Azure: getting service certificate without defining an additional configuration - c#

My cloud service has the following config:
<?xml version="1.0" encoding="utf-8"?>
<ServiceConfiguration ...>
<Role name="...">
<ConfigurationSettings>
<Setting name="MyCertThumbprint" value="AB687DC9F63D51AE6E9522B86B97EFD15F55EA42" />
</ConfigurationSettings>
<Certificates>
<Certificate name="MyCert" thumbprint="AB687DC9F63D51AE6E9522B86B97EFD15F55EA42" thumbprintAlgorithm="sha1" />
</Certificates>
</Role>
</ServiceConfiguration>
See the redundance?
I want to get rid of MyCertThumbprint config. Is there an Azure API that gives me access to the thumbprint of MyCert? Or maybe the X509Certificate2 instance itself (i.e. without having to search for it using X509Store) ?

Sure - if you know other information about the certificate, you can use any of the X509FindType Enumerations with X509Certificate2Collection.Find Method. Unfortunately, the Certificates section of the ServiceConfiguration is for locating the certificate in the Cloud Service certificate store and installing that certificate on the VMs associated with the Role you are deploying. There is no API to access the section directly. So your choice is to hard code something like the certificate subject name or the thumbprint and hope it doesn't change, or add a setting like you've demonstrated in your code sample that is configurable with each deployment.
The ConfigurationSettings section mirrors the appSettings section in the web.config file and when used in conjunction with CloudConfigurationManager.GetSetting("settingsKey") with look first in the ServiceConnfiguration then in the web.config for application settings, allowing you to un local in an emulator or just IIS express and achieve the same functionality. So we duplicate the settings in both ServiceConfiguration and web.config.

Related

AWS SDK for .NET can't access credentials with IIS

I'm having some trouble accessing the AWS credentials in the SDK Store, but it seems to only be a problem when running under IIS. If I hit the same code by invoking an NUnit test with ReSharper the dependency injection works and the S3 client is able to authenticate.
IAmazonS3 s3Client = new AmazonS3Client();
Has anyone else run into this problem? How were you able to get the dependency injection to work?
[Edit]
The credential file approach has been recommended for use with IIS because the SDK Store encrypts the credentials differently for each user. I can only get a credentials file to work if I hard-code the path in the appSettings which I do not want to do.
Where would the SDK look for the credentials file besides the below paths?
C:\Users\<IIS_app_name>\.aws\credentials
C:\Users\<my_domain_user>\.aws\credentials
The question was answered under Pavel's answer, but I'll post an answer to make the information easier to consume. You can specify the credentials file location in the webLocal.config (I wasn't able to get it to work without that). When the app is deployed, the credentials file location will be an invalid path, and the SDK will fail over to using the IAM role for the EC2 instance.
webLocal.config
<?xml version="1.0"?>
<appSettings>
<!-- AWS -->
<add key="AWSProfilesLocation" value="C:\Users\<IIS_app_name>\.aws\credentials" />
<add key="AWSRegion" value="us-west-2" />
<add key="S3Bucket" value="bucket." />
</appSettings>
The dependency injection will work when you instantiate a client without arguments.
IAmazonS3 s3Client = new AmazonS3Client();
The SDK Store saves the credentials under the C:\Users\<username>\AppData\Local\AWSToolkit folder, so unless IIS is being run under the same account as the NUnit tests, IIS will not be able to access the same credentials.
This blog discusses the various options for storing and using credentials. In your case, it looks like a better option would be to use the credentials file.

Azure Worker Role What went wrong before OnRun() method?

I have suddenly started getting key not found error in my worker role.
Configuration is missing required information. Make sure the property
'Endpoint' is defined as part of
'Microsoft.ServiceBus.ConnectionString' key within 'appSettings'
section, or Windows Azure configuration settings.
What I have tried:
Setting name Microsoft.ServiceBus.ConnectionString is present in Cloud config.
<Role name="MyWorkerRole">
<ConfigurationSettings>
<Setting name="Microsoft.ServiceBus.ConnectionString" value="Endpoint=sb://mysevicebus.servicebus.windows.net />
Service definition file.
<ConfigurationSettings> <Setting name="Microsoft.ServiceBus.ConnectionString" />
Package.Config entry for Microsoft.WindowsAzure.ConfigurationManager points to correct version 2.0.3
App.Config: Runtime -> AssemblyBinding -> DependentAssembly for AzureServiceRuntime, ServiceBus & AzureConfiguration packages are correct.
Not sure what else to look into. Can you please help?
P.S. The exception is thrown after OnStart() method, just before hitting Run() method.
Have you attempted to add the SharedAccessKey and RootManagedSharedAccessKey? They are missing from you application's code demonstrated above. I have this in the app settings of my Role as well as the service configuration.
<add key="Microsoft.ServiceBus.ConnectionString" value="Endpoint=sb://yourSBname.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=KeyFromPortal" />

How to configure Kentico CMS to use In-Role Cache

First of all, I'm new to Kentico CMS.
We download the from here. Then install the application as Windows Azure project.
When I look at web.config, Kentico CMS 7 (as of today) uses Shared Caching which has been deprecated a couple of years back.
Is there any way I can configure to use In-Role Cache (or worst case Cache Service which is still in Preview)?
<!-- Azure AppFabric cache BEGIN -->
<section name="dataCacheClients"
type="Microsoft.ApplicationServer.Caching.DataCacheClientsSection,
Microsoft.ApplicationServer.Caching.Core" allowLocation="true"
allowDefinition="Everywhere"/>
<!-- Azure AppFabric cache END -->
<!-- Azure AppFabric cache BEGIN -->
<dataCacheClients>
<dataCacheClient name="default">
<hosts>
<host name="YourName.cache.windows.net" cachePort="22233"/>
</hosts>
<securityProperties mode="Message">
<messageSecurity authorizationInfo="YourKey"/>
</securityProperties>
</dataCacheClient>
<dataCacheClient name="SslEndpoint">
<hosts>
<host name="YourName.cache.windows.net" cachePort="22243"/>
</hosts>
<securityProperties mode="Message" sslEnabled="true">
<messageSecurity authorizationInfo="YourKey"/>
</securityProperties>
</dataCacheClient>
</dataCacheClients>
<!-- Azure AppFabric cache END -->
The host element in the caching configuration points to a caching cluster and it doesn't care about how the cache cluster is deployed - old service, new service or in-role.
If you use the new Caching service you should be able to change the configuration to point at your cache instance using your cache's URL
To use in-role caching you will need to create the relevant load-balanced endpoints for the cloud service and then configure your client with your cloud service URL.
I found the article in Kentico site, so I posted for others -
Windows Azure Cache Service in Kentico CMS
If you used AppFabric caching in your Kentico CMS projects running on Azure, you could be interested in replacing this caching option with a new Windows Azure Cache because AppFabric cache is no longer provided.
To make it work, you should follow the official guide from Azure documentation - How to Use Windows Azure Cache Service (Preview).
After initially creating the cache and configuring it, you need to open your project in Visual Studio and install Windows Azure Caching NuGet package for CMSApp web role as it is mentioned in the guide.
Another step is to remove xmlns attribute from tag in your web.config file, replace the original and tags with the newly added ones and delete duplicate tag.
The next thing to do is to remove xmlns attribute for tag as well, put tag to the original section and delete the duplicate.
The rest of the steps should correspond to those mentioned in the guide, i.e. replacing [Cache role name or Service Endpoint] with the endpoint, which is displayed on the Dashboard in the Azure Management Portal.
The guide also contains sample codes for creating and retrieving objects from the cache, specifying expiration, storing ASP.NET session state, etc.

How to add service reference from customer's private network

I need to develop a service client application in C#. The service is hosted on customer's local network which I have no access. So I cannot use Add Service Reference option to create service proxy.
The customer gave me only the XML Soap declarations of their service. It looks like the following:
<?xml version="1.0" encoding="UTF-8" ?>
- <!-- Published by JAX-WS RI at http://jax-ws.dev.java.net. RI's version is Oracle JAX-WS 2.1.5.
-->
- <!-- Generated by JAX-WS RI at http://jax-ws.dev.java.net. RI's version is Oracle JAX-WS 2.1.5.
-->
- <definitions xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:tns="http://helios.tedas.gov.tr/im" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.xmlsoap.org/wsdl/" targetNamespace="http://helios.tedas.gov.tr/im" name="IletisimModulu">
- <types>
It is just the head of XML, I am not putting the full XML because of its size. I think this is what we would see if we navigate to service url from explorer (http://mywebservice/Service?WSDL).
So now, how can I create service proxy from this XML document that they gave me?
So I cannot use Add Service Reference option to create service proxy.
You can paste a file path there as well as an URL. See also How can I consume a WCF service using a local WSDL file?.

Remote Desktop "can't connect to the remote computer"

I have followed this tutorial to create the first azure application
http://msdn.microsoft.com/en-us/WAZPlatformTrainingCourse_IntroToWindowsAzureLabVS2010
Because after deployment its not working on the following url
http://24fb8b6a055d4ab2a556218f62d6dbe1.cloudapp.net/
I found the following link helpful to connect via remote desktop to be able to see the error:
http://wely-lau.net/tag/remote-desktop/
However, after following all steps, I get the following error
Remote Desktop can’t connect to the remote computer for one of these
reasons:
1) Remote access to the server is not enabled
2) The remote computer is turned off
3) The remote computer is not available on the network
Make sure the remote computer is turned on and connected to the
network, and that remote access is enabled.
In:
ServiceConfiguration.Cloud.cscfg
I have this contents
<?xml version="1.0"?>
<ServiceConfiguration serviceName="GuestBook" xmlns="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceConfiguration">
<Role name="GuestBook_WebRole">
<Instances count="1" />
<ConfigurationSettings>
<Setting name="Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=luisvalenciaguestbook;AccountKey=x" />
<Setting name="DataConnectionString" value="DefaultEndpointsProtocol=https;AccountName=luisvalenciaguestbook;AccountKey=x" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.Enabled" value="true" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountUsername" value="levalencia" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountEncryptedPassword" value="x" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountExpiration" value="2012-12-16T23:59:59.0000000+01:00" />
</ConfigurationSettings>
<Certificates>
<Certificate name="Microsoft.WindowsAzure.Plugins.RemoteAccess.PasswordEncryption" thumbprint="x" thumbprintAlgorithm="sha1" />
</Certificates>
</Role>
<Role name="GuestBook_WorkerRole">
<Instances count="1" />
<ConfigurationSettings>
<Setting name="Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=luisvalenciaguestbook;AccountKey=x" />
<Setting name="DataConnectionString" value="DefaultEndpointsProtocol=https;AccountName=luisvalenciaguestbook;AccountKey=x" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.Enabled" value="true" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountUsername" value="levalencia" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountEncryptedPassword" value="x" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountExpiration" value="2012-12-16T23:59:59.0000000+01:00" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteForwarder.Enabled" value="true" />
</ConfigurationSettings>
<Certificates>
<Certificate name="Microsoft.WindowsAzure.Plugins.RemoteAccess.PasswordEncryption" thumbprint="x" thumbprintAlgorithm="sha1" />
</Certificates>
</Role>
</ServiceConfiguration>
By default Remote Desktop for Azure uses the usual TCP port 3389: you'll need to have this enabled outbound at your corporate firewall.
An alternative approach to setting up Remote Desktop through the configuration files directly or through Visual Studio is to use the Azure Management Portal to modify them temporarily. This is rather easier and somewhat less error prone, especially where certificates are concerned.
Sign in to the management portal as usual, and choose "Hosted Services". Then find the service you'd like to configure.
The next step is to configure the Web Role or Worker Role to allow Remote Desktop connections: this will adjust the configuration file for the service, so any changes here will be lost when you next upgrade or reimage. Select the role, then in the toolbar ensure "Enable" is checked on, and choose Configure:
You'll be prompted for the username, password, certificate and expiry time.
Choose OK. If you've made changes to the configuration it can take a little while (sometimes several minutes) for them to be applied.
Once the instances are marked as "ready" again, you can then select one and choose Connect:
This will download a file with the extension .rdp, which you can then open to connect to the remote host. (You will most likely see some security warnings when you do so.)
If you still see the warning about being unable to connect to the remote host then there are a couple of things to explore: certificates and firewall issues. In my experience the "manual" process, configuring the remote desktop settings in Azure through the portal, usually gets around any issues with certificates.
Firewall issues are harder to resolve. You may find that using Windows Azure Connect -- which in essence creates a secure VPN connection from your PC to the Azure instances -- allows you to access the Azure host directly, tunnelling across your corporate firewall.
If you are exposing a https endpoint, make sure you also expose an http endpoint. This solved the same issue for me with a data service I am hosting in a webrole.
All the above didn't work for me.
Enter your credentials, prefixed with . E.g. “\maarten”. This is done to strip off the Windows domain from the credentials entered.
Its somehow strange that is not documented anywhere and it should be stripped off by the windows azure RD manager !
I had this problem and nothing worked, I couldn't Remote Desktop in even though the role was fully working.
It turns out there is a known issue with Azure SDK 1.7 and 1.8. Here is the info I received from Microsoft:
A timing issue in a role startup in SDK versions 1.7 and 1.8 sometimes causes a firewall rule required by the Remote Forwarder Service to be deleted. Restart of the service will correct the problem and recreate the firewall rule but this is not a persistent fix. Any redeployment or restart of the role instance may cause the problem to reoccur.
Work Around:
Azure application developers can implement a custom startup task that refers to a *.cmd file (e.g. RemoteForwarderConfig.cmd) as described below. This will ensure a firewall rule is created that opens ports for the Remote Forwarder Service. This startup task should be added to the role designated for running the remote forwarder.
Documentation on startup tasks is available at http://msdn.microsoft.com/en-us/library/windowsazure/gg456327.aspx
Example task config:
<Task commandLine="RemoteForwarderConfig.cmd" executionContext="elevated" taskType="background"></Task>
Example task cmd file contents:
#echo off
netsh advfirewall firewall add rule name="RemoteForwarderService custom rule" description="Allow incoming connections to the remote forwarder" dir=in protocol=tcp program="%ProgramFiles%\Windows Azure Remote Forwarder\RemoteForwarder\RemoteForwarderService.exe" action=allow enable=yes
I had this issue and couldn't figure it out.
Turned out the password wasn't complex enough however it didn't inform me of this at any point. Adding a more complex password and logging in with \YourUsername sorted it for me!

Categories

Resources