Dev thoughts

New identity management in .Net 4.5

2012-04-08T23:36:00.001-07:00

Originally the management of the identities in the .Net framework was mainly done through the “System.Security.Principal” namespace, with the 2 interfaces “IIdentity” and “IPrincipal” (and the class “WindowsIdentity” for everything around Kerberos and NTLM).
Since a few years, lots of improvements have been made in the management of the authentication process, with some new claims-based protocols (like WS-Federation or Saml2). In Microsoft world, those protocols can be easily managed through some services like ADFS 2.0 or Azure Access Control Service (ACS) 2.0.
In the .Net framework, a new set of API has been released by Microsoft through the Windows Identity Foundation (WIF) sdk (http://msdn.microsoft.com/en-us/security/aa570351).

For more information regarding this framework till .Net 4.0, I strongly advise you to refer to:

Programming Windows Identity Foundation, by Vittorio Bertocci (@Vibronet),
A Guide to Claims-Based Identity and Access Control (2nd Edition), from the Microsoft patterns & practices Developer Center.

Till .Net 4.0, this WIF framework was not included directly in the .Net framework.
(The sdk was available here: http://www.microsoft.com/download/en/details.aspx?id=4451)

In .Net 4.5 a very nice job has been done by Microsoft, and now “WindowsIdentity” is built upon a new “System.Security.Claims.ClaimsIdentity”.

Till .Net 4.0, you could see that:

WindowsIdentity till .Net 4.0

Now you will get that:

WindowsIdentity in .Net 4.5

All the old properties are still here.
You can check in the 2 following screenshots that all the properties from WindowsIdentity till .Net 4.0 are still available in the .Net 4.5 version:

WindowsIdentity entry for the current user under .Net 4.0

WindowsIdentity entry for the current user under .Net 4.5

By the way, you can notice at the same time the new “AuthenticationType” “LiveSSP” that allows to use a LiveId.
This “LiveSSP” is not really new. It was already available in IIS in Windows 7 and 2008 R2 (http://technet.microsoft.com/en-us/library/cc771945.aspx).
Here again you can see that Microsoft did a great job to integrate correctly everything.

Manipulating claims and tokens will probably be greatly eased with those new objects. Retrieving all the claims for a user becoming really easy:

All the claims for the current user (most important properties being “Type” and “Value”)

For people working with identities, working with .Net 4.5 should be quite interesting!

This is outside the scope of this note, but let’s finish with a link about the new Kerberos features in Windows Server 8: http://technet.microsoft.com/en-us/library/hh831747.aspx

Snippet c#: Detect if a hostname or an IP is the local machine

2012-04-08T05:02:00.003-07:00

Here is a simple and efficient code snippet to detect if a string represents the local machine or not.
Basically it will return ‘true’ for values like: “localhost”, “127.0.0.1”, “::1”, …

public static bool IsLocalhost(string hostNameOrAddress)
{
    if (string.IsNullOrEmpty(hostNameOrAddress))
        return false;

    try
    {
        // get host IP addresses
        IPAddress[] hostIPs = Dns.GetHostAddresses(hostNameOrAddress);
        // get local IP addresses
        IPAddress[] localIPs = Dns.GetHostAddresses(Dns.GetHostName());
        // test if any host IP is a loopback IP or is equal to any local IP
        return hostIPs.Any(hostIP => IPAddress.IsLoopback(hostIP) || localIPs.Contains(hostIP));
    }
    catch
    {
        return false;
    }
}

(Note: to use it you need to reference “System.Net” that contains “IPAddress”)

Tips: Useful commands for TFS in Visual Studio

2011-10-25T07:29:00.000-07:00

This post is a short remember of 2 TFS command lines I use a lot.
Because of that, I like to have them defined as "External Tools" in Visual Studio.

Command 1: Preview of a get latest

I like to know exactly what I will get before getting it [therefore I can know when a merge will be required before starting it... No need to have a bad surprise when it can be avoided!]

This first command is in fact the classic "get", with the option "/preview".
Which gives:
c:\program files (x86)\microsoft visual studio 10.0\Common7\IDE\TF.exe get /preview /recursive

Here how you can integrate it in Visual Studio.
Select "Tools" > "External Tools…", and then create a new entry:

Creation of the command "TFS Test Get"

Values should be:

A meaningful title ☺
Command: c:\program files (x86)\microsoft visual studio 10.0\Common7\IDE\TF.exe
Arguments: get /preview /recursive
Initial directory: $(SolutionDir)
Select the option "Use Output window"

Observation: this command is interesting to know which files will be updated, and if some merges will be required, however I strongly advise any TFS user to use Team Foundation Sidekicks.

Command 2: Undo unchanged checked out files

In TFS a file must be checked out before being modified.
The "check out" operation can be automated (no prompt will appear), but very often some files are checked out without being modified... (because you did a modification but canceled it after, or because a whole group of files have been checked out at the same time, or those annoying "*.vspscc" files...)

This second command is available in the power tools and allows to cancel the check out of all the files that don't contain any modification.
Here is the command:
C:\Program Files (x86)\Microsoft Team Foundation Server 2010 Power Tools\TFPT.EXE uu /noget /recursive

Here again how you can integrate it in Visual Studio.
Select "Tools" > "External Tools…", and then create a new entry:

Creation of the command "TFS uu" ("uu" standing for "undo unchanged")

Values should be:

A meaningful title ☺
Command: C:\Program Files (x86)\Microsoft Team Foundation Server 2010 Power Tools\TFPT.EXE
Arguments: uu /noget /recursive
Initial directory: $(SolutionDir)
Select the option "Use Output window"

Observations:

I always run this command before any commit or any shelve, therefore I know exactly what I will commit,
If you are in a situation in which some files have been modified in your workspace without having been checked out (meaning that TFS does not know there are some modifications), you can quickly find them by doing a recursive checked out of all the files, and then calling this command.

Last advice: Create some shortcuts

Because I am using those commands before each get latest and before each commit, I usually like to define some shortcuts to call them quickly.
Those commands are among a few ones I even put in the main menu bar.
To do so, you can do a right click on the main menu bar, and select "Customize…".

Add your external commands

Notice that you will not see the name of your commands in the "Customize" panel. You will see "External Command #". However the names will be ok (and you can even put some icons if you prefer).

That's it for those 2 basic but useful commands.
G

Tips: Use JavaScript commands in your browser

2011-05-03T08:10:00.000-07:00

Do you know that it is possible to manually execute JavaScript commands directly in your favorite browser? [Internet Explorer, Firefox, Chrome or whatever…]
When you are on a website, you can write a JavaScript command and execute it.
Here is a basic test: javascript:alert('Hello world!');

Execution of a basic JavaScript command directly in a browser

This possibility allows to do lots of interesting things.
Here are two commands I think very useful:

1. The Printliminator

http://css-tricks.com/examples/ThePrintliminator/
This command allows to modify a page before printing it (by removing some parts).
Therefore you can print only the content that interests you.

javascript:(function(){function%20loadScript(a,b){var%20c=document.createElement('script');c.type='text/javascript';c.src=a;var%20d=document.getElementsByTagName('head')[0],done=false;c.onload=c.onreadystatechange=function(){if(!done&&(!this.readyState||this.readyState=='loaded'||this.readyState=='complete')){done=true;b()}};d.appendChild(c)}loadScript('http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js?ver=1.3.2',function(){loadScript('http://css-tricks.com/examples/ThePrintliminator/js/printliminator.js',function(){printlimator()})})})()

Here is an example:

Original site

Modifications using the Printliminator

Result with only what we want to print

2. Show password field hidden values

http://www.mydigitallife.info/show-or-verify-asterisk-password-field-hidden-value-with-view-passwords-bookmarklet/
This command shows the values of the password fields in a page.

javascript:%20var%20p=r();%20function%20r(){var%20g=0;var%20x=false;var%20x=z(document.forms);g=g+1;var%20w=window.frames;for(var%20k=0;k<w.length;k++)%20{var%20x%20=%20((x)%20||%20(z(w[k].document.forms)));g=g+1;}if%20(!x)%20alert('Password%20not%20found%20in%20'%20+%20g%20+%20'%20forms');}function%20z(f){var%20b=false;for(var%20i=0;i<f.length;i++)%20{var%20e=f[i].elements;for(var%20j=0;j<e.length;j++)%20{if%20(h(e[j]))%20{b=true}}}return%20b;}function%20h(ej){var%20s='';if%20(ej.type=='password'){s=ej.value;if%20(s!=''){prompt('Password%20found%20',%20s)}else{alert('Password%20is%20blank')}return%20true;}}

Those were 2 useful functionalities.
There are way more.
Here are 2 “funny” ones:

1. Edit any web page/site

This one is really basic, but it can be handy sometimes (for example before doing a screenshot, or why not for some pranks!).
Of course this will not allow you to edit the real web site!

javascript:document.body.contentEditable='true'; document.designMode='on';void 0

2. Destroy any web page/site

What about destroying a website using a spaceship!
There are several funny scripts ready to use on the internet that allows to do that. Here’s one of them from http://erkie.github.com/:

javascript:var%20s%20=%20document.createElement('script');s.type='text/javascript';docume nt.body.appendChild(s);s.src='http://erkie.github.com/asteroids.min.js';void(0);

You can direct the spaceship!

That’s it.

A last thing:
you can create bookmarks with those JavaScript commands. Therefore you will be able to execute them easily!

Tips: Manage your server expiration rules using the 'net accounts' command

2011-02-28T08:00:00.000-08:00

<babblings>
The default security on a server is to force all users to change their passwords after 42 days.
Well.. This may be a good rule for important servers, but this can be really annoying for test servers, shared accounts, or any account you use once upon a time..

The most common way to modify this behavior is to use the local policy security console (through "gpedit.msc" for example), finding the parameters, and modifying them.
Easy?
Well.. not so much if we look at all the people that struggles with doing that.

In fact if like me you don't change those parameters very often, you will probably not remember where they are located.
And even after having found them, you might have some bad surprises when trying to modify them: "Hey, I am the administrator, but the field is readonly! wtf.."

Well, a very easier and faster solution exists to perform this.
There are some really basics but still powerfull commands: the "net commands".
Good administrators have been using them for ages!
</babblings>

"net accounts" offers the following options:

"net accounts" parameters

Here is the Microsoft Technet description of the parameters:

/forcelogoff:{minutes | no} - Sets the number of minutes to wait before ending a user's session with a server when the user account or valid logon time expires. The default value, no, prevents users from being forced to log off.

/minpwlen:length - Sets the minimum number of characters for a user account password. The range is from 0 through 127 characters and the default is six characters.

/maxpwage:{days | unlimited} - Sets the maximum number of days that a user account's password is valid. The unlimited value sets no maximum time. The /maxpwage command-line option must be greater than /minpwage. The range is from 1 through 49,710 days (that is, unlimited equals 49,710 days), and the default value is 90 days.

/minpwage:days - Sets the minimum number of days before a user can change a new password. The default value is zero days, which sets no minimum time. The range is from 0 through 49,710 days.

/uniquepw:number - Requires a user to not repeat the same password for the specified number of password changes. The range is from 0 through 24 password changes, and the default is five password changes.

/domain - Performs the operation on the primary domain controller of the current domain. Otherwise, the operation is performed on the local computer.

The 2 commands I use the most:

net accounts /maxpwage:unlimited [to disable the expiration of the password]
net accounts /uniquepw:0 [to allow to reuse the same password]

Here is the default parameters on a new windows server 2008 R2 SP1:

Default parameters on a new Windows Server 2008 R2 SP1

As you can see here, the values are not the "default" ones that are given in the Technet link above.
Here the passwords will expire after 42 days, and there is no history maintained [it signifies that you can redefine a password used previously].

Here is the result after applying my modifications:

Expiration has been disabled

That's it!!
In a nutshell, to disable the expiration rule of the passwords, you only need to use this command: "net accounts /maxpwage:unlimited" ! ☺

Tips: The “clip” command

2010-12-29T08:00:00.000-08:00

The “clip” command allows to redirect an output to the clipboard.

It can be very useful to copy the content of a large output in the clipboard.

For example, if you want to get all the assemblies that are in your GAC and whose name contains “TeamFoundation”:
gacutil /l | find "TeamFoundation" | clip

I sometimes use this command to avoid having to remember some complicated passwords.

For example, if I have an exe “%ProgramFiles%\MyProgram.exe” that will prompt me for a password "MyComplicatedPassword”, I will create the following shortcut:

%windir%\System32\cmd.exe /c "(echo MyComplicatedPassword| clip) & ("%ProgramFiles%\MyProgram.exe")"

Main steps for this creation:

Create a new shortcut

Set up the command

Now when I will use my new shortcut, it will launch my application, and when I will be prompted for its password, I will be able to paste it!

Observations:

Write “echo MyComplicatedPassword| clip”, and not “echo MyComplicatedPassword | clip” to avoid to include a space character at the end of the password,
A shortcut must point on an existent file. Hence the use of “%windir%\System32\cmd.exe”.
Some applications are expecting to be launched from their folder. You might need to set up the “Start in” value in the properties of your new link (well.. and while you are having a look to the properties, you may also want to play with “Change Icon…”, and to set the “Run” value to “Minimized”)

Improve your new shortcut

Don’t do that with important passwords

Let's talk about batch and command line scripting - Part 1/2

2010-11-04T07:06:00.000-07:00

About this article

There are lots of powerful tools to perform scripting.

Powershell is great to manipulate files, MSBuild is nice to create tasks and execute them, ..

However to perform quick tasks on any Windows, batch scripting can be quite handy:

it is always available [no need to install anything],
when you are used to the syntax, it is quite easy and fast,
you can write a .bat file and then execute it on any Windows

Even if now powershell can be found almost anywhere, you cannot execute scripts by default on it.

[And having to modify a register, or to be an administrator to launch "set-ExecutionPolicy RemoteSigned", can be annoying when the goal is to perform quickly a few actions, or when you expect a script to be run on several computers]

I will not present in this article all the commands that are available, but I will focus on the scripting part.

I will not explain the use of basic commands or keywords, like "@echo off", "REM", "SET"... If you have never written a script, or at least read one, this article is probably not the best one to start...

To get a list of the main commands, you can type "Help" in a Command Prompt.

To get more information, you can have a look here:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/ntcmds.mspx

By the way, each time you will see a section like this one (<Babblings>..</Babblings>)... You can skip it! This is just me babbling. No crucial information here.

</Babblings>

1. Using the round brackets ( ) to create blocks

To define blocks of commands, you need to use the round brackets.

For example to write a 'if' statement with several commands, you can write:

if "%toto%" == "Test" (

echo 1st line

echo 2nd line

)

2. Using ^ to create multi-lines commands

^ allows to define multi-lines commands. It can really be convenient to improve the readability of a script.

For example:

echo This test ^

will write^

a unique line.

returns:

This test will write a unique line.

3. Using & to write several commands on a line

& does the opposite of ^

It allows to write several commands on a line.

For example:

echo 1

echo 2

can be written:

echo 1 & echo 2

However, to improve the readability, I prefer writing:

(echo 1) & (echo 2)

I already spoke twice of readability:

when you write a script, always keep in mind that someone may need to read it after...

Worst case scenario: this someone can be you in a very long time!!!

(Yes, sometimes I have to think hard to figure what past-me has written. But I made a deal with future-me to improve that.)

</Babblings>

4. Block statements

4.1. The 'if' statement

The 3 most usual ways to use 'if' are:

Checking if a file exists: if [not] exist FileName (command1) [else (command2)]
Checking if a variable exists: if defined variable (command1) [else (command2)]
Comparing elements:

Basic way:

if [not] string1==string2 (command1) [else (command2)]

Advanced:

if [/i] string1 CompareOp string2 (command1) [else (command2)]

where

/i indicates that the comparison must be case insensitive
if string1 and string2 contains only digits, a numeric comparison is performed
CompareOp is a three-letter comparison operator:

EQU for '=', NEQ for '≠',
LSS for '<', LEQ for '≤',
GTR for '>', GEQ for '≥'

Therefore:

if /i "2" GTR "10" (echo String comparison) else (echo Numeric comparison)

returns "String comparison"

while

if /i 2 GTR 10 (echo String comparison) else (echo Numeric comparison)

returns "Numeric comparison"

To get more options: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/if.mspx

4.2. The 'for' statement

When it has been created, this command was intended to be used on a set of files. But it can now be quite useful to perform loops.

The default syntax is:

for [variable] in (set) do (command)

where

[variable] must be '%' followed by one case sensitive letter when 'for' is used from the command line, or '%%', also followed by one case sensitive letter when it is used from a script.
(set) can be a file mask, like "(*.doc *.txt)"

For example the following script (take care of the '%%') opens in different notepads all the .txt and .bat files:

for %%f in (*.txt *.bat) do start notepad.exe %%f

Several other options exist on the 'for' command.

The one I find the most interesting is '/L' (L for Loop).

For example here is an enumeration, starting from 0, ending at 10, by step of 1:

for /L %%i in (0,1,10) do echo %%i

While the following script creates an infinite loop:

for /L %%i in (0,0,0) do echo To infinity and beyond!

You can check all the possibilities here:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/for.mspx

It took me some time to remember the syntax of the 'for' command.

And very often I still forget that the variable must be in the format '%v' or '%%v', depending on where is used the command.

However, this is quite a useful command to know.

</Babblings>

5. Using && and ||

Here come 2 boolean operators that deserve to be known!

I think an example will explain how to use them:
(MyTestCommand) && (echo success) || (echo failed)

is equivalent to

MyTestCommand

if %ERRORLEVEL% == 0 (echo success) else (echo failed)

(MyTestCommand) & (if %ERRORLEVEL% == 0 (echo success) else (echo failed))

2 other examples:

(ping -n 1 127.0.0.1 > nul) && (echo Success) || (echo Failed)

returns 'Success'

while

(ping -n 1 1.0.0.0 > nul) && (echo Success) || (echo Failed)

returns 'Failed' (assuming that you can't reach 1.0.0.0 on your network)

I really use a lot '&&' and '||'

I think "(MyCommand) || (MyOtherCommand)"

is more readable than

MyCommand

IF not %ERRORLEVEL% == 0 (MyOtherCommand)

</Babblings>

6. Using labels

In batch files, labels are used by:

'goto': to jump in another place in the code (without parameters),
'call': to call a function and then to continue the current execution of the script (some parameters can be specified)

The definition of a label must start by ':', but this character can be omitted in the 'goto' or the 'call'.

The script:

echo 1

goto :Jump This is a test

echo 2

echo 3

:Jump

echo 4 - %*

echo 5

will return

4 - [either nothing, either the parameters provided to the script. Here "This is a test" is useless and ignored]

whereas the script:

echo 1

call :Jump This is a test

echo 2

echo 3

:Jump

echo 4 - %*

echo 5

will return

4 - This is a test

4 - [either nothing, either the parameters provided to the script.]

Observation:
You can jump directly to the end of the script by using:

goto :EOF

'goto :EOF' is usually used at the end of a function (because the function will returned only after having reached its end)

Conclusion of this first part

I did not put here all what I had intended. Therefore next Thursday I will write a 2nd part.

This is my first real post, so excuse the way the codes are written: I will improve my blog progressively.

</Babblings>

In the next part of this article, I will explain:

How to call a script and how to exit it,
How to manage strings,
The usual problem of "Variable expansion" (what is it and how to manage it),
A few comments/tips on interesting commands,

To end this first post, I think this video fits well:

http://www.youtube.com/watch?v=dmEvPZUdAVI

Thank you for reading!

Hello World 2

2010-11-01T07:06:00.000-07:00

I have decided recently to start a technical blog.
I am not sure I will keep it for long, but well... who knows.
I will try to alternate here short articles [tips, comments on interesting books / tools, ...], and longer stuffs.

This is my 2nd blog. I kept the 1st one from 2006 to 2008, but it was not very technical.
This blog will be about Microsoft .Net, mostly with C#. I will probably write some things about Silverlight and WPF. Maybe Workflow Foundation. Certainly Team Foundation Server and some other useful tools. In short, this blog will be about developing on a Windows Platform with Microsoft .Net.

Ok. 1st message is written.
Interesting things might start next Thursday.
Stay tuned,
G