Tech Debug

AWS PowerShell Lambda Build Environment for Docker

Tech Debug — Mon, 17 Feb 2020 08:00:21 +0000

If you’re deploying an AWS PowerShell Lambda (which is PowerShell Core 6.0) in a build pipeline, you’ll likely come across the fact that the older PowerShell docker images don’t have Dotnet Core installed.

The .NET Core 3.0 .NET Core 3.0 SDK Docker images now contain PowerShell Core, but since AWS still uses .NET Core 2.1 which is in Long Term Support, you’re out of luck.

Therefore if you’re deploying your lambda from your CI pipeline using docker, then you need a build environment which has:

PowerShell Core 6
.NET Core 2.1
AWS Tools for PowerShell

You’ve come to the right place. Here is a DockerFile you can use to build your Lambda deployment environment. Make sure you choose the AWS PowerShell Tools module you need in the last line:

An example of how you can build and use this image in a pipeline is below. I use Buildkite, so YMMV:

Sunscreen – Does it really help?

Tech Debug — Sun, 14 Jul 2019 09:42:52 +0000

A large increase in melanoma has been experienced in countries where chemical sunscreens are in use. This has been seen in the last decade in places such as Australia where promotion of sunscreens has been ongoing. In 1992 Queensland had more incidences of melanoma per capita than any other place on Earth. ^[11]

Not to be joked about is the result of applying sunscreen to your skin, which as an organ absorbs chemicals. How else does a Nicotine patch work?! A study in the April 2004 Journal of Chromatography found that there is “… significant penetration of all sunscreen agents into the skin, and oxybenzone and metabolites across the skin”. ^[12] A randomized clinical trial published results this year in the Journal of the American Medical Association found that found that several active ingredients, including oxybenzone, enter the bloodstream at levels that far exceed the agency’s recommended threshold for requiring additional safety tests. This was with application of four commercially available sunscreens according to current sunscreen labeling (apply at least every 2 hours). ^[18]

Chemical Sunscreens Include:

Benzophenones (dixoybenzone, oxybenzone – a potential hormone disruptor) – rapidly oxidise in the presence of light and inactivates important antioxidant systems in the skin (the skin’s natural protection system) ^[5]
Titanium dioxide – causes DNA damage (the cells genetic material) due to superoxide radicals, active oxygen radicals and hydroxyl radicals when exposed to light ^[2]^[3]^[4]
PABA and PABA esters:
- ethyl dihydroxy propyl PAB
- glyceryl PABA
- p-aminobenzoic acid
- padimate-O – produces free radicals in presence of light (singlet molecular oxygen) and substantially increase indirect damage (strand breaks in DNA) when in contact with cells ^[1]^[7]
- octyl dimethyl PABA – produces free radicals in the presence of light ^[1]
Cinnamates:
- cinoxate causes DNA damage (sister chromatid exchanges) ^[6]
- ethylhexyl p-methoxycinnamate
- octocrylene
- octyl methoxycinnamate – produces free radicals (singlet molecular oxygen) known to be toxic to cells ^[1]
Salicylates (ethylhexyl salicylate, homosalate, octyl salicylate)
Digalloyl trioleate
Menthyl anthranilate
Avobenzone [butyl-methyoxydibenzoylmethane; Parsol 1789] – This is the only chemical sunscreen currently allowed by the European Community. However, its safety is still questionable since it easily penetrates the skin and is a strong free radical generator.
Dibenzoylmethane – produces free radicals responsible for direct DNA damage (strand breaks) ^[8]
Methyl sinapate – causes DNA damage (chromosome aberrations and sister chromatid exchanges) ^[9]
Phenylbenzimidazole sulphonic acid and 2-phenylbenzimidazole – acts as photosensitisers of DNA damage when exposed to sunlight or UV-B radiation ^[10]

What about Free Radicals?

Many of the ingredients found in commercially sold sunscreens (as listed above) can have free radical generating properties which MAY increase cellular damage and changes that may lead to cancer. Details on why:

Oxygen-free radicals are more generally known as reactive oxygen species (ROS). The cumulative production of ROS is termed oxidative stress.
Oxidative stress induces a cellular redox imbalance which has been found to be present in various cancer cells compared with normal cells; the redox imbalance thus may be related to oncogenic stimulation (tending to cause or give rise to tumors).
DNA mutation is a critical step in carcinogenesis and elevated levels of oxidative DNA lesions (8-OH-G) have been noted in various tumours, strongly implicating such damage in the study of causation of cancer.
UV rays absorbed by the skin can generate harmful compounds called reactive oxygen species (ROS), which as detailed above can be related to skin cancer. Once the filters (Some of the chemical blockers listed above) soak into the lower layers of skin, they react with UV light to create more damaging ROS. Research indicates that sunscreen filters become damaging when they are soaked into the skin and another layer of sunscreen is not applied.
- A team of researchers from the University of California found that three commonly used ultraviolet (UV) filters in sunscreen – octyl methoxycinnamate, benzophenone 3 and octocrylene – eventually soak into the deeper layers of the skin after application, leaving the top skin layers vulnerable to sun damage. ^[17]

After visiting Hawaii in 2018 I saw a movement there to ban chemical based sunscreens, not only due to health concerns but due to environmental concerns. The outcome has been that beginning Jan 1, 2021, Hawaii is one of the first places in the world to legislate banning chemical sunscreens including octyl methoxycinnamate and oxybenzone. ^[16]

Lastly – food for thought – The sunscreen myth?

Conclusion

I’m not a medical professional of any kind, and you should not rely on my information in any way shape or form. However the referenced material is sound, solid medical research in peer reviewed journals. As such you should read the references yourself and come to your own conclusion about what you are putting on your skin, and the motives behind the manufacturers.

UVA and UVB rays are still a danger if one is genetically predisposed to cancer and has over-exposure to the Sun. Maybe you should consider suplementation of Fish Oil for reduction of Sunburn and Risk of Cancer? ^[13]^[14] There is even promising recent research indicating that the natural production of Vitamin D3 from natural sun exposure may also protect your skin. ^[15]

From reading all the medical journals and references, I’ll be sticking to a healthy level of natural sun exposure, or where that can not be achieved (for longer periods of time) a zinc based sunscreen, long sleeves, hats, sunglasses and shade from big trees. Fashion be damned.

References:

^ Chem Res Toxicol 1996 Apr-May; 9(3):605-9 Photochemical Formation of Singlet Molecular Oxygen in Illuminated Aqueous Solutions of Several Commercially Available Sunscreen Active Ingredients
^ Mutation Research 2000 3 March 2000, Pages 1-7 Effect of the photocatalytic activity of TiO₂ on plasmid DNA
^ Free Radical Biology and Medicine Volume 27, Issues 3–4, August 1999, Pages 294-300 Irradiation of titanium dioxide generates both singlet oxygen and superoxide anion
^ FEBS Letters Volume 418, Issues 1–2, 24 November 1997, Pages 87-90 Chemical oxidation and DNA damage catalysed by inorganic sunscreen ingredients
^ Journal of Investigative Dermatology Volume 106, Issue 3, March 1996, Pages 583-586 Oxybenzone Oxidation Following Solar Irradiation of Skin: Photoprotection versus Antioxidant Inactivation
^ Mutation Research Volume 212, Issue 2, June 1989, Pages 213-221 Enhancing effects of cinoxate and methyl sinapate on the frequencies of sister-chromatid exchanges and chromosome aberrations in cultured mammalian cells
^ Mutation Research Volume 444, Issue 1, 21 July 1999, Pages 49-60 Illumination of human keratinocytes in the presence of the sunscreen ingredient Padimate-O and through an SPF-15 sunscreen reduces direct photodamage to DNA but increases strand breaks
^ Free Radical Biology and Medicine Volume 26, Issues 7–8, April 1999, Pages 809-816 Nitroxide radicals protect DNA from damage when illuminated in vitro in the presence of dibenzoylmethane and a common sunscreen ingredient
^ Mutation Research Volume 212, Issue 2, June 1989, Pages 213-221 Enhancing effects of cinoxate and methyl sinapate on the frequencies of sister-chromatid exchanges and chromosome aberrations in cultured mammalian cells
^ Chem Res Toxichol 1999 Jan; 12(1):38-45 Photosensitization of Guanine-Specific DNA Damage by 2-Phenylbenzimidazole and the Sunscreen Agent 2-Phenylbenzimidazole-5-sulfonic Acid
^ American Journal of Public Health 82, no. 4 (April 1, 1992): pp. 614-615 C F Garland, F C Garland, and E D Gorham “Could sunscreens increase melanoma risk?”
^ Journal of Chromatography BVolume 803, Issue 2, 25 April 2004, Pages 225-231 Liquid chromatographic assay for common sunscreen agents: application to in vivo assessment of skin penetration and systemic absorption in human volunteers
^ Carcinogenesis Volume 24, Issue 5, May 2003, Pages 919–925 Effect of eicosapentaenoic acid, an omega-3 polyunsaturated fatty acid, on UVR-related cancer risk in humans. An assessment of early genotoxic markers
^ Journal of Investigative Dermatology Volume 124, Issue 1, January 2005, Pages 248-255 Eicosapentaenoic Acid and Docosahexaenoic Acid Reduce UVB- and TNF-α-induced IL-8 Secretion in Keratinocytes and UVB-induced IL-8 in Fibroblasts
^ Journal of Investigative Dermatology Volume 137, Issue 12, December 2017, Pages 2469-2471 Skin-Derived Vitamin D3 Protects against Basal Cell Carcinoma
^ The Lancet Planetary Health Volume 2, Issue 11, November 2018, Pages e465-e466 Sunscreens, cancer, and protecting our planet
^ Free Radical Biology and Medicine Volume 41, Issue 8, 15 October 2006, Pages 1205-1212 Sunscreen enhancement of UV-induced reactive oxygen species in the skin
^ JAMA. Published online May 06, 2019321(21):2082–2091 Effect of Sunscreen Application Under Maximal Use Conditions on Plasma Concentration of Sunscreen Active Ingredients: A Randomized Clinical Trial

Other References:

Medical Disclaimer

No warranty whatsoever is made that this article is accurate. There is absolutely no assurance that any statement contained or cited in this article touching on medical matters is true, correct, precise, or up-to-date. The overwhelming majority of this article is written, in part or in whole, by a medical nonprofessional. Even if a statement made about medicine is accurate, it may not apply to you or your symptoms.

The medical information provided on TechDebug is, at best, of a general nature and cannot substitute for the advice of a medical professional (for instance, a qualified doctor/physician, nurse, pharmacist/chemist, and so on). TechDebug is not a doctor.

None of the contributors, system operators, developers, or hosts of TechDebug nor anyone else connected to TechDebug can take any responsibility for the results or consequences of any attempt to use or adopt any of the information presented on this web site.

Nothing on TechDebug.com or included as part of any content of TechDebug, should be construed as an attempt to offer or render a medical opinion or otherwise engage in the practice of medicine.

Disclaimer courtesy of Wikipedia, used under CC-BY-SA licence.

Launch Windows Server 2016 Nano in AWS with Powershell

Tech Debug — Fri, 21 Oct 2016 04:15:51 +0000

Amazon Web Services yesterday announced they now have Amazon Machine images available for Windows Server 2016. This includes Nano Server, a perfect solution for a roll your own IaaS server to host your .NET Core APIs.

Windows Server 2016 Nano Server -A cloud-native, minimal install that takes up a modest amount of disk space and boots more swiftly than the Datacenter version, while leaving more system resources (memory, storage, and CPU) available to run apps and services.

One of the interesting things about Nano for existing Windows server users, is you can only access it via PowerShell/WinRM for managment of the server. You can quickly spin up a new instance of nano in your PowerShell console (already configured for AWS):

Once the instance has started up, you can get the Admin credentials using your EC2 Key, and establish a remote PowerShell session:

This leaves you with an established PowerShell session to the remote server, which can be shown as follows:
C:\> $session Id Name ComputerName ComputerType State ConfigurationName Availability -- ---- ------------ ------------ ----- ----------------- ------------ 2 Session2 172.19.1.67 RemoteMachine Opened Microsoft.PowerShell Available

You are now able to invoke remote commands on your Nano server:
C:\> Invoke-Command -Session $session -ScriptBlock { Get-Process | Select ProcessName, Id |ft } ProcessName Id ----------- -- amazon-ssm-agent 1792 csrss 496 EMT 1088 Idle 0 LiteAgent 828 lsass 556 services 544 smss 360 svchost 648 svchost 692 svchost 768 System 4 wininit 520 WmiPrvSE 1236 wsmprovhost 1468

If you just want to jump onto the remote server, you can Enter the Session:
C:\> Enter-PSSession -Session $session [172.19.1.67]: PS C:\Users\Administrator\Documents> $StartTime = (Get-Date) - (New-TimeSpan -Day 1) [172.19.1.67]: PS C:\Users\Administrator\Documents> Get-WinEvent -FilterHashTable @{LogName='System'; Level=2; StartTime=$StartTime} | select TimeCreated, Message TimeCreated Message ----------- ------- 10/21/2016 2:36:36 AM Task Scheduler service failed to start Task Compatibility module. Tasks m... 10/21/2016 2:36:15 AM The Virtualization Based Security enablement policy check at phase 6 fail... 10/21/2016 2:36:15 AM The Virtualization Based Security enablement policy check at phase 0 fail... 10/20/2016 4:18:55 AM Task Scheduler service failed to start Task Compatibility module. Tasks m... 10/20/2016 4:18:48 AM The Virtualization Based Security enablement policy check at phase 6 fail... 10/20/2016 4:18:48 AM The Virtualization Based Security enablement policy check at phase 0 fail... 10/20/2016 4:14:42 AM Task Scheduler service failed to start Task Compatibility module. Tasks m... 10/20/2016 4:14:11 AM The Virtualization Based Security enablement policy check at phase 6 fail... 10/20/2016 4:14:11 AM The Virtualization Based Security enablement policy check at phase 0 fail... 10/20/2016 11:12:05 AM The Virtualization Based Security enablement policy check at phase 6 fail... 10/20/2016 11:12:05 AM The Virtualization Based Security enablement policy check at phase 0 fail...

[172.19.1.67]: PS C:\Users\Administrator\Documents> Exit-PSSession

Don’t forget once you are finished to remove the session:
Remove-PSSession -Session $session

Given that this instance has no local console, you will have to maintain and access it fully using PowerShell. Time to skill up on your PowerShell skills. If you would like to read more on remotely managing the instance, Microsoft have documented how to manage Nano Server. It’s a good next step to read.

Cloudformation stack creation – scripting via bash

Tech Debug — Fri, 29 Jul 2016 03:44:13 +0000

Find yourself creating the same AWS Cloudformation stack a lot during testing?
Wasting too much time repeating typing in tags?

A simple post today with a quick solution.

Put your stack tags and parameters into json files and use this bash wrapper script to create the cloudformation stack. This script wraps the aws cloudformation create-stack command, but lets you create the stacks again and again with different names. The benefit is the parameters and tags are pre-defined. Thus this script will save you time if you are doing this from the AWS console regularly.

An example of running the script with parameters (that are ordinal on purpose):

create-stack.sh MockStack3 deploy/MockServices.template stackParams.json stackTags.json

Provide your own template file, and modify the stackParams and stackTags to your own needs. Below you’ll find the GitHub gist of the script and sample json files.

Tested on Bash in Windows 10 insider preview

Packer vmware-iso builder on ESXi without DHCP

Tech Debug — Wed, 16 Sep 2015 03:14:36 +0000

When you are building Windows Server 2012 R2 base images (vSphere Templates) using packer on vSphere (using vmware-iso packer builder); the process usually relies on the windows server to get an IP address automatically via DHCP. This allows the packer builder to then communicate to the server over WinRM and complete the provisioning.

What happens when there is no DHCP available in your vSphere VM Network?

The easy solution is to have the bootstrap of the windows server set a static IP for the server.
This would allow the packer builder to then communicate to the server over WinRM and complete the provisioning.
I already provide an Autounattend.xml to the windows server via the packer floppy_files stanza for the vmware-iso builder.

These user variables are populated with the environment specific floppy files:

I pass the config json file into the packer build command as shown below. This allows us to pass in different config per environment to the same build template for packer.

packer.exe build -var-file=Config-VMWare.json .\PackerBaseWin2012R2-VMWare.json

The Autounattend.xml executes the file a:\vmware-userdata.ps1 as the last step of the FirstLogonCommands setting of the Autounattend process.

The script for this particular environment then uses powershell cmdlets to configure the required static IP address allocated to the Packer Build VM:

Note: If you don’t wait long enough for the boot process to complete; the vmware-iso builder may detect the self assigned IP (169.x.x.x) prior to the userdata script setting the Static IP.
To solve this you can set the vmware-iso builder boot_wait to wait a bit longer, e.g. 10 mins.

This solves how to use packer on vSphere for Windows Server 2012 R2 bootstrapping where you don’t have a DHCP server on the subnet.

Setup Sublime Text for F# Development

Tech Debug — Fri, 04 Sep 2015 03:27:26 +0000

After being asked to use Visual Studio 2015 for F# Development, I decided it’s way more lightweight to to develop it on my Mac using Sublime Text 3.

Software you need installed:

Install Mono on your Mac
Of course Sublime Text 3
And the best package manager for Sublime, Package Control.

Install (using package control) these packages with package control in Sublime Text:

F# – Gives you syntax Highlighting
F-Sharp – Autocomplete, tooltips, definitions, etc.
SublimeREPL – A multi language REPL including F#

If you are used to Visual Studio for any F# development; you can create some Sublime text keyboard shortcuts using your key bindings settings:

Open REPL : CTRL+ALT+F
Send selected code to REPL : CTRL+SHIFT+ENTER

The bindings I use are shown below:

You’ll want to configure Sublime 3 indentation settings to include these options to replace Tabs with spaces; as Sharp hates your tabs.

This setup also works on Sublime for Windows, but you need fsi.exe in your path and working with all dependencies (Windows SKD, .NET Framework etc.).

Windows 10 UEFI USB Boot in VMWare Fusion 7

Tech Debug — Mon, 03 Aug 2015 03:59:10 +0000

You’ve downloaded your purchased Windows 10 ISO from Microsoft, and you’ve managed to create a bootable UEFI USB stick.
Now you’ve decided to run Windows 10 in VMWare Fusion Pro on your Mac. Yet the USB stick can NOT be booted from.
There is a solution. VMWare fusion has some (unsupported) EFI options you can enable to effect a USB boot.
First you’ll want to create a Windows 10 VM in VMWare Fusion.
Create a new VM, and select the more options icon:

Select Create a custom virtual machine and select Continue:

Select Windows 10 as the operating system, and select Continue – x64 is selected here as I’m 64 bit all the way:

Leave the virtual disk options and select Continue:

On the Summary Screen, you can use the Customize Settings button to change your VM defaults. I updated my RAM to 8GB, my CPU Cores to 2, and changed the VM Disk size to 100GB (60GB may be a bit small for most power users).

Before you start the VM; you’ll need to modify the vmx file directly.

In the Virtual Machine Library, right click on the Windows 10 VM and select Show in Finder.
Right click on the vmwarevm container and select Show Package Contents
Edit the *.vmx file using your favourite text editor
Append the following options to the configuration to enabled EFI booting:

firmware = "efi" efi.legacyBoot.enabled = "true"

The Legacy boot option allows VMWare to see the USB device in some cases; and was required for me.
Boot your new VM:

You’ll find that the new EFI boot loaders are picked up, but not yet the USB. Since you couldn’t attach a USB before starting, you can do it now. Open the VM preferences and attach the USB containing the EFI Boot files:

VMWare will now boot into the Windows 10 setup.

Thanks to a post by A Virtual Den for pointing me in the right direction for the VMX LegacyBoot option!

Attempt to Deploy Netflix Edda on Wildfly 8.x

Tech Debug — Wed, 08 Apr 2015 09:32:45 +0000

I’ve been trying to find a production platform for Edda, the Netflix OSS app for tracking AWS resources.

The application is written in Scala, which gets compiled as Java bytecode. The build toolset used by Netflix is gradle, and they deploy the application for testing into Jetty. Jetty can be used in a production environment, but the setup that comes with the build set with Edda is not really designed with a production server in mind. That said, a lot of people just end up running Edda by manually running up Jetty as a background process on a Linux box. Since I’ve been using Java application servers for quite a number of years (Websphere AS, Tomcat, Glassfish); I understand the need to run compiled Java web apps in production infrastructure. Therefore, I have been trying to find a reliable, OpenSource Java Web Application Server (WAS) to host Edda.

I’ve been thinking of trying out JBoss in the past, and the 8th major release of Jboss is now known as Wildfly, it seemed like a likely target for deploying Edda to.

The gradle build of Edda produces a WAR file, ready for deployment to a WAS. However, the war file from the gradle build won’t deploy by default on Wildfly, as shown with this error:

01:12:50,021 ERROR [org.jboss.as.server] (XNIO-1 task-10) JBAS015870: Deploy of deployment "edda-2.1.war" was rolled back with the following failure message: {"JBAS014671: Failed services" => {"jboss.undertow.deployment.default-server.default-host.\"/edda-2.1\"" => "org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host.\"/edda-2.1\": Failed to start service Caused by: com.sun.jersey.api.container.ContainerException: The ResourceConfig instance does not contain any root resource classes."}}

Edda uses Jersey (a standard and portable JAX-RS API) for RESTful Web services, but the WAR file won’t deploy properly with the servlets configured to use Jersey. This is due to the fact that Jersey is no longer a (default) option for JAX-RS web services on Wildfly. It comes integrated with RestEasy as the JAX-RS implementation instead.

Using RestEasy makes it necessary to change your Web.xml file because Jersey and RestEasy have different deployment configurations. This will likely to apply to any Wildfly 8.2 release, even though I’m using 8.2.0

The solution for Edda; is to modify the web.xml that gets built into the WAR file. I’ve committed the modification for web.xml to a branch on my fork of Edda. This solves the deployment issue when you try to deploy Edda as a WAR file into Wildfly.

Yet after all this; I can’t actually get Edda to work properly on Wildfly.

In the end I went for the good old Tomcat Java Web App Server, and Edda runs with an out of the box build.

ADFS2 is not always SAML 2.0 standards compliant

Tech Debug — Tue, 10 Feb 2015 04:26:26 +0000

Now the madness with ADFS2 SAML assertions via WS-Trust 1.3 – and how they are not valid for use with Amazon Web Services (AWS).

lexx:saml$ aws sts assume-role-with-saml --role-arn $role --principal-arn $principal --saml-assertion $assertion A client error (InvalidIdentityToken) occurred when calling the AssumeRoleWithSAML operation: Responses must contain SubjectConfirmatonData with a Recipient and NotOnOrAfter

This failed due to a missing Recipient attribute on the SubjectConfirmationData element. Of course; I can’t modify the assertion to add the missing Recipient; as the SAML token is signed:

Second fail is because I’ve modified the assertion to add the missing attribute; but now the signature is invalid.

When you get an assertion from the ADFS Identity Provider via the IdP Web Landing Page, for AWS, the assertion includes a “recipient”:

When you ask for an assertion from the WS-Trust 1.3 endpoint; it is missing:

Seems to be a common problem with ADFS2 whereby ADFS1 did it correctly. It’s not just me…

In the original SAML 2.0 Core spec – Line 725 – Recipient is an optional attribute in the SubjectConfirmationData element. However in subsequent errata for the specification, Errata 02 in May 2007, made it mandatory. Errata 05 still includes this requirement.

At lease one bearer element MUST contain a element that itself MUST contain a Recipient attribute containing the service provider’s assertion consumer service URL

Of course; Amazon adhere to the Standard:

The value of the Recipient attribute inside the SubjectConfirmationData element must match the AWS endpoint (https://signin.aws.amazon.com/saml)

It seems that ADFS2 doesn’t provide valid SAML 2.0 assertions issued via the WS-Trust 1.3 endpoint. Since this has been a standard since for almost 8 years, how does ADFS2 even claim to be standards based.

SAML assertion from ADFS2 via SOAP endpoint

Tech Debug — Sat, 07 Feb 2015 06:14:35 +0000

According to Wikipedia, Microsoft Active Directory Federation Services (ADFS) is:

… a software component developed by Microsoft that can be installed on Windows Server operating systems to provide users with single sign-on access to systems and applications located across organizational boundaries. It uses a claims-based access control authorization model to maintain application security and implement federated identity.

ADFS can provide Single sign as an identity provider to users, but what if a developer needs the same sign on outside of “browser land”? One option is to scrape webpage responses, but a better option is receiving a SAML Assertion using SOAP endpoints exposed via Microsoft ADFS, as long as they are enabled. You can use SOAP 1.2 with WS-A Addressing and mixed message security with the username/password in the SOAP headers secured over HTTPS, and get a valid SAML assertion.

There is Mex Endpoint (Anonymous by default) provided by ADFS2 or greater (if not disabled) at
https://youradfsserver.com.au/adfs/services/trust/mex
If you want to play with SOAP based claim requests, use a tool like SoapUI and consume the Mex endpoint as the WSDL. You can then construct Soap messages, and see if you get a valid response – which would contain an assertion.

The SOAP Endpoint for requesting a SAML token using WS-Trust 1.3 and mixed security would be
https://youradfsserver.com.au/adfs/services/trust/13/usernamemixed

The client credentials are included in the header of a SOAP message. Confidentiality is preserved at the transport layer (SSL/TLS); hence a usernamemixed endpoint.

Here is an example SOAP request for usernamemixed:

You can also use curl to post the soap request as shown:

Given all that; this actually won’t work for AWS; given ADFS2 actually breaks the SAML2.0 standards updated in 2012. Next post will detail this.

Is SNI viable?

Tech Debug — Thu, 04 Dec 2014 23:00:55 +0000

Traditionally if one was to secure a web server using TLS (or previously, SSL) – then one would configure your web server to use TCP port 443 to listen for TLS requests from clients (browsers). When a browser connects to the web server using the HTTPS protocol, the server would encrypt the communications and all would be well with the world.

A problem occurs when you use name based Virtual Hosting on your web server. If you need to determine the client request before providing content from a virtual host, e.g. blah.com vs. blahblah.com, then this couldn’t be done if you encrypted the communications using TLS. Enter stage left: Server Name Indication.

According to Wikipedia:

Server Name Indication is a feature that extends the SSL and TLS protocols. It permits the client to request the domain name before the certificate is committed to the server. This is essential for using TLS in virtual hosting mode.

I’ve a need to use Server Name Indication (SNI) for some freelance IT work I perform, but colleagues shy away from SNI since Internet Explorer on Windows XP is unsupported.

Is this an issue? Are so many people still on Windows XP that it will diminish the security aspects of implementing SSL to secure input of personal data ?

One of the best places to determine OS usage trends in Australia would be from Google, but they don’t provide such data. Therefore I turn to another source of data: StatCounter. They have been providing stats to websites and business for well over 10 years, so their data should be viable.

Source: StatCounter Global Stats – OS Market Share

The chart above shows Operating system usage for 2014 in Australia. Windows XP sits at 4 percent usage at the end of 2014. For an operating system that’s now unsupported and 4 Major versions old; it just shouldn’t be considered anymore.

Source: StatCounter Global Stats – Combine Chrome (all versions) & Firefox (5+) Market Share

The second chart shows browser usage statistics in 2014. Internet Explorer 6, which doesn’t support SNI, isn’t even on the chart anymore.

Knowing the actual statistics – the usage of Internet Explorer 6 (or a lesser version) and Windows XP seems to be so minimal that usage of SNI is a viable option; especially where it gives a rise to cost saving on implementation of x509 certificates on web front ends. What do you think?

Jive for Office 2013 64bit

Tech Debug — Thu, 20 Nov 2014 09:13:16 +0000

A client I’m consulting for is using Jive as their EDRMS of choice. It’s not bad; but after using Office 365 recently, Jive is not as integrated as you’d like with Office 2013.

Working in the cloud (Jive is a cloud EDRMS) requires that another client you may connect from have the appropriate client plugin. In the case of Office 2013, you need to install the Jive plugin from their community website. It’s not easy to find, but it can be found.

The first issue I hit after installing this is that the 64bit version of Office 2013 disabled the COM Add-In. This occurred using the Jive extension version 30.1.655.15760.

After digging around on the support community pages; there is a registry fix to make the plugin compatible with x64 office clients. The one provided was for Office 2011; so I’ve included here a modified registry file for Office 2013 64bit edition.

Steps to get the extension working are:

Uninstall the Jive for Office extension.
Import this registry file for windows:
Reinstall the JiveOfficeInstaller.msi

After that; success!

Jive extension now working in Office 2013 x64

Powershell: AWS and IAM policy retrieval

Tech Debug — Tue, 05 Aug 2014 07:19:43 +0000

I’ve recently been working more day to day on Amazon Web Services, and I found it a little unwieldy to navigate around policy documents assigned to IAM groups.

Sometimes you just want to have a local copy of the policies to edit/play with/look at.

Therefore, I came up with a quick script to solve this. Enjoy…
Of course, the AWS SDK for Powershell is required.

Podcast RSS Feed (XML file) not working on WordPress Site

Tech Debug — Fri, 06 Jun 2014 07:05:55 +0000

I host this blog in WordPress, and it’s a great micro CMS with all the bells and whistles. I also publish and host the XML file for a podcast of the Angry Human. It’s picked up by feed burner, and then iTunes takes the feed burner RSS feed and et voila! All the Apple listeners to the show Angry Human by David Biedny get their recent shows!

I recently had an issue where I’ve moved this site from Rackspace Cloud Sites to the Godaddy Managed WordPress sites. One of the things that was happening was the URI for the podcast XML RSS feed was returning as a 404 not found; even though it was there. Nothing I tried made this thing work, and nowhere could I find other people talking about RSS XML files published alongside wordpress not working. Even adding a new .htaccess file in the subfolder on the server to turn off URL rewrites did not work.

Another client I had recently worked with wanted some SEO optimisations, and we ended up implementing the awesome WordPress SEO plugin by Joost de Valk . One of the things I had noted about this plugin on the Godaddy hosting, was that the XML site map feature used to help bots index the site, was not working. We fixed this quite easily with a commonly known fix in the .htaccess file on the WordPress host.

I had not groked this similar error until an “Aha” moment when I realised an XML file, whether it be sitemap.xml or angryhuman.xml had been invoking the same rewrite error causing a 404 not found on a valid URI for a hosted file. Double checking and I had indeed implemented WordPress SEO plugin on this site.

The root cause: any self published XML file outside of the standard wordpress folders on a GoDaddy Managed WordPress Site – will return a 404 not found if you are using WordPress 3.9 and WordPress SEO by Yoast.

Therefore the fix in this case for my self published XML feed for Angry Human was adding this to the .htaccess:

Disk space Usage

Tech Debug — Thu, 20 Feb 2014 03:41:44 +0000

I came across a useful bash alias. I don’t know where. I’ll call it dureport.
alias dureport='du -sdk * | awk '\''{printf "%12d\t%s\n", $1, substr($0,index($0,$2),80)}'\'' |sort -r'

PowerShell to Configure BizTalk Server 2013 Host and Host Instances

Tech Debug — Tue, 21 Jan 2014 03:06:03 +0000

Everyone loves automated processes.

With BizTalk 2013 if you want to provide a repeatable install; you need automation. PowerShell is where it’s at.
Lucky for me, other very skilled people already have written PowerShell scripts providing the capability to create hosts and host instances. Sandro Pereira has written and published a PowerShell script to create your BizTalk host instances based upon the best practice of host separation. However, it’s only written for BizTalk 2010.

I’ve gone and modified it for BizTalk 2013. It provides the exact same capability, with BizTalk 2013 capabilities.
This includes new Receive Port Handlers:

SB-Messaging
SFTP
WCF-BasicHttpRelay
WCF-NetTcpRelay

And New Send Port Handlers:

SB-Messaging
SFTP
WCF-BasicHttpRelay
WCF-NetTcpRelay
WCF-WebHttp (the new adapter supporting REST)

The diff to the BTS2010 version from Sandro is:

You can grab my updated BizTalk 2013 script over at my BizTalk 2013 GitHub repository.

End of Microsoft Development?

Tech Debug — Mon, 20 Jan 2014 04:21:58 +0000

It has been a year from not blogging at all, due to a hectic professional schedule.

I’ve been busy dealing with BizTalk 2010, WCF services and all things SOA. One thing I’ve learnt is I’m not a hardcore developer. I’m much better at implementing technical solutions and server sysadmin. I think I’ll stick to that. In the meantime my knowledge and skill level with BizTalk has gone up now having almost 2 years experience developing, deploying and maintaining an ESB based around BizTalk 2010 and WCF services. It will be good to get back to Unix systems and Git source control instead of Wintel systems with TFS.

Microsoft Development

Tech Debug — Sat, 07 Jan 2012 13:05:41 +0000

I’ve started down the path of Darkness

In December 2011, I went on BizTalk training with @BizTalkBill and I’m now four weeks into the next stage of my career which is being an Microsoft “Integration Specialist”. You won’t find any open source in this realm, no ruby, nothing involving indie developers cracking out code until late at night.

What this change means is getting to know Visual Studio, BizTalk, SQL Server and all things Microsoft. It means using TFS, even though you really want to use Git. It means C# coding when you are familiar with interpreted languages like Perl, PHP and Ruby (I won’t be doing an ASP work).

That means you can expect going forward less posts about Unix, Clearcase (finally!) and Open Source platforms, and more about Microsoft offerings; specifically integration products.

Welcome to 2012.

Git on 10.04 Ubuntu LTS

Tech Debug — Tue, 06 Dec 2011 12:51:34 +0000

This is more for me than you, however if you need Git on Ubuntu 10.04 (LTS) try this. The commands I ran get the pre-packaged PPA Git working on Ubuntu 10.04:
sudo apt-get install python-software-properties sudo add-apt-repository ppa:git-core/ppa sudo aptitude update sudo aptitude safe-upgrade sudo aptitude install git

Apple iTMS TV show quality review

Tech Debug — Sat, 03 Sep 2011 04:18:29 +0000

This is an old review I wrote and never posted, but it’s still relevant today. My conclusion is up to date for 2011.

Having just purchased and watched seasons 1 and 2 of The Tudors from iTunes (I missed them on Showtime), I was searching the net for other peoples thoughts on the quality of these TV shows. One review I came across was from AllForces.com, concering iTunes quality vs Bit Torrent. Since their blog post in 2005, Apple seems to have upped the standard of their TV show offerings.

I’m be the first to admit that I’m an Apple fan, with my Mac laptop the primary downloader of these TV Shows, syncing to my iPhone and also viewing the shows via front row on my Mac Mini. It’s the viewing of these on the Mac Mini I will review.

For the review I was watching iTunes video files using the following:

2009 Model Mac Mini
Sony KDL-46W4500 1080p LCD Television
DVI to HDMI connection from Mac to TV, set at 720p resolution
Apples Front Row for playback, with the TV Shows sourced on a remote Mac Laptop over 54g WiFi

DRM

One of the things All Forces addressed was the DRM vs Bit Torrent downloads. Apple has come a long way since 2005 with their music, having the majority of the catalogue as “iTunes Plus”. This has their musical offerings in 256Kbps DRM free AAC audio. It’s an advancement since 2005, even though others offer better music quality.

There are still DRM restrictions in place for video, and I don’t see this abating any time soon. The TV and Movie industry is a lot less lenient to the removal of Digital Rights Management, and with Blu-ray winning the HD wars we wont see DRM removed from video any time soon.

Video Quality

One of the key points in the review by All Forces in 2005 was the low resolution of the iTunes video files. Quality of the TV episodes have increased since 2005, and Apple seem to be on a winner with H264 encoding. The files for The Tudors video files are 640×360 H264 encoded MPEG4 files, with an average size of 600MBytes per episode.

Pricing

In 2011 I also use an Apple TV. Pricing is a MAJOR sticking point with people using iTunes for TV Shows. In Australia they sell at AUD$2.99, only in standard definition, and only via the iTunes Store. In the US one can purchase HD versions for the same price or SD versions for USD$1.99. It’s ridiculous. You can’t even watch TV shows in Australia on Apple TV. Why?!

Conclusion

The quality of the iTunes show, as seen with The Tudors Season 1 is great. Apple have come a long way over the last 4 years to be able to offer all major TV shows as electronic downloads. Ease of access, and a decent price point makes it viable for consumers to use Apple as their source of entertainment. However, the disparate pricing across markets and the lack of HD shows in some countries is the final blocker to making iTunes your first and only stop for watching TV shows.