxxxxxxxxxxxxxxxxxxxx/index.json" />
</packageSources>
<packageSourceCredentials>
<VSTSFeed>
<add key="UserName" value="#{PAT_UserName}#" />
<add key="ClearTextPassword" value="#{PersonalAccessToken}#" />
</VSTSFeed>
</packageSourceCredentials>
</configuration>
I have website that is Hosted in a Azure App Service. are there any options in azure so that I can put a password on the website. Ideally without changing the websites code.
Just a basic password or user name and password, doesn't need to be google or facebook login or AD login.
It is a .net based website and I have seen a few options to do this, but it means I have to change the code of the website in someway or another.
Surely with all that sophisticated cloud technology, I can go in to the portal and set a password at a server level? - Or is the only way to make some kind of change to the application?
It is possible to enable Basic Authentication for Azure Web Apps with some settings in the applicationHost.xdt. You can load some modules in this file on the start of your Web App.
Steps:
Navigate to your WebApp in the Azure Portal
In the left menu, search for the header Development Tools an select Advanced Tools (Kudu)
Use the Debug Console > CMD tool, to navigate to the WebApp directory: \home\site
Create a file named: applicationHost.xdt
Paste the following:
<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
<location path="%XDT_SITENAME%" xdt:Locator="Match(path)">
<system.webServer>
<rewrite xdt:Transform="InsertIfMissing">
<allowedServerVariables xdt:Transform="InsertIfMissing">
<add name="RESPONSE_WWW_AUTHENTICATE" xdt:Locator="Match(name)" xdt:Transform="InsertIfMissing" />
</allowedServerVariables>
<rules xdt:Transform="InsertIfMissing">
<rule name="BasicAuthentication" stopProcessing="true" xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)">
<match url=".*" />
<conditions>
<add input="{HTTP_AUTHORIZATION}" pattern="^Basic dXNlcjpwYXNzd29yZA==" ignoreCase="false" negate="true" />
</conditions>
<action type="CustomResponse" statusCode="401" statusReason="Unauthorized" statusDescription="Unauthorized" />
<serverVariables>
<set name="RESPONSE_WWW_AUTHENTICATE" value="Basic realm=Project" />
</serverVariables>
</rule>
</rules>
</rewrite>
</system.webServer>
</location>
</configuration>
Change the Basic Auth to your liking (default in example is: user:password)
Make sure the web.config rewrite rules don't contain <clear /> as this wil remove the effects from the applicationHost.xdt file
Save the file and Stop and Start your WebApp (a simple Restart will not suffice)
Notes:
Not sure if this works on Linux based WebApps..
You can add this step to you're deployment pipelines by using FTP
Update: I've noticed issues with applicationHost.xdt while using it on secondary Web App slots. Only the primary slot seems to work.
PS: Cross-post from my answer here.
You can use Authentication and authorization in Azure App Service.
Authentication/Authorization was previously known as Easy Auth.
Azure App Service provides built-in authentication and authorization support, so you can sign in users and access data by writing minimal or no code in your web app, RESTful API, and mobile back end, and also Azure Functions. This article describes how App Service helps simplify authentication and authorization for your app.
Source: Authentication and authorization in Azure App Service and Azure Functions.
EDIT:
The above is a solution to have a password protected App Service without changing any code whatsoever. At this point there is no alternative, as you can see in the open feedback issue Allow HTTP Basic authentication on basic apps
Hi everyone, we understand the demand for this feature, but we do not plan to support authentication at this level. We suggest using EasyAuth for this scenario.
https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization
EDIT 2:
This method forces the user to use google or facebook, etc...
This is not true. You can also create a user in your Azure Active Directory and use that one with Easy Auth. The username would be something like username#<YOUR-TENANT>.onmicrosoft.com
Not sure if this is the right place to ask but... We have an older application that is set up to use SSO, currently Azure ADFS. I want to use login.microsoft.com url instead of our organizational url that has been used in the past.
I replaced the currently working links in web.config with the endpoints from Azure
<appSettings>
<add key="FederationMetadataLocation" value="https://login.microsoftonline.com/dfmi.onmicrosoft.com/FederationMetadata/2007-06/FederationMetadata.xml" />
</appSettings>
and
<federatedAuthentication>
<wsFederation passiveRedirectEnabled="true" issuer="https://login.microsoftonline.com/0845a734g7-6d23-7c96-9f4x-3427v39n4sd5/wsfed/" realm="https://customdfmi.dfmi.net/" requireHttps="true" />
<cookieHandler requireSsl="false" />
</federatedAuthentication>
I get to the sign-in page. When I put in the credentials it shows "AADSTS700016: Application with identifier 'https://customdfmi.dfmi.net/' was not found in the directory".
It is set up in Azure. Redirect URI is the exact copy of what's in web.config. What am I putting wrong in web.config? Do I need to put the Application ID somewhere in it? Any pointers would be great. Thanks!
Did you received this message?
AADSTS700016
UnauthorizedClient_DoesNotMatchRequest - The application wasn't found in the directory/tenant.
This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have misconfigured the identifier value for the application or sent your authentication request to the wrong tenant.
Can Orchard work with AD and Windows authentication?
I need to allow only specific AD groups access to a blog. The rest of the site should be accessible to any valid domain user. The admin dashboard should only be accessible by another specific AD group.
[ update ]
At the suggestion of ViRuSTriNiTy, I tried the following:
- install the windowsauth module
http://gallery.orchardproject.net/Packages/Orchard.Module.AlexZh.WindowsAuthentication
- in the admin settings, I added a user for myself as "my-domain\my-user-name", where the domain name and user are mine.
- added a role to match a AD role that I am a member of and gave this role access to everything.
- switched the iis settings over to use windows auth, and turned off anonymous
- updated the web.config to use windows auth and specify the role that I setup previous
However,I cant get to the admin panel now. What could I be missing?
[ update 2 ]
After noticing the documentation link he provided (duh), I saw that I needed to enable windows auth for the modules. So I enabled IIS anonymous again (so I could log in), and updated the settings for the modules, but I see no option under Settings\Users for to enable windows auth. Did it move?
Im using v1.10.2
You can use the module AlexZh.WindowsAuthentication.
Documentation: http://orchardwinauth.codeplex.com/documentation
First you need to change the Orchard.Web project properties (in Visual Studio, click on project + F4) to ...
Anonymous Authentication: Disabled
Windows Authentication: Enabled
... and then you need to change the Orchard.Web\Web.configto something like this
<authentication mode="Windows">
<forms loginUrl="~/Users/Account/AccessDenied" timeout="2880" />
</authentication>
<roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" />
<authorization>
<allow roles="YourDomain\Domain Users" />
<deny users="?" />
</authorization>
The permissions can be configured as usual based on Orchard roles.
I've been using this module since 2 years now and i'm pretty happy with it but be aware that the module has several bugs:
it might cause a deadlock, see https://github.com/OrchardCMS/Orchard/issues/7688
it creates a new user when the logged in domain user cannot be found in the Orchard DB, you might want to alter the class CustomAuthenticationService to avoid this (i can provide some code if you need it)
I just start to learn new Office 365 API. I'm also not so deep understand server-side programming. I have VS2013 and all pre-requisites as pointed in the link bellow. Some example with Windows Desktop App worked. But when I get example https://code.msdn.microsoft.com/Office-365-APIs-Get-d75d1c8a - it fails during setting up in Service Manager after Sign-In to O365.
The error message - "Unsupported or invalid query filter clause specified for property '' appId of resource 'Service Principal' ". This message appear instead permissions in Service Manager. When I press OK - "Sign In" point in Service Manager still there - Authentication Failed.
Please help!
You need to remove the existing client id and settings from app.config (or web.config in web project). When I removed the following from App.config in the Office365Api.Demo project, I was able to register the app in my own Azure AD.
<add key="ida:ClientId" value="[put here your ClientID]" />
<add key="ida:RedirectUri" value="http://localhost/eb2c041088c22f67fecaffda29528308" />
<add key="ida:AuthorizationUri" value="https://login.windows.net/" />