SkadeFro

App-V, Office 2010 and Ribbons

2012-01-03T12:40:00.001+01:00

Updated 4th Jan 2012: And that didn’t work once rolled out in production anyway. Back to the drawing board. :-(

~~I explained how to use SuperOffice inside Microsoft Application Virtualization client in a~~ ~~former blog post~~. What I didn’t mention was that since we did that, we had a annoying problem with that. Every time a user started Microsoft Word, they would get a popup saying “An error occurred and this feature is no longer functioning properly. Please run Setup and select “Repair…” to restore this application

I opened a Support Case at Microsoft and we have been troubleshooting this issue for several months and today we finally cracked it. Doing installation of SuperOffice they register an Office Add on and register some Office Ribbons. They have “messed” up the registry keys a bit thou. Some things are registered for Office 12 (office 2007) and some tings get’s registered for Office 14 ( Office 2010 )

doing sequencing, after installing SuperOffice,
export hklm\software\Wow6432Node\Microsoft\Office\12.0 and delete it.
replace \12.0\ with \14.0\ in the reg file, and import it.

Now word will function again.

ID3206: A SignInResponse message may only redirect within the current web application:

2011-12-21T00:04:00.001+01:00

I got a question in a remark on ADFS 2.0 and ASP.NET and wanted to do a post about it instead of trying to fit in code inside a remark too.

Sometimes you might see the above error. And I can understand why it can be frustrating at times, so ill try and clarify what it means.

You create a sign message and redirect the user to the ADFS/STS. The user logs in successfully and gets send back with a token, and now WIF on the webserver say’s “go away, you are trying to login with a token issued for another domain/application than me.

The key here is your return URL. When you add a Relying Party on your ADFS server, you specify a WS-Federation Passive Endpoint. Your return URL need to be within same scope as your WS-Federation Endpoint URI.

I have added the code I’m using now, and added a few comments. Should clear things up a bit.

Code Snippet
 ' basicly this tell adfs, to redirect the user onward to some other STS. For most people this should not be specified.
Dim HomeRealm As String = "urn:admin.wingu.dk"
 
'What Identity did we specify in the "Relying Party Trusts" on the ADFS server
'This has to also be listed in web.config under <microsoft.identityModel><service><audienceUris>
' or you will get ID1038: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris.
' This will most often be an URI, like https://admin.wingu.dk/SSI2 , but could also be an URN, like "urn:admin.website.ssi2"
Dim Realm As String = ("https://admin.wingu.dk" & Request.ApplicationPath & "/").ToLower
 
' Lets inspect and modify the Return URL
' If this falls out of scope from what you specefied under WS-Federation Passive Endpoint, when adding you
' Relying Party on the ADFS server, you will get 
' ID3206: A SignInResponse message may only redirect within the current web application: 
'
' Basicly, if you want several endpoints for you website. Like www.1.com and www.2.com or
' www.1.com/app1 and www.1.com/app1, add more Relying Party's, one for each.
' There is another way, maybe ill do a blog about that someday
 
Dim ReturnURI As New UriBuilder(ReturnUrl.ToLower)
' We need to use HTTPS, no matter what, so
ReturnURI.Scheme = "https"
ReturnURI.Port = 443
'I dont want to redirect back to my self. This can be ok in some sceenarios
If ReturnURI.Path.Contains("login.aspx") Then ReturnURI.Path = Request.ApplicationPath & "/"
' change localhost / computernamer or what ever, to the fqdn used on the ADFS to redirect back to
ReturnURI.Host = "admin.wingu.dk"
ReturnUrl = ReturnURI.ToString
 
Dim authModule As WSFederationAuthenticationModule = FederatedAuthentication.WSFederationAuthenticationModule
authModule.PassiveRedirectEnabled = True
Dim mess As WSFederation.SignInRequestMessage = authModule.CreateSignInRequest("passive", ReturnUrl, False)
 
mess.HomeRealm = HomeRealm
mess.Realm = Realm
Dim redirURL As String = mess.WriteQueryString()
Response.Redirect(redirURL)
 

SQL user does not use default schema

2011-12-14T15:20:00.001+01:00

So I was troubleshooting an installation of SuperOffice Customer Service. When running the installer it would fail with an ODBC driver error saying something down the line of “’config’ object not found” and you could see it was doing a “select count(*) from config”

I jumped over to the SQL server and saw that the SuperOffice SQL user did not have crm7 schema set as default schema and was not owner. So I chanced that, and tried again. I would still failed. So I open a new query in Management studio and did a “select * from config” .. that should work, but didn’t, I would still get no such object.

after goggling a while I decided to do a alter user, so opened the “help” page for “alter user” and voila, after reading the page I suddenly knew what was wrong.

The value of DEFAULT_SCHEMA is ignored if the user is a member of the sysadmin fixed server role. All members of the sysadmin fixed server role have a default schema of dbo.

The person who had installed superoffice had added the SQL user crm7 to the sysadmin role, and as you can see, that will break the schema role assignment. After removing the user from sysadmin, everything worked again.

Deploy CRM List Component though PowerShell

2011-10-23T13:58:00.001+02:00

as always I did a few searches on Google. Most hits just explained how to upload the WSP file and then call the AllowHtcExtn.ps1 script.

On blog did explain you could use Add-SPSolution and Install-SPSolution but that didn’t work for me.

$solution = Get-SPSolution crmlistcomponent.wsp
if(!$solution){ $solution = Add-SPSolution X:\SPS_2010_prov\listekomponent\en\crmlistcomponent.wsp }
Install-SPSolution -WebApplication "https://$webappurl" $solution -GACDeployment -Force

The solution didn’t show up in Solution Gallery inside SharePoint. And when I tested from CRM 2011 it kept complaining the List Component isn't installed.

I have just been to Microsoft Campus Days in Copenhagen ( kind of a “mini TechEd” ) and one of the session I was attending was about SharePoint Online and how Microsoft only allow Sandbox solutions, and then it hit me. Maybe the CRM list Component is a sandbox solution and needs to be deployed that way. We have a winner!

So we end up with

Write-Host "Starting Sharepoint User Code Service"
stsadm -o provisionservice -action start -servicetype Microsoft.SharePoint.Administration.SPUserCodeService -servicename SPUserCodeV4

Write-Host "Install crmlistcomponent if needed"
$solution = Get-SPUserSolution crmlistcomponent.wsp -Site "https://$webappurl" -ea 0
if(!$solution){ 
    $temp = Add-SPUserSolution X:\SPS_2010_prov\listekomponent\en\crmlistcomponent.wsp 
    $solution = Get-SPUserSolution crmlistcomponent.wsp -Site "https://$webappurl"
}

Write-Host "Active crmlistcomponent if needed"
if($solution.Status -ne 'Activated'){
    $solution = Install-SPUserSolution $solution -Site "https://$webappurl"
}

Write-Host "Make sure .htc file name extension is an allowed file type"
$app = Get-SPWebApplication -Identity "https://$webappurl"
$app.AllowedInlineDownloadedMimeTypes.Add("text/x-component")
if(!$app.WebFileExtensions.Contains("htc")){
    Write-Host "Adding .htc file name extension to the list of allowed file types."
    $app.WebFileExtensions.Add("htc")
    $app.Update()
}

Find owner of Fulltext catalog

2011-10-22T17:18:00.001+02:00

Once in a while I would get this error when dropping SQL logins

The database principal owns a fulltext catalog in the database, and cannot be dropped.

Changing the owner is easy enough, but I’m doing this by scripts and needed a way to find the owner of the fulltext catalog. Took a while but finally managed to get the result with

select cat.fulltext_catalog_id, cat.name 
    from sys.fulltext_catalogs as cat 
    inner join sys.database_principals as dp2 
    on cat.principal_id = dp2.principal_id

Perfect, so lets script that, and we get something like

$SQLLogin = 'soadmin_SOTEST2'
$sqlserver = 'sql01.int.wingu.dk'
$database = 'SO7_SO7SOTEST2'

$sql = "select cat.fulltext_catalog_id, cat.name from sys.fulltext_catalogs as cat "
$sql = ($sql + " inner join sys.database_principals as dp2 on cat.principal_id = dp2.principal_id ")
$sql = ($sql + "where dp2.name = '$SQLLogin'")

$rs = Invoke-Sqlcmd -ServerInstance $sqlserver -Database $database -Query $sql
foreach($row in $rs){
    $sql = ("ALTER AUTHORIZATION ON Fulltext Catalog::[" + $row.Name + "] TO dbo")
    Invoke-Sqlcmd -ServerInstance $sqlserver -Database $database -Query $sql
}

Working with SuperOffice though PowerShell

2011-10-10T18:13:00.001+02:00

This powershell snap in is not meant to be a complete SuperOffice client, but for most basic stuff you can use this. Like say, you want to run a batch job everyday to update/sync information's from anther system and SuperOffice

working with powershell makes a lot of things a lot easier. Lets have a look at a few examples

First lets connect to SuperOffice. If you have the superoffice.config from your client laying around somewhere you can easily connect using that.

$module = Get-Module | where {$_.name -eq 'wingu.SuperOffice.SnapIn'}
if($module -eq $null){ 
    $module = Get-Module -ListAvailable | where {$_.name -eq 'wingu.SuperOffice.SnapIn'}
    if($module){ import-module wingu.SuperOffice.SnapIn }
}

$config = Get-SO7config c:\superoffice.config | Set-SO7config
$config.Username = $config.Explicit.DBUser
$config.Password = $config.Explicit.DBPassword

So, just to validate everything is working, lets get the license information

$LicenseInfo = Get-SO7LicenseInfo
# To replace running license use
# Set-SO7LicenseInfo -CompanyName 'Happy Ducks Holding ApS' -SerialNumber '1234'
# To Update current license. ( like if you buy more user licenses )
# Set-SO7LicenseInfo $LicenseInfo

To see what credentials is associated with alz@sotest1.local and if he is logged on right now, you could so something like this

Get-SO7Person -email alz@sotest1.local | Get-SO7Credentials

Or to have a loot at who is using SuperOffice right now

Get-SO7Credentials | where {$_.CredentialType -eq 'Ticket' }

( this will not be accurate, since cleanup of ticket’s is only done when a user logs in. but still … )

Do you want a list of Persons asscociated with Contact ‘hestehøj a/s’ ?

Get-SO7Contact 'Hestejøj AS' | Get-SO7Person

Want to create a new Associate, with AD login ?

$logonName = 'alz'
$upn = 'alz@sotest1.local'
$FirstName = 'Allan'
$Lastname = 'Zimmermann'

# Get Associate if exists
$CRM7User = Get-SO7Associate -logonName $logonName -ea 0
# Get Person with email corrosonding to upn, if exists
$CRM7Person = Get-SO7Person -email $upn -ea 0
if((!$CRM7User) -and (!$CRM7Person)){
    # could not find a person nor Associate so create both
    $CRM7User = New-SO7Associate -FirstName $FirstName -Lastname $Lastname -logonName $logonName -Email $upn -AdUser
    $CRM7User = Get-SO7Associate -logonName $logonName -ea 0
    $CRM7Person = Get-SO7Person -email $upn -ea 0
}
if((!$CRM7User) -and ($CRM7Person)){
    # Person exists, but have no Associate so create it and link to person
    $CRM7User = New-SO7Associate -person $CRM7Person -logonName $logonName -Email $upn -AdUser
    $CRM7User = Get-SO7Associate -logonName $logonName -ea 0
}
# Assign a UserLicense, allow login, and enable Windows/web
$CRM7User | Enable-SO7Associate

Or, create with a CRM5 password (not ad login) ?

$logonName = 'alz'
$upn = 'alz@sotest1.local'
$FirstName = 'Allan'
$Lastname = 'Zimmermann'
$Password = 'Passw0rd'

# Get Associate if exists
$CRM7User = Get-SO7Associate -logonName $logonName -ea 0
# Get Person with email corrosonding to upn, if exists
$CRM7Person = Get-SO7Person -email $upn -ea 0
if((!$CRM7User) -and (!$CRM7Person)){
    # could not find a person nor Associate so create both
    $CRM7User = New-SO7Associate -FirstName $FirstName -Lastname $Lastname -logonName $logonName -Email $upn -Password $Password
    $CRM7User = Get-SO7Associate -logonName $logonName -ea 0
    $CRM7Person = Get-SO7Person -email $upn -ea 0
}
if((!$CRM7User) -and ($CRM7Person)){
    # Person exists, but have no Associate so create it and link to person
    $CRM7User = New-SO7Associate -person $CRM7Person -logonName $logonName -Email $upn -Password $Password
    $CRM7User = Get-SO7Associate -logonName $logonName -ea 0
}
# Assign a UserLicense, allow login, and enable Windows/web
$CRM7User | Enable-SO7Associate

anyway, here is a complete list of commands.

Get-Command -Module wingu.SuperOffice.SnapIn

Close-SO7Session
Decrypt-SO7H
Disable-SO7Associate
Enable-SO7Associate
Encrypt-SO7H
Get-MySO7Identity
Get-SO7Associate
Get-SO7Business
Get-SO7config
Get-SO7Contact
Get-SO7Country
Get-SO7Credentials
Get-SO7Email
Get-SO7LicenseInfo
Get-SO7Person
Get-SO7Secret
Get-SO7SystemInfo
New-SmartProcess
New-SO7Associate
New-SO7Business
New-SO7Contact
New-SO7Credentials
New-SO7Person
Remove-SO7Associate
Remove-SO7Business
Remove-SO7config
Remove-SO7Contact
Remove-SO7Credentials
Remove-SO7Email
Remove-SO7Person
Save-SO7config
Set-SO7config
Set-SO7LicenseInfo
Set-SO7Person

SharePoint and WebDAV–part 2

2011-10-08T15:31:00.001+02:00

So I was troubleshooting mapping SharePoint though WebDAV and found I had to open the SharePoint site though office in one way or the other, in order to successfully map it. That was true, but for one very specific reason.

Talking about cookies, you need to know there is 2 kinds of cookies. Session Cookies and Persistent cookies. Session cookies only “lives” as long as your browser is open. As soon as you close *ALL* your browser windows they cookie will expire. Persistent cookies will stay on your machine until the expire date on the cookie is hit.

When you setup SharePoint to use Claimsbased authentication SharePoint save a cookie on your machine called the “FedAuth” cookie. This is your what authenticate you every time you hit SharePoint. It gets set when the Identity Provider (STS/ADFS) makes your browser “post” your claims to https://fqdn/_trust/ .It gets removed when you click “sign out” or “Sign in as Different User”.

The WebDAV client, and various Office applications does support working with websites that facilitate Claimsbased authentication, but they cannot authenticate you. It assumes you have a FedAuth cookie on your machine. Some times you will get a browser popup, but there are places this wont happen (like with WebDAV). I had told SharePoint to use Session Cookies, since that would make more sense when working with SharePoint. You login you do your stuff, you might sign out, or you might close your browser. Next time you hit it, it asks you to login. I was happy, everyone else was happy. That is, until someone needed to work with SharePoint from within Outlook and though WebDAV.

SharePoint will standardly run with Persistent Cookies, but you can change this though PowerShell. Set UseSessionCookies to $true or $false. If you need to work with SharePoint though Office or WebDAV you need to set this to $false (default)

$snapin = Get-PSSnapin | where {$_.name -eq 'Microsoft.SharePoint.PowerShell'}
if($snapin -eq $null){ Add-PSSnapin Microsoft.SharePoint.PowerShell }

$sts = Get-SPSecurityTokenServiceConfig
$sts.UseSessionCookies = $false
$sts.Update()
iisreset

As far as I know, you cannot set this per site.

Next you want to make sure Office/Web Client can read the cookie. Referee to “Persistent cookies are not shared between Internet Explorer and Office applications”

First encounter with SuperOffice 7 PocketCRM

2011-10-05T18:08:00.001+02:00

Apparently some people inside the company I work for, have told some one else that I have had a bit of experience with SuperOffice. One of our SuperOffice consultants was troubleshooting a failed SuperOffice 7 PocketCRM installation, and needed some help getting it up and running. I have never seen that product but I never back down from a good challenge.

The first thing I noticed when logging on to the server, was that SuperOffice web was installed, and didn’t work. If you browsed the local website, no matter what you wrote you would just get an HTTP 404 file not found. The weird thing was the error came from a Tomcat server and not IIS. I did a net stat –ano to see if Tomcat had “stolen” port 80, but that was not the case. After looking around a bit inside IIS, I noticed there was added an ISAPI filter pointing to a DLL inside the tomcat directory. After removing that entry, IIS worked again, and we could login to SuperOffice web.

But now Pocket CRM wasn’t working. Knowing that the ISAPI DLL was “eating” all web request, I decided to created a new website and added the ISAPI filter to that website, and I also added a virtual directory pointing to Jakarta as it had been doing on the original website. browsing to the new website’s /dl I would now be presented with the option to download the pocket CRM client. We tested if we could login from a client, but had no luck. After several different test’s we managed to get an error from the client saying it couldn’t connect to http://fqdn/NetServer/soPrincipal . I ran the installer for SoWeb and created a new NetServer installation on the main website (the one with SoWeb) with a virtual directory called /NetServer. Ran config and we tested the CRM Pocket client again.

Now we would just get login failed, no matter what. I enabled logging on the NetServer installation, but it wouldn’t generate any log.

<SuperOffice>
  <Diagnostics>
    <add key="LogError" value="True" />
    <add key="LogWarning" value="True" />
    <add key="LogFailureAudit" value="True" />
    <add key="LogSuccessAudit" value="True" />
    <add key="LogInformation" value="False" />
    <add key="LogToFile" value="True" />
    <add key="LogFolder" value="c:\temp" />
  </Diagnostics>
</SuperOffice>

Weird. I opened visual studio on my own machine, added a reference to the above server and created a small test application

    Sub Main()
        Dim WS As New ServiceReference1.SoPrincipalClient
        Dim Password As String = "secret", UserName As String = "user"
        Dim Succeeded As Boolean, TimeZone As ServiceReference1.SoTimeZone, Response As ServiceReference1.SoPrincipalCarrier
        Dim AuthenticationSucceeded
        Dim Credentials As ServiceReference1.SoCredentials
        Dim WsClient As test.ServiceReference1.SoExceptionInfo = WS.AuthenticateUsernamePassword(Password, UserName, _
               Succeeded, TimeZone, Response, AuthenticationSucceeded, Credentials)
        Console.WriteLine("Succeeded: " & Succeeded)
        Console.WriteLine("AuthenticationSucceeded: " & AuthenticationSucceeded)
        If Credentials Is Nothing Then
            Console.Write("Credentials is nothing")
        Else
            Console.Write("Credentials Ticket: " & Credentials.Ticket)
        End If
        Dim s As String = ""
        Console.WriteLine("done.")
        Console.ReadLine()
    End Sub

I cant re-generate the error message, to show here on the blog, but it said something about about not being able to bind the web service to port “http”. I have seen that error before so I opened web.config and added

<system.serviceModel>
   <serviceHostingEnvironment multipleSiteBindingsEnabled="true" /> 
</system.serviceModel>

After that I could now successfully authenticate to the NetServer, so we went back to the SuperOffice client. Same stuff, Client would say “authentication failed” and NetServer was net generating any log.

I went back to my application and wrote a wrong username and password. a log file was created. I delete the logs, chanced username/password to some valid credentials and ran the application again. no log file got generated … So seems SuperOffice has a bug and isn't logging successful logins when told too. We did the same test from the PocketCRM client, and saw the same thing happen. It would log when typing wrong username and password, and no log when we typed valid credentials. But the client kept saying “authentication failed”

After enabling debug logging inside tomcat I noticed PocketCRM wasn’t talking with NetServer though Tomcat, so I had the weird idea that maybe the PocketCRM application inside Tomcat didn’t talk with the correct NetServer

After looking though different files, I found \SuperOffice\SuperOffice 7 Server\Modules\PocketCRM\Tomcat 6.0\webapps\#pocketcrm\WEB-INF\classes and saw the NetServer URL was wrong. I changed it, and restarted PocketCRM, and voila. Everything worked.

Managing CRM 2011 with powershell

2011-10-02T21:07:00.001+02:00

I see a lot of hits from search engines where people are searching for stuff related to Microsoft CRM 2011 and powershell. So I decided to upload the snap in a wrote about, a few months ago.

The problem with CRM 2011 is that the powershell commands that comes with CRM 2011 only works on the local machine. but even worse, you can do anything from the commands except doing basic configuration of the installation it self. obvious stuff like adding users and changing roles isn't supported.

So here is a PowerShell Snap in (works as module too) that does exactly all that. It works on any machine that have .NET 4.0 and powershell 2.0 installed. Just copy the \debug folder to C:\Windows\System32\WindowsPowerShell\v1.0\Modules\CRM2011.Module open powershell and type “import-Module CRM2011.Module” and your ready to rock.

Add-CRMUserRole
Disable-CRMSystemUser
Enable-CRMSystemUser
Get-CrmLanguage
Get-CrmOrganization
Get-CrmOrganizationLanguage
Get-CrmRole
Get-CRMSystemUser
Get-CRMSystemUserSettings
Get-CRMUserRole
New-CRMCustomerAdminRole
New-CrmOrganization
New-CrmOrganizationLanguage
New-CRMSystemUser
Remove-CrmOrganization
Remove-CrmOrganizationLanguage
Set-CrmOrganization
Set-CRMSystemUser
Set-CRMSystemUserSettings
Update-CRMSystemUser

Getting output from process spawned from powershell

2011-10-01T23:05:00.001+02:00

Updated 02-10-2011: Fixed a small bug that could make SmartProcess consume 100%
There is several ways you can spawn a new process from within PowerShell. Start-Process for instance. If you create a new object of type System.Diagnostics.Process or call Start-Process and get such an object back, you can now get access to the Standard Input/Standard Output … there is a “catch” thou. These only get updated every time the process sends a complete line including a newline.

So lets say you spawn nslookup and want to catch every time i t expects input, it wont work.

function StartProcess([String]$FileName){
    $process = New-Object "System.Diagnostics.Process" 
    $startinfo = New-Object "System.Diagnostics.ProcessStartInfo" 
    $startinfo.FileName = $FileName
    #$startinfo.Arguments = $arguments 
    #$startinfo.WorkingDirectory = $pwd.Path 
    $startinfo.UseShellExecute = $false
    $startinfo.RedirectStandardInput = $true
    $startinfo.RedirectStandardOutput = $true
    $startinfo.RedirectStandardError = $false
    #$startinfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden 
    $startinfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Normal

    $process.StartInfo = $startinfo 
    $temp = $process.start()
    return $process
}

function GetPrompt([System.Diagnostics.Process]$process, [Int]$waitSec){
    $str = ''
    $i = 1
    while( (!([String]$str).contains("> ")) -and (!$process.HasExited) -and ($i -le $waitSec) -and ($process.StandardOutput.Peek() -eq -1) ){
        # Write-Host ("Peek: " + $process.StandardOutput.Peek())
        while($process.StandardOutput.Peek() -ge 0){
            $iChar = $process.StandardOutput.Read()
            $str = ($str + [Convert]::ToChar($iChar))
        }
        if(!([String]$str).contains("> ")){ Write-Host "."; Start-Sleep -s 1; }
        $i = $i + 1
    }
    return $str
}

if($true){
    #[void] [System.Reflection.Assembly]::LoadWithPartialName("'System.Windows.Forms")
    #[System.Windows.Forms.SendKeys]::SendWait("skadefro.dk")

    if(!$process.HasExited){ Write-Host "Killing process"; $process.kill(); $process.StandardOutput.ReadToEnd() }
    $process = StartProcess 'nslookup'
    GetPrompt $process 2
    $process.StandardInput.WriteLine('set q=MX')
    GetPrompt $process 2
    $process.StandardInput.WriteLine('skadefro.dk')
    $process.StandardInput.Flush()
    #$process.StandardOutput.ReadToEnd()
    GetPrompt $process 2

}
if(!$process.HasExited){ $process.kill() }

So you could write some code and hook up to the ErrorDataReceived and OutputDataReceived events. but those have the same problem, so you need to dig a bit deeper. You need to take each stream object and hook up to BaseStream.BeginRead

So that is what I have done. Inside my SuperOffice Add in I have added a new command called New-SmartProcess

And now the above code will look cleaner and actually work

function WaitForPrompt([wingu.SmartProcess]$process, [Int]$waitSec){
    $str = ''
    $i = 1
    while( (!($process.StandardOutput.contains("> ")) -and (!$process.HasExited) -and ($i -le $waitSec))){
        if(!([String]$str).contains("> ")){ Write-Host "."; Start-Sleep -s 1; }
        $i = $i + 1
    }
    return $str
}

if($process){ if(!$process.HasExited){ Write-Host "Killing process"; $process.kill(); $process.StandardOutput.ReadToEnd() } }
$process = New-SmartProcess 'nslookup'
WaitForPrompt $process 2
$process.StandardOutput
$process.StandardOutput = ''
$process.WriteLine('set q=MX')
WaitForPrompt $process 2
$process.StandardOutput
$process.StandardOutput = ''
$process.WriteLine('skadefro.dk')
WaitForPrompt $process 2
$process.StandardOutput
$process.StandardOutput = ''
if(!$process.HasExited){ $process.kill() }

You can find my SuperOffice PowerShell snapin inclucing Source code here

Installshield MSI Multiple Instances

2011-09-30T18:05:00.001+02:00

While working on automating installation of SuperOffice Customer Service (formerly known as eJournal ) I ran into a few issues. I started with just copying all files and changing configuration files but it didn’t quite do the trick. Doing installation of Customer Service it also install's 2 Windows Services and scripting that would just not be worth it, so I decided to see if I could control the installer instead.

If you have installed SuperOffice Customer Service once, the next time you call SuperOffice.CustomerService.exe you will get a prompt to either create a new instance or modify an existing installation

I’m no expert on MSI installers, but I did some digging around and it seems the way they get that to work, is doing some Transform scripting inside the installer. (that’s why it is an exe and not an MSI )

The first thing I did was extract the MSI and have a look at the properties in the installer so I could pass on the correct parameters. but when I called MSIEXEC with the SMI, I would get all kinds of different errors. (makes sense now ). After a lot of goggling I found that I could control the instance by number, by adding /Instance= to the .EXE … test that I created a couple in instances like this

SuperOffice.CustomerService.exe /instance=1 /V"EJHOSTNAME=servicesotest1.so7.wingu.dk INSTALLDIR=C:\servicesotest1.so7.wingu.dk /L*v c:\1.log /passive"
SuperOffice.CustomerService.exe /instance=2 /V"EJHOSTNAME=servicesotest2.so7.wingu.dk INSTALLDIR=C:\servicesotest2.so7.wingu.dk /L*v c:\2.log /passive"

And uninstalling

SuperOffice.CustomerService.exe /x /instance=1 /V" /L*v c:\1.log /passive"
SuperOffice.CustomerService.exe /x /instance=2 /V" /L*v c:\2.log /passive"

so I though that would be awesome, I could just pass on my CustomerService ID as Instance Name and everything would be perfect. But no … if I pass on a number higher than 1000 I fails and doesn’t work, so I had to do some more digging. I decided to see if I could emulate all the instance numbers and find a “free” instance number when installing, and the same, when uninstalling and look at install location.

I came across this neat little PowerShell Snap In/Module to get information about installed software. but you can also get all the information with WMI if you prefer that kind of stuff

$programs_installed = @{};
$win32_product = @(get-wmiobject -class 'Win32_Product' )
foreach ($product in $win32_product) {
    $product | fl
    # $product.InstallLocation
    $name = $product.Name;
    
    $version = $product.Version;
    if ($name -ne $null) {
        $programs_installed.$name = $version;
    }
}

So now I can easely get a list of installed instances including my “instance number” by running

Get-MSIProductInfo -Name 'SuperOffice Customer Service' | fl ProductName, ProductCode, InstallLocation, PackageCode, InstanceType, Transforms

For a complete list, do

Get-MSIProductInfo | fl AuthorizedLUAApp, InstallContext, InstalledProductName, Language, Name, PackageCode, PackageName, ProductIcon, Transforms, Version, CollectUserInfo, Equals, GetComponentState, GetFeatureState, GetHashCode, GetType, ToString, PSPath, Item, AdvertisedLanguage, AdvertisedPackageCode, AdvertisedPackageName, AdvertisedPerMachine, AdvertisedProductIcon, AdvertisedProductName, AdvertisedTransforms, AdvertisedVersion, Context, Features, HelpLink, HelpTelephone, InstallDate, InstallLocation, InstallSource, IsAdvertised, IsElevated, IsInstalled, LocalPackage, PrivilegedPatchingAuthorized, ProductCode, ProductId, ProductName, ProductVersion, Publisher, RegCompany, RegOwner, SourceList, UrlInfoAbout, UrlUpdateInfo, UserSid, Advertised, Installed, V1, AssignmentType, DiskPrompt, InstanceType, LastUsedSource, LastUsedType, MediaPackagePath, ProductState, VersionMajor, VersionMinor, VersionString

So to wrap it all up ….

function InstallSuperOfficeCustomerService([String]$fqdn){
    $InstanceID = 0
    #$AllreadyInstalled = Get-MSIProductInfo -Name 'SuperOffice Customer Service'
    $AllreadyInstalled = @(get-wmiobject -class 'Win32_Product' ) | where {$_.Name -eq 'SuperOffice Customer Service'}
    if($AllreadyInstalled){
        # add 1, to avoid getting "default" instance, and check if its free
        $InstanceID = $InstanceID + 1
        $isFree = $AllreadyInstalled | where { $_.Transforms -eq ":InstanceId$InstanceID.mst" }
        # If not free, loop til we find one unused
        while($isFree){
            $InstanceID = $InstanceID + 1
            $isFree = $AllreadyInstalled | where { $_.Transforms -eq ":InstanceId$InstanceID.mst" }
        }
    }
    if(! (Test-Path 'c:\CustomerService')){ $temp = New-Item 'c:\CustomerService' -type directory }
    # replace /passive with /qn to hide the UI
    $parameters = "/instance=$InstanceID /V""EJHOSTNAME=$fqdn INSTALLDIR=C:\CustomerService\$fqdn /L*v c:\CustomerService\install-$fqdn.log /passive""" 
    # Write-Host ("X:\SuperOfficeInstall\Customer Service 7.0 SR2\SuperOffice.CustomerService.exe " + $parameters)
    $installStatement = [System.Diagnostics.Process]::Start( "X:\SuperOfficeInstall\Customer Service 7.0 SR2\SuperOffice.CustomerService.exe", $parameters ) 
    $installStatement.WaitForExit()
}

function UnInstallSuperOfficeCustomerService([String]$fqdn){
    # now i could look though the instance number and call it with 
    # SuperOffice.CustomerService.exe /x /instance=$InstanceID /V" /L*v c:\$InstanceID.log /passive"
    # but instead i'll play it safe and use the ProductCode
    
    #$isInstalled = Get-MSIProductInfo -Name 'SuperOffice Customer Service' | where {$_.InstallLocation -like "*$fqdn*" }
    $isInstalled = @(get-wmiobject -class 'Win32_Product' ) | where {($_.Name -eq 'SuperOffice Customer Service') -and ($_.InstallLocation -like "*$fqdn*")}
    if($isInstalled){
        # replace /passive with /qn to hide the UI
        # $ProductCode = $isInstalled.ProductCode
        $ProductCode = $isInstalled.IdentifyingNumber
        $parameters = "/x $ProductCode /passive /L*v c:\CustomerService\uninstall-$fqdn.log "
        # Write-Host ("msiexec " + $parameters)
        $uninstallStatement = [System.Diagnostics.Process]::Start( "msiexec", $parameters ) 
        $uninstallStatement.WaitForExit() 
    }
}

function IsSuperOfficeCustomerServiceInstalled([String]$fqdn){
    $isInstalled = @(get-wmiobject -class 'Win32_Product' ) | where {($_.Name -eq 'SuperOffice Customer Service') -and ($_.InstallLocation -like "*$fqdn*")}
    if($isInstalled){
        return $true
    } else {
        return $false
    }
}

InstallSuperOfficeCustomerService 'deleteme4.domain.com'

UnInstallSuperOfficeCustomerService 'deleteme4.domain.com'

IsSuperOfficeCustomerServiceInstalled 'deleteme4.domain.com'
IsSuperOfficeCustomerServiceInstalled 'deleteme5.domain.com'

SharePoint 2010 and WebDAV

2011-09-30T16:04:00.001+02:00

Updated 08-10-2011: Please see update here

I have known for sometime that SharePoint supports WebDAV, and in my experience, you always end up spending a few hours getting it to work. Today was no different.

A collogue of mine sent me an email complaining he couldn’t connect to he's SharePoint 2010 site in explore or use the Explorer View button within the site. "Open with Explorer”

I knew I had seen it work in the past but for some reason I couldn’t get it to work for me neither. I tried everything but no matter what I just kept getting an annoying “Your client does not support opening this list with Windows Explorer”

And when connecting with “net use * https://blah.blah” I would constantly get

System error 224 has occurred.

Access Denied. Before opening files in this location, you must first add the web site to your trusted sites list, browse to the web site, and select the option to login automatically.

there is a billion hits on Google searching for this, but one of the more interesting was a White paper on Microsoft.com - Understanding and Troubleshooting the SharePoint Explorer View but it didn’t really get me any further.

I’m using Claimsbased authentication on all SharePoint sites, so I started thing it had something to do with that. I found this post, that claims you cannot connect to SharePoint if it using Forms based authentication / Claimsbased authentication. But then I test on my local computer where I also SharePoint installed configured to use Claims too, and that works. This was starting to be really annoying

God know how, but then I cam across this post. Note that he writes:

The Open with Explorer and the new Upload Multiple seems to depend on Office 2010 being installed.

So I was clicking around inside SharePoint as a maniac and at one point I hit the “Connect to Office” button, and suddenly it worked.

I instantly opened a DOS prompt and tried “net use * https:\\blah” and it worked too.

So while writing this blog post, I created a new SharePoint site with English language instead of Danish to make some better screenshots. And clicking Connect to Office just didn’t seem to be enough, so I started looking at the differences between the Danish site and the English site. 2 things where different. I normally don’t enable Anonymous Access, but I had done that on the Danish site.

And I normally don’t enable Basic authentication, but I had here.

Still nothing. This was driving me nuts now …. so I started clicking around like a maniac again, and BAM suddenly it all worked again. What the hell ???

Now I was getting mad. I created a new site ( Basic authentication disabled, and Anonymous Access disabled like normal ). View in Explorer fails as expected. I click the “Datasheet View”

And after that everything suddenly works. I guess the trick here is making sure Office have “talked” with the SharePoint site in some way or the other.

What a waste of a few good hours I will never get back …

I make mistakes, but I’m never wrong.

2011-09-28T04:40:00.001+02:00

This will not be a technical blog post, so if you’re not in too all this insightful feelings stuff, close your browser now.

I do a lot of coding, but I’m not a developer. I do a lot of system installation and configuration, but I’m not a System Administrator. I do a lot of system designs but I’m not a system architect. So what am I? People who have known me for a while will know I would describe myself as a very talented bug finder and troubleshooter. I’m also very stubborn both in a good way and in a bad way. So let’s have a look at how “I can be oh so wrong” and make a complete fool out of my self :)

I was asked to try and implement SuperOffice 7 in the hosting environment I’m working on. As always, we had known for quite a while this was something we would need to get working, but when I finally got the assignment I had less than a week to get something up and running, because we had a potential new customer that wanted a solution NOW! (Why is it always like that?)

So I asked for the installation media and created a proof of concept installation. It had a few errors and flaws but in general I was convinced I could get this up and running. I prefer automating everything I do, while I’m doing it, to make it easier to reestablish the environment and to “catch” whatever problems I will run into, when I need to automate it anyway, once we have to go into production.

So after 4 days I had the following issues, in order to give the final go on my solution.

I couldn’t automate the process of creating a new blank SuperOffice database
I couldn’t get SuperOffice to start up inside App-V but was working fine on my test servers and deployment machine, so was convinced this would be easy to solve.
While I was converting my ugly PowerShell scripts to PowerShell CmdLet’s I noticed it was using insane amounts of memory that I was worried would impact the performance of the provisioning engine.

Except the creating of the SuperOffice database everything was automated so a Support case was opened on the 2 upper problems. While testing and trying out different things I noticed something funny in my PowerShell snap in. Sometimes I would get the same error message “Failed to create Identity from tokens” as I got on the SuperOffice client . While digging in a little deeper I realized that I really hadn’t done my homework properly. The NetServer API SuperOffice offers to .NET developers doesn’t allow you to “swap” between databases and the only way to work around that would be to place the code inside different AppDomains and I had never tried coding something that used different AppDomains. I hated that, and started getting frustrated at SuperOffice, which was completely wrong of me for 3 good reasons. For one they had a valid reason for making that choice, and two I learned a lot of new exciting stuff about working with AppDomains that I know will be useful to me in other cases and lastly. Being able to unload all the SuperOffice stuff from within the memory space of the provisioning engine, also solve one of the 3 problems mentioned above.

So 1 weeks passes and I just can’t “crack” the problem with the SuperOffice client and SuperOffice wasn’t helping us out a lot, on the case. I could reproduce the error in almost any environment ( Windows 7, Windows 2008, and Windows 2008 R2 servers. From 32 and 64 bit. With and without App-V. With or without being run from Remote Desktop or XenApp desktops. I tried using SQL 2005, SQL 2008 and SQL 2008 R2 servers … nothing would work for me, but everyone I talked with kept saying “but it works for me, no problem. It sure sounds weird” ) , so a colleague put me in touch with a partner we use when implementing SuperOffice at other customers. They solved the database problem in a few hours and we sat down and went through the whole setup to see if we could figure out what I was doing wrong in regard with the SuperOffice Client. While showing my approach for different things they were complaining a lot. I wasn’t doing things the “SuperOffice” way. I refused to use “CRM5” as Schema prefix and insisted on keeping DBO as owner on all objects (will give problems when working with 3rd party add-ons). I used a controversial way of loading SuperOffice by using inipath as start parameter instead of keeping the configuration inside the SuperOffice client installation folder ( will give problems with reporting, office add-ons and 3rd party add-ons). And I refused to add the user’s as SQL users in the database. ( Remember, I am stubborn. and I had read somewhere you didn’t need to do it. ) Any way, he suggested I added the users ( as windows users ) to the database and BAM, everything worked, I mean everything. I was so embarrassed. Anyone who have worked with SuperOffice know this is how you do things, and people had been telling me nonstop since I started on this project I had to remember this. But I was so convinced this was not needed, but I couldn’t remember where I had read it. I just made sense to me, why add the user, when SuperOffice already had a username/password from the superoffice.config . And the NetServer API worked flawlessly without doing that. We had even priced the product to not include an SQL CAL for each user.
So Just be sure I sent an email to a contact within SuperOffice asking him to confirm, that this had been my problem all along. The reply I got wasn’t quite what I had expected. He told me I was correct, users do not need access to the database and the problem was with the ODBC DSN links I had created. I was about to explode at that point. I felt I was bouncing back and forward all the time and getting nowhere. I mean there is only one way to create a DSN link, you choose an ODBC provider fill in server and database and you are done. How freaking hard can it be.

Moving on, we decided to stick with adding the users to database and just be done with it. While restoring a customer’s data from one SuperOffice database too another we started getting some access denied messages. As always my first tool of choice to trouble shoot SQL problems, was opening SQL Profiler and look at what was going on. I noticed dbsetup.exe was executing half the queries as the windows user we were logged on as, and not the SQL login it was being told to use. The Support Technician from SuperOffice say; as it was the most natural thing in the world “Did you remember to set the DSN connection to use SQL login” ?

God . If I hadn’t already felt dumb enough as it was, that sure did the trick. Why, oh why hadn’t I opened the freaking SQL profiler a long time ago while trouble shooting the client problems ? Why didn’t I listen when SuperOffice told me to check the DSN connection ?

If you look at this screen shot. Since the username and password doesn’t get saved, but it affects the “test” button at the end of the wizard, I have always assumed this only affected the test in the end. But that is defiantly not the case. If you leave it as show, it will add a “Trusted_Connection” entry in registry with the value of “yes”. If you change the radio button down to SQL Authentication it doesn’t add that registry entry, or it changes the value to “no”

Most connection strings I have worked with have always had Trusted Connection=yes. I generally try and avoid using SQL login when I can (but it can be useful in some cases) What happens in the case of SuperOffice is, they don’t specify that when they connect using the DSN, and therefor “inherits” whatever setting you choose in the wizard. That can be quite handy, and confusing at the same time. But it means that even thou SuperOffice send a username and password, it gets ignored if Trusted_Connection is set to yes, flip it back to SQL and it will now connect using the username and password SuperOffice sends with it.

Anyway . . .So I went back and changed all my code and scripts to create the DSN links with Trusted_Connection set to “no” and removed the all users from the Windows group I had created to give users access to databases and everything worked like a charm. So now we don’t need to bill all users for an SQL CAL, but only one CAL per SuperOffice installation.

Who would have guessed, not only do I make mistakes I can also be wrong.

SuperOffice 7 Web and SO_ARC on different servers

2011-09-26T20:22:00.001+02:00

I’m playing around with SuperOffice 7 web. I’ve managed to automate the process of creating separate websites per SuperOffice instance, but after the initial setup I started getting some weird errors.
I’m far from, done with all this, and I defiantly don’t know everything I need to know to make all this work, but I’m taking things as they come.

When downloading files, I would get errors like

My first though was I hadn't escaped the file path properly.
When setting up SuperOffice web I found that these 4 files needs to be updated
~\bin\Reporter\SoReporter.Executer.exe.config
~\bin\BatchService\SoBatchService.exe.config
~\bin\Reporter\SuperOffice.CONFIG
~\Web.config
I modified my SuperOffice PowerShell snap in to support loading all files and changing the content, to make it easier for me while automating the process.

In the above error the SO_ARC is places on \\fs01\Customers\SOTEST2\APPS\SO7\SO_ARC so that’s what I had in SoBatchService.exe.config, SuperOffice.CONFIG and Web.config. … I escaped the string with $SO_ARC = $SO_ARC.Replace("\", "\\") … Provisioned the website and tried again.

Still now luck, so open Process Monitor and look what's going on …. AAHHH!

That’s weird, I specifically set the credentials I want it so connect as and yet its accessing the files as IUSR …

    <Documents>
      <!-- Location of SO_ARC -->
      <add key="ArchivePath" value="\\\\fs01\\customers\\SOTEST2\\APPS\\SO7\\SO_ARC" />
      <!-- Location of template folder.
                    This folder only needs to be specified when it is other than default. -->
      <!--<add key="TemplatePath" value="\\\\qa-build\\StateZeroSoArc\\Template" />-->
      <!-- Location of temporary folder for streaming files.  
                    This path must resolve to the same location for farms/culsters. -->
      <add key="TemporaryPath" value="c:\\temp" />
      <!-- Impersonate user when accessing the document archive or the temporary folder  -->
      <add key="ImpersonateUser" value="False" />
      <!-- Name of the user to impersonate with -->
      <add key="ArchiveUser" value="soadmin_SOTEST2" />
      <!-- Password of the user to impersonate with -->
      <add key="ArchivePassword" value="SuperSecret" />
      <!-- Domain of the user to impersonate with -->
      <add key="ArchiveDomain" value="INT" />
      <!-- Size of internal buffer in KB -->
      <add key="BufferSize" value="32" />
    </Documents>

Ah well, no worry, I modified my script to create an application pool with a domain account and set the websites anonymous account to run as the application pool.

# Set application Pool identity
Set-ItemProperty ('IIS:\AppPools\' + $InstanceName) -name processModel -value @{userName=($ADDomainName + '\' + $SOAdminUser);password=$SOAdminPassword;identitytype=3}
# Set Application Pool Identity as Anonymous User 
Set-WebConfigurationProperty -filter /system.webServer/security/authentication/anonymousAuthentication -name userName -value "" -PSPath IIS:\ -location ('IIS:\Sites\' + $InstanceName)

And now it works… Guess that is a bug, or I don’t understand the parameters well enough.

And tonight I’m going to throw some love at reporting … Every time I try and generate a report I get this error in the browser after a minute’s time.

Updated 27-09-2011: Problem solved. First of all, I had forgotten to create the DSN link. But it still failed.
There was no error messages being generated anywhere, so I fired up process monitor and had a look. And sure enough, SoReporter.Executer.exe was getting access denied creating so_log.txt, so I gave the application poll write permissions in the /bin and had a look. After doing that, every time I tried generating a report, instead of getting the above error I would know be logged out of the website. hmmm, strange …

After looking at some of the warnings in the normal log files I started to wonder if “Failed to parse Assembly 'Edanmo.OleStorage, Version=1.0.847.22469,Culture=neutral,PublicKeyToken=8840063030bd4bce'.” had something to do with this so began looking more into errors after finding DLL files. Edanmo.OleStorage quickly lead me to MsgReader – DLL . I bet they chanced something in the code and was not in the mode for reflector, but since I know now I had something to do with mail I remembered seeing something in the above config files

    <Factory>
      <DynamicLoad>
        <add key="DefaultSoMail" value="C:\Program Files\SuperOffice\SuperOffice 7 Web\SuperOffice\bin\SoMail.dll" />
        <add key="SaleImpl" value="SuperOffice.Sale.Services.Implementation.dll" />
        <add key="ProjectImpl" value="SuperOffice.Project.Services.Implementation.dll" />

Now, I know that is not right. I remember thinking the first time I saw it, that I couldn’t harm pointing at the “wrong” directory. the DLL was there too … but I know better than that. so just for fun I went though all the config files mentioned above and removed the path

        <add key="DefaultSoMail" value="SoMail.dll" />

Love and be hold. We have a winner …. Now I can generate reports.
I modified my provisioning scripts, deleted everything and created all from scratch ( to fix permissions, things I had chanced in config files etc. ) and re-tested and it still works .. so that is the fix …

Hosting SuperOffice 7 on Citrix/RDP

2011-09-25T18:39:00.001+02:00

I have been spending a lot of time looking into SuperOffice 7 the last few weeks, preparing automatic provisioning and hosting of SuperOffice 7. I want to briefly talk about some of the issues I ran into, and how I worked around them to get a working environment up and running.

SuperOffice can work in a 2-tier solution with a SQL database on a server somewhere and a fat client installed on a client computer. In this solution when SuperOffice is started it load its configuration from the installation directory (C:\Program Files (x86)\SuperOffice\SuperOffice 7 Windows)
SuperOffice can also run as a Web Client in a semi 3-Tier solution. You have your database on some severe, you have a Webserver running 1 or more websites, each website with it’s own configuration file(s).

From a hosting perspective that means you would prefer the web approach, but not everything in SuperOffice works from the web client. And, for now, some of the administrative tasks cannot be done though the web interface either. Many 3rd party add-ons for superoffice is not designed to work from the web client either.

In a hosting environment with Citrix/Remote Desktop servers is sometimes installed as dedicated per customer, and sometimes installed in a “shared hosting” environment where different customers facilitate the same farm of server. If customers have their own servers, keeping the configuration files in a single location shouldn't post any problems, but in a shared environment you don’t want different users from different customers being able to only talk with 1 SuperOffice database

I'm sure there's many ways to handle this, but for now I see 2 working solutions. The SuperOffice 7 client supports an parameter called IniPath. If we start SOCRM.exe or SOAdmin.exe with this parameter it will load the superoffice.config and superoffice.ini files from that location instead. That does how ever pose a few problems. SuperOffice still use a lot of COM interfacing ( ActiveX ). Say you have word open and want to archive the document you have open. If SuperOffice is running you will see

and everything works perfectly. If how ever, SuperOffice is not running you will see

And if you click that button it will launch the SuperOffice client for you. This launch will not know about the IniPath parameter and SuperOffice will now be searching the wrong place for the configuration files.

I’m not sure if you could do an search and replace in registry and change the launch parameters, but there is another way

In the environment I’m working with right now we use Microsoft Application Virtualization ( App-V ) to deploy applications on all Citrix XenApp and Remote Desktop Servers. When you are sequencing SuperOffice 7 you can modify the File Properties for SuperOffice.config and SuperOffice.ini to make them User Specific

So I created a small “initializer” application and added to the package, that each user have to call once before using SuperOffice. That application copy in the configuration files for that specific customer, and from now on every time superoffice starts it is reading the “correct” configuration files. ( Note: you need to set the right permissions on the files, to allow users to change these files, while sequencing SuperOffice 7 )

SuperOffice Powershell snap in updated

2011-09-24T02:55:00.001+02:00

Updated 02-10-2011: Added new command called New-Smart Process. Read more about it here and here. Also made it easier to install as a module instead of PS Snapin
Updated 28-09-2011: Fixed an error when creating new associates. Fixed a bug in the DSN links created by the snap-in. Added a handful more commands.

I’m starting to use the powershell snap in I created more and found quite a bit of bug’s, spelling errors and needed more commands for my tasks.
Here is a short list of commands

Close-SO7Session
Close down any open connection to SuperOffice and unloads the appdomain
Decrypt-SO7H
Decrypts an 7C: string. Used within superoffice.config to protect database username and password
Encrypt-SO7H
Encrypts an text to an 7C: string. Used within superoffice.config to protect database username and password
Get-MySO7Identity
Return an SO7Associate object representing who you are within the current connection to SuperOffice
Get-SO7Associate
Return one or more SuperOffice Associate
Get-SO7config
Get an empty config object. Used to represent an connection to SuperOffice
Get-SO7Credentials
Get one or more SuperOffice Associate Credentials ( CRM5 / Active Directory / Tickets and so on )
Get-SO7Email
return one or more Email Address from within SuperOffice
Get-SO7Person
return one or more SuperOffice Person objects
Get-SO7Secret
Used for Calculating CRM5 secrets
New-SO7Associate
Create new SuperOffice Associate. Can auto create a Person if needed
New-SO7Credentials
Attach/update credentials for an existing SuperOffice Associate
New-SO7Person
Create new SuperOffice Person
Remove-SO7Associate
Remove one or more SuperOffice Associates
Remove-SO7config
Removes SuperOffice config files and removes DSN links
Remove-SO7Credentials
Remove one or more SuperOffice Credentials
Remove-SO7Email
Remove one or more SuperOffice Email Address
Remove-SO7Person
Remove one or more SuperOffice Persons
Save-SO7config
Save config object as SuperOffice config files ( superoffice.config/superoffice.ini and create DSN link )
Set-SO7config
Set running configuration. (what superoffice database do you want to work with right now ) Will Close any existing connection and unload its appdomain
Set-SO7Person
Update an existing SuperOffice person.

Download here. Compiles fine under both .NET 3.5 and 4.0.

Implementing Active Federation in a Passive Federation website.

2011-09-22T21:53:00.001+02:00

This post is mostly notes for my self. I spend a few hours trying to get this to work so didn’t want to loose it.

I have a running STS that works perfectly with Passive Federation. I provide a GUI where customers can authenticate them self though various social providers like Facebook and linked in, but they can also login using their own STS (mostly ADFS). I needed to offer this though Active Federation too. (user sends a Issue Request Token with a UserNameWSTrustBinding and I need to validate this against all STS providers I have registered for that username )

There is a billion examples on Google on how to do this but I kept getting HTTP error 404 when calling the web service. but after trying hundred of thousand's different web.config setups I finally managed to get it working.

So I create a class that can validate username and password

Imports Microsoft.IdentityModel.Tokens
Imports Microsoft.IdentityModel.Claims
Imports System.IdentityModel.Tokens

Public Class CustomUserNameSecurityTokenHandler
    Inherits UserNameSecurityTokenHandler

    Private _CanValidateToken As Boolean = True
    Public Overrides ReadOnly Property CanValidateToken() As Boolean
        Get
            Return _CanValidateToken
        End Get
    End Property

    Public Overrides Function ValidateToken(token As System.IdentityModel.Tokens.SecurityToken) As Microsoft.IdentityModel.Claims.ClaimsIdentityCollection

        Dim userNameToken As UserNameSecurityToken = TryCast(token, UserNameSecurityToken)
        If userNameToken Is Nothing Then
            Throw New ArgumentException("The security token is not a valid username token.")
        End If

        If userNameToken.UserName = userNameToken.Password Then
            Dim identity As IClaimsIdentity = New ClaimsIdentity()
            identity.Claims.Add(New Claim(ClaimTypes.Name, userNameToken.UserName))
            identity.Claims.Add(New Claim(ClaimTypes.Role, "NoobsAndMorrons"))
            Return New ClaimsIdentityCollection(New IClaimsIdentity() {identity})
        Else
            Throw New InvalidOperationException("Username/password is incorrect in STS.")
        End If
        Return MyBase.ValidateToken(token)
    End Function
End Class

And then I added these sections to my web.config file
First we need to remove Microsoft's default handler and add the above class

  <microsoft.identityModel>
    <service>
      <securityTokenHandlers>
        <remove type="Microsoft.IdentityModel.Tokens.WindowsUserNameSecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
        <add type="CustomUserNameSecurityTokenHandler" />
      </securityTokenHandlers>
    <service>
  <microsoft.identityModel>

Next we add a placeholder for the web service requests. Add an text file and rename it issue.svc, and add this to it.

<%@
ServiceHost 
Factory="Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceHostFactory" 
Service="CustomSecurityTokenServiceConfiguration" 
%>

Next go back to web.config and add this

  <system.serviceModel>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
    <services>
      <service name="Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract" >
        <endpoint address="" binding="customBinding" contract="Microsoft.IdentityModel.Protocols.WSTrust.IWSTrustFeb2005SyncContract"/>
        <endpoint address="" binding="customBinding" contract="Microsoft.IdentityModel.Protocols.WSTrust.IWSTrust13SyncContract"/>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <federatedServiceHostConfiguration />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceMetadata httpGetEnabled="true"/>
          <serviceCredentials>
            <serviceCertificate findValue="7A41CF269D6BCDED80DDD9B6FD517E37891453B5" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <bindings>
      <customBinding>
        <binding >
          <security authenticationMode="UserNameOverTransport" />
          <httpsTransport />
        </binding>
      </customBinding>
      </bindings>
    <system.serviceModel>

Enjoy …I know I didn’t

Claims authentication made simple

2011-09-22T01:32:00.001+02:00

I promised an simple example on how to authenticate against ADFS and get a token back. I honestly don’t think this code is production ready, but when your messing around with all this, it truly helps having some working example code to get a better understanding of what's going on.

So here a little solution to get you started.

Project ClaimsAuthentication
This contains all the code needed to authenticate against an Secure Token Service. Most code is wrapped up to talk with Active Directory Federation Service 2.0, but it could be any STS that understands SAML 2.0 and WS-Federation.
Project CloudAPI
Is an simple wrapper class used to call a web service that implements claimsbased authentication. I added it to give a few examples on how to get a token and then use it to authenticate with.
Project ClaimsAuthenticationTest
Is a windows forms application that shows how to use the 2 other classes. In a fairly simple way, it try to make it simple to test Asymmetric/Symmetric/Bearer token types; How to use Windows/UserName/Certificate and IssuedToken Authentication schemes; And as a little goody, I also wrapped up a simple way to authenticate against an ADFS server, and then get back a FedAuth Cookie, that is needed when talking with SharePoint 2010. I also added a an example on how to upload and download from SharePoint 2010 after authentication.

Lets have a short look at what all this is. IF you download and run the sample you will see this

On the left you have the basic information needed to authenticate against an Secure Token Service ( here called Identity Provider )

Identity Provider: this could be an ADFS 2.0 server
Realm: What website URL or urn do you want to authenticate for.
Authenticate by : Windows/UserName/Certificate and IssuedToken
Key Type: (how to encrypt claims inside token) Asymmetric/Symmetric/Bearer
If you choose to authenticate by UserName, fill out username and password

And that’s it. If everything goes well, you will see “Token” on the right side show how long the token is valid for. If you choose bearer or if you have loaded a certificate with the private key for a Symmetric encrypted token. Claims will show you all the claims inside the token.

If you can get a token, you can now try and type in the URL of an SharePoint 2010 website in “SharePoint URI” and click “Get FedAuth”. The the 2 list box's in the bottom left corner will show all SharePoint list’s and all items inside each list. You can also upload and download files to the lists or delete items.

In the bottom right corner is 3 buttons. Each one represent different ways of talking with a Web Service that implements Claimsbased authentication. Note here ActAs is issued to “impersonate” another user though he's token. And require you to have permission to do this. If on the other hand you have an token with Symmetric signed claims you can reuse this token to authenticate again using “IssuedToken”. ( hint hint. This is why you want to sign your claims )

Project compiles fine under both .NET version 3.5 and 4.0 .. When you swap to 3.5 you will get 2 errors. Read my remarks above those 2 lines.

SuperOffice 7 making my head hurt

2011-09-17T15:29:00.000+02:00

Updated 23-09-2011: I moderated my comment about superoffice. That was childish of me
Updated 24-09-2011: New version updated with a ton of bug fixes .. read more here

My original approach to handling users in superoffice didn't work as expected. I don’t know why I didn’t catch this while testing ( I apparently don’t test well enough )

The whole point of this powershell add on was to make a simple way of managing users in multiple SuperOffice databases. Turns out the SuperOffice NetServer API is hardcoded to declare everything as internal static’s ( that’s private shared for us VB nuts ). They don’t expose a function to clear them, and pretty much everything inside the API is handled though static’s. And they don’t offer you a way to change configuration. Even SuperOffice.Configuration.ConfigFile.SetConfigFile fails. ( they check internal static variable superoffice.socontext._currentPrincipal . That means you can “sign-out” but you’re a “stuck” with the database you connected to the first time. If you change the configuration file (like I did in my old code) SuperOffice will now throw
Authentication failed
Failed to create Identity from tokens
If you (but you wont, its not nice to spy at others bad coding habit's ) look inside SOCore.dll with reflection you can easily see that, SuperOffice is talking with the database ( so DSN link, database and database username/password is correct ) but the identity token it created with your windows principal or CRM username/password doesn’t match anything in database. Since its still looking in the old database

I tried messing a bit around with reflection and overwrite the variables. But didn’t really get me anyway (but I learned a lot of new trick while trying ) so I decided to go down the path I read about on devnet.superoffice.com .

AppDomain … Now there is something I don’t know anything about. I know what it is, but I have never, ever tried coding with/against it.I created a ton of small test applications going down different paths, but nothing really seemed to work. *IF* I managed to get different things loaded, superoffice would go nuts and not work. Then after several hours of getting more and more desperate i found a very simple example (sorry lost the link) and that got me kicked in to gear.

So here is the updated version of my powershell add-on to manage users in SuperOffice. Its pretty much the same but

I renamed all functions to start with so7.
I’ve added a Type Formatting file ( .ps1xml ) so output looks better.
I fixed a small bug in the configuration files. SuperOffice client goes nuts when it see <security> tag, so removed that unless you specifically set the Symmetric keys.
And best of all. Now it works against multiple SuperOffice instances.

Enjoy ….

Working with SuperOffice users though PowerShell

2011-09-10T15:27:00.000+02:00

Updated 24-09-2011: Rewritten, see more here
So you maybe saw my ugly PowerShell scripts to work with SuperOffice in my last blog post. Here is a more “clean” way to handle this

I created a small PowerShell PSCmdlet that you can use to

List/Find/Create/Delete and Create Associates with Person objects
List/Find/Create/delete Associates
Create/Manage/delete License information for Associates
Create/Manage/save/remove SuperOffice configurations ( all with superoffice.config / superoffice.ini and the fucking lame DSN links )

Might be worth mentioning that an Associates is the same as an souser. in most cases you create a Person and then link that person to an Associates and then add credentials ( CRM5 / CRM7 / Windows and what ever ) to that person to give them the ability to access superoffice

Get-CRM7config
Returns an empty CRM7Config object. This is what I use to manage connections to different SuperOffice installations and to create/remove client/server configurations
Remove-CRM7config
Removes the files superoffice.config and superoffice.ini and the DSN link.
Save-CRM7config
Creates and saves superoffice.config and superoffice.ini . if need to be called from a client or with a server installation, add –CreateDSN to also create that.
Set-CRM7config
When calling all other powershell commands it looks for this configuration. (saved in local variable $CRM7Config )
Get-CRM7Person
Gets all or a specific Person from SuperOffice
Remove-CRM7Person
Removes the specified Person from SuperOffice (does not check if user also have Associates )
Get-CRM7User
Get all or a specific Associate
New-CRM7User
Creates a new Associate ( InternalAssociate, Anonymous, System, External or Resource). Create a Person if needed or associates with the one supplied.
Also handles AD integration
Remove-CRM7User
Delete the specified Associate. use –RemovePerson to clean all.
Get-CRM7UserLicense
Returns a more code/user-friendly object you can use to manage permissions for a given user.
Make your chances to license’s/permissions for the user and then call UpdateUserLicense on the object to save it.
Close-CRM7Session
Close down any open session you might have to SuperOffice
Get-MyCRM7Identity
Returns an instance of the user you are currently logged in as

Precompiled assembly's for .NET version 3.5 and 4.0 attached and the complete source code.
Updated 12-09-2011: I’ve fixed a few errors added a few more powershell commands and a lot more powershell parameters. Notably I’ve added –EncryptedDBUser to Save-CRM7config . That way you can get dbUser and dbpassword encrypted within the superoffice.config file

SuperOffice 7 – Creating a new user

2011-09-09T22:14:00.001+02:00

24-09-2011: This can be done more smoothly, please see this post.

God I spend way to much time finding a solution for this

    Function CreateNewUser(mySession As SuperOffice.SoSession, ADLogin As Boolean, sFullName As String, loginName As String, sEmail As String, sPassword As String) As SuperOffice.CRM.Administration.SoUser
        Dim soDB As SoDatabase = SoDatabase.GetCurrent()
        Dim Person As Person = Person.CreateNew
        Person.SetDefaults()
        Person.Firstname = Mid(sFullName, 1, InStr(sFullName, " ") - 1)
        Person.Lastname = Mid(sFullName, InStr(sFullName, " ") + 1)
        Person.Contact = GetPrimaryContact()
        Person.Save()

        Dim user As SuperOffice.CRM.Administration.SoUser = SuperOffice.CRM.Administration.SoUser.CreateNew(Person.PersonId, License.UserType.InternalAssociate)
        user.LogonName = loginName
        'user.SetValidUserName(loginName)
        user.LoginRight = True
        user.LicenseFieldRight.DemandRight(CRM.Security.EFieldRight.Read)
        user.SetPassword(sPassword)
        user.RoleIdx = 1
        user.GroupIdx = 1
        user.OtherGroupIds = New Integer() {2, 3, 4}
        If ADLogin Then
            Dim ADUser = FindADUSer(sEmail)
            Dim SID As New System.Security.Principal.SecurityIdentifier(ADUser.Properties("objectSid").Value, 0)
            user.AddCredential("ActiveDirectory", SID.Value, sEmail)
        End If
        user.Save()
        Return user
    End Function

So we start by creating a Person and then we associate a new user with this person. We set the basic information for the user and if the user is going to be a windows user, add some Windows Credentials by getting the user’s SID from ad.
Here is a quick way to find a user by UPN

    Function FindADUSer(upn As String) As System.DirectoryServices.DirectoryEntry
        Try
            Dim defaultNamingContext As String
            Using rootDSE As New System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
                defaultNamingContext = rootDSE.Properties("defaultNamingContext").Value.ToString()
            End Using

            Dim entry As New System.DirectoryServices.DirectoryEntry("LDAP://" & defaultNamingContext)
            Dim search As New System.DirectoryServices.DirectorySearcher(entry)
            search.Filter = "(userPrincipalName=" & upn & ")"
            search.PropertiesToLoad.Add("sAMAccountName")
            search.PropertiesToLoad.Add("userPrincipalName")
            search.PropertiesToLoad.Add("objectSid")
            Dim result As System.DirectoryServices.SearchResultCollection = search.FindAll()
            For Each res As System.DirectoryServices.SearchResult In result
                Return res.GetDirectoryEntry
            Next
        Catch ex As Exception
            Throw ex
        End Try
        Throw New Exception("Could not find user in AD")
    End Function

Cool, so we have a user that can login and do everything, (though code) but you cant open the SuperOffice client. To do that you need to assign a license to the user.

    Function GetIndexByModuleOwner(SOUser As SuperOffice.CRM.Administration.SoUser, ownername As String) As Integer
        'SuperOffice.License.AssociateModuleLicenseOwner
        For i As Integer = LBound(SOUser.Licenses) To UBound(SOUser.Licenses)
            Dim lic = SOUser.Licenses(i)
            If lic.Owner.OwnerName.ToLower = ownername.ToLower Then
                Return i
            End If
        Next
        Return 0
    End Function

    Sub SetUserLicense(User As SuperOffice.CRM.Administration.SoUser, Enabled As Boolean)
        Dim licenseModuleOwner As Integer = GetIndexByModuleOwner(User, "Superoffice")
        If licenseModuleOwner >= 0 Then
            'LicAssocLnk[ModuleOwner (int) ][ModuleLicense (int or string)]
            'User.Licenses(licenseModuleOwner)(SuperOffice.License.SoLicenseNames.Web).Assigned = True
            User.Licenses(licenseModuleOwner)(SuperOffice.License.SoLicenseNames.User).Assigned = Enabled
            User.Licenses(licenseModuleOwner)(SuperOffice.License.SoLicenseNames.Windows).Assigned = Enabled
            User.Save()
        End If
    End Sub

    Sub SetTravelLicense(User As SuperOffice.CRM.Administration.SoUser, Enabled As Boolean, RemoteTravel As Boolean)
        Dim licenseModuleOwner As Integer = GetIndexByModuleOwner(User, "Superoffice")
        If licenseModuleOwner >= 0 Then
            'LicAssocLnk[ModuleOwner (int) ][ModuleLicense (int or string)]
            User.Licenses(licenseModuleOwner)(SuperOffice.License.SoLicenseNames.Travel).Assigned = Enabled
            User.Licenses(licenseModuleOwner)(SuperOffice.License.SoLicenseNames.RemoteTravel).Assigned = RemoteTravel
            User.Save()
            If Enabled Then SetUserLicense(User, Enabled)
        End If
    End Sub

I decided to split this up a bit. I’m going to be toggling the features a lot so makes more sense in my code.

So now we can just

        SoSession.Authenticate("user", "supersecretpassword")
        Dim user As CRM.Administration.SoUser = CreateNewUser(mysession, True, "Allan Zimmermann", "AZ", "alz@wingu.dk", "MegaHemmeligt!")
        SetUserLicense(user, True)
        SetTravelLicense(user, True, True)

SuperOffice 7 – Connecting to the damn thing

2011-09-09T15:22:00.000+02:00

updated 23-09-2011: Removed my remarks about superoffice. That was childish of me.
updated 23-09-2011: This config script wont work. The superoffice.config contain elements that will break when used from socrm.exe ( the client ) .. please look at my powershell snapin for the same thing

I really don’t like superoffice force me/us to use DNS instead of just giving the option to use connection strings. But that is just how it is for now.

Anyway, so in order to connect to SuperOffice you need to make a DSN link within ODCB administration in order for SuperOffice to be able to speak with its database. Once that is in place you need to create an app.config file defining how SuperOffice can connect to this database. They call this superoffice.config but it is just a plain app.config file. If using a client to connect you also need to put all this information in one more time, but in old school INI format .. ( how lame, talk about redundant redundancy )

I started with a PowerShell script to do all this but I ended up creating my own PowerShell PSCmdlet to handle all the SuperOffice stuff.

So first I need to create the DSN .. and of it needs to be the 32 bit version

function Create32bitDSNLink([string]$DSNName, [string]$DBServer, [string]$DBName, [string]$DriverName, [string]$Driverdll){
    $HKLMPath1 = "HKLM:\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\" + $DSNName
    $HKLMPath2 = "HKLM:\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\ODBC Data Sources"

    md $HKLMPath1 -ErrorAction silentlycontinue

    set-itemproperty -path $HKLMPath1 -name Driver -value $Driverdll
    set-itemproperty -path $HKLMPath1 -name Description -value $DSNName
    set-itemproperty -path $HKLMPath1 -name Server -value $DBServer
    set-itemproperty -path $HKLMPath1 -name LastUser -value ""
    set-itemproperty -path $HKLMPath1 -name Trusted_Connection -value "Yes"
    set-itemproperty -path $HKLMPath1 -name Database -value $DBName

    ## This is required to allow the ODBC connection to show up in the ODBC Administrator application.
    md $HKLMPath2 -ErrorAction silentlycontinue
    set-itemproperty -path $HKLMPath2 -name "$DSNName" -value $DriverName
}

Next we need to create the ini file and superoffice.config

function CreateSuperOfficeconfig([string]$Path, [string]$dbserver, [string]$dbname, [string]$SOAdminUser, [string]$SOAdminPass){
    $filename = ($Path + 'SuperOffice.config')
    if ( (Test-Path $filename) -eq $true) { Clear-Content -path $filename }

    add-content -path $filename -value ('<?xml version="1.0" encoding="utf-8"?>')
    add-content -path $filename -value ('<configuration>')
    add-content -path $filename -value ('        <configSections>')
    add-content -path $filename -value ('          <sectionGroup name="SuperOffice">')
    add-content -path $filename -value ('            <sectionGroup name="Security">')
    add-content -path $filename -value ('              <section name="Cryptography" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('            </sectionGroup>')
    add-content -path $filename -value ('            <section name="ClientConfigurationProvider" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('            <section name="Diagnostics" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('            <sectionGroup name="Data">')
    add-content -path $filename -value ('              <section name="Session" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('              <section name="Database" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('              <section name="ImplicitAnonymous" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('              <section name="Explicit" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('            </sectionGroup>')
    add-content -path $filename -value ('            <sectionGroup name="Factory">')
    add-content -path $filename -value ('              <section name="CustomFactories" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('              <section name="DynamicLoad" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('            </sectionGroup>')
    add-content -path $filename -value ('            <sectionGroup name="Mail">')
    add-content -path $filename -value ('              <section name="Component" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>')
    add-content -path $filename -value ('            </sectionGroup>')
    add-content -path $filename -value ('            <section name="Documents" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('            <section name="Globalization" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('            <section name="Services" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />')
    add-content -path $filename -value ('          </sectionGroup>')
    add-content -path $filename -value ('  </configSections>')
    add-content -path $filename -value ('  <Security>')
    add-content -path $filename -value ('      <Cryptography>')
    add-content -path $filename -value ('        <add key="SymmetricKey" value="mbiNaaa+3wWcbzGWCnvCvRBoLg8NADQiXaaChJ38W1w=" />')
    add-content -path $filename -value ('        <add key="SymmetricIV" value="aBL3Kh0mXHzn+NvXkSS/Lg==" />')
    add-content -path $filename -value ('        <add key="SymmetricSecret" value="SuperOffice NetServer 1.0 Alpha lab-testing" />')
    add-content -path $filename -value ('      </Cryptography>')
    add-content -path $filename -value ('    </Security>')
    add-content -path $filename -value ('    <ClientConfigurationProvider>')
    add-content -path $filename -value ('      <!-- FilePath should be the root directory of structure where GUI configuration XMLs are located. ')
    add-content -path $filename -value ('        Application and instance names become subdirectories to this path. If empty, missing or invalid,')
    add-content -path $filename -value ('        the path of the NetServer assemblies will be used as root. -->')
    add-content -path $filename -value ('      <add key="FilePath" value="C:\RunningTests\TestConfiguration\" />')
    add-content -path $filename -value ('')
    add-content -path $filename -value ('      <!-- If caching is true, the NetServer configuration services will cache configurations on a per-user or per-group basis in the')
    add-content -path $filename -value ('        BinaryObject table, and the Six.Web client will cache them in session state. If false, no caching will be done and there will')
    add-content -path $filename -value ('        be a significant amount of processing on each GUI refresh. However, you will see changes to the GUI immediately, useful for development. -->')
    add-content -path $filename -value ('      <add key="CacheConfigurations" value="true" ></add>')
    add-content -path $filename -value ('    </ClientConfigurationProvider>')
    add-content -path $filename -value ('')
    add-content -path $filename -value ('    <Mail>')
    add-content -path $filename -value ('      <Component>')
    add-content -path $filename -value ('      </Component>')
    add-content -path $filename -value ('    </Mail>')

    add-content -path $filename -value ('  <SuperOffice>')
    add-content -path $filename -value ('    <Factory>')
    add-content -path $filename -value ('      <DynamicLoad>')
    add-content -path $filename -value ('      </DynamicLoad>')
    add-content -path $filename -value ('    </Factory>')
    add-content -path $filename -value ('    <Diagnostics>')
    add-content -path $filename -value ('      <!-- Log errors (default True). -->')
    add-content -path $filename -value ('      <add key="LogError" value="True" />')
    add-content -path $filename -value ('      <!-- Log warnings (default False) -->')
    add-content -path $filename -value ('      <add key="LogWarning" value="False" />')
    add-content -path $filename -value ('      <!-- Log general information. This includes successful SQLs passed to the database.')
    add-content -path $filename -value ('                 Only permit this option while debugging a bug.  This will be a severe performance hit!')
    add-content -path $filename -value ('                 (default False) -->')
    add-content -path $filename -value ('      <add key="LogInformation" value="False" />')
    add-content -path $filename -value ('      <!-- Log failed authentications (default True) -->')
    add-content -path $filename -value ('      <add key="LogFailureAudit" value="True" />')
    add-content -path $filename -value ('      <!-- Log sucessfull authentications (default False) -->')
    add-content -path $filename -value ('      <add key="LogSuccessAudit" value="False" />')
    add-content -path $filename -value ('      <!-- Log to the OS event log (default True) -->')
    add-content -path $filename -value ('      <add key="LogToEventLog" value="True" />')
    add-content -path $filename -value ('      <!-- Log to SuperOffice Research and Product Development (Online through a WebService)  (default False) -->')
    add-content -path $filename -value ('      <add key="LogToSuperOffice" value="False" />')
    add-content -path $filename -value ('      <!-- Log to a LogFile (default False) -->')
    add-content -path $filename -value ('      <add key="LogToFile" value="True" />')
    add-content -path $filename -value ('      <!-- Folder (e.g. UNC path) where the logfile is to recide.  Note that the owner of the process needs to have access to manipulate files in this folder -->')
    add-content -path $filename -value ('      <add key="LogFolder" value="P:\SO7\logs\" />')
    add-content -path $filename -value ('    </Diagnostics>')
    add-content -path $filename -value ('    <Data>')
    add-content -path $filename -value ('      <Session>')
    add-content -path $filename -value ('        <add key="Mode" value="Process" />')
    add-content -path $filename -value ('      </Session>')
    add-content -path $filename -value ('      <Database>')
    add-content -path $filename -value ('        <add key="DatabaseMajor" value="MSSQL" />')
    add-content -path $filename -value ('        <add key="DatabaseMinor" value="8" />')
    add-content -path $filename -value ('        <add key="Server" value="' + $dbserver + '" />')
    add-content -path $filename -value ('        <add key="Database" value="' + $dbname + '" />')
    add-content -path $filename -value ('        <add key="CommandTimeOut" value="300" />')
    add-content -path $filename -value ('        <add key="TablePrefix" value="dbo" />')
    add-content -path $filename -value ('        <add key="ConnectionString" value="Server=[@Server];Database=[@Database];User ID=[@User];Password=[@Password]" />')
    add-content -path $filename -value ('      </Database>')
    add-content -path $filename -value ('      <ImplicitAnonymous>')
    add-content -path $filename -value ('        <add key="Allowed" value="False" />')
    add-content -path $filename -value ('        <add key="DBUser" value="" />')
    add-content -path $filename -value ('        <add key="DBPassword" value="" />')
    add-content -path $filename -value ('        <add key="CommonDBConnection" value="True" />')
    add-content -path $filename -value ('        <add key="SoUser" value="" />')
    add-content -path $filename -value ('        <add key="SoPassword" value="" />')
    add-content -path $filename -value ('      </ImplicitAnonymous>')
    add-content -path $filename -value ('      <Explicit>')
    add-content -path $filename -value ('        <add key="ExternalPersonAllowed" value="False" />')
    add-content -path $filename -value ('        <add key="EmployeeAllowed" value="True" />')
    add-content -path $filename -value ('        <add key="SystemAllowed" value="True" />')
    add-content -path $filename -value ('        <add key="DBUser" value="' + $SOAdminUser + '" />')
    add-content -path $filename -value ('        <add key="DBPassword" value="' + $SOAdminPass + '" />')
    add-content -path $filename -value ('        <add key="CommonDBConnection" value="True" />')
    add-content -path $filename -value ('      </Explicit>')
    add-content -path $filename -value ('    </Data>')
    add-content -path $filename -value ('    <Documents>')
    add-content -path $filename -value ('      <!-- Location of SO_ARC ; the Windows Client will override this with a real value at runtime (the value will not be visible in the file) -->')
    add-content -path $filename -value ('      <add key="ArchivePath" value="c:\SO_ARC" />')
    add-content -path $filename -value ('      <!-- Location of template folder. This folder only needs to be specifies when it is other than default. -->')
    add-content -path $filename -value ('      <!-- Optional: add key="TemplatePath" value="" /-->')
    add-content -path $filename -value ('      <!-- Location of temporary folder for streaming files.  This path must resolve to the same location for farms/culsters. -->')
    add-content -path $filename -value ('      <add key="TemporaryPath" value="" />')
    add-content -path $filename -value ('      <!-- Impersonate user when accessing the document archive or the temporary folder  -->')
    add-content -path $filename -value ('      <add key="ImpersonateUser" value="false" />')
    add-content -path $filename -value ('      <!-- Name of the user to impersonate with -->')
    add-content -path $filename -value ('      <add key="ArchiveUser" value="" />')
    add-content -path $filename -value ('      <!-- Password of the user to impersonate with -->')
    add-content -path $filename -value ('      <add key="ArchivePassword" value="" />')
    add-content -path $filename -value ('      <!-- Domain of the user to impersonate with -->')
    add-content -path $filename -value ('      <add key="ArchiveDomain" value="" />')
    add-content -path $filename -value ('      <!-- Size of internal buffer in KB -->')
    add-content -path $filename -value ('      <add key="BufferSize" value="32" />')
    add-content -path $filename -value ('    </Documents>')
    add-content -path $filename -value ('  </SuperOffice>')
    add-content -path $filename -value ('</configuration>')
}


function CreateSuperOfficeini([string]$Path, [string]$dbserver, [string]$dbname, [string]$DriverName){
    $filename = ($Path + 'SuperOffice.ini')
    if ( (Test-Path $filename) -eq $true) { Clear-Content -path $filename }

    add-content -path $filename -value ('[Client]')
    add-content -path $filename -value ('PrefMailClient=Outlook2007')
    add-content -path $filename -value ('PrefWordProcessor=Word2007')
    add-content -path $filename -value ('PrefLang=US')
    add-content -path $filename -value ('[ODBC:' + $dbname + ']')
    add-content -path $filename -value ('Database=' + $dbname)
    add-content -path $filename -value ('Driver=' + $DriverName)
    add-content -path $filename -value ('Server=' + $dbserver)
    add-content -path $filename -value ('[SuperOffice]')
    add-content -path $filename -value ('Datapath=ODBC:' + $dbname)
    add-content -path $filename -value ('Archivepath=P:\SO7\SO_ARC')
    add-content -path $filename -value ('GlobalPrefix=dbo')
}

Well, not pretty but it works … I have pretty much the same code in VB.NET and together with this nifty little class it’s a piece of cake "”cheating” SuperOffice NetServer to connect to what ever database we want. ( Thanks too this link )

Imports System.Configuration
Imports System.Reflection

Public MustInherit Class AppConfig
    Implements IDisposable
    Public Shared Function Change(path As String) As AppConfig
        Return New ChangeAppConfig(path)
    End Function

    Public MustOverride Sub Dispose() Implements IDisposable.Dispose

    Private Class ChangeAppConfig
        Inherits AppConfig
        Private ReadOnly oldConfig As String = AppDomain.CurrentDomain.GetData("APP_CONFIG_FILE").ToString()

        Private disposedValue As Boolean

        Public Sub New(path As String)
            AppDomain.CurrentDomain.SetData("APP_CONFIG_FILE", path)
            ResetConfigMechanism()
        End Sub

        Public Overrides Sub Dispose()
            If Not disposedValue Then
                AppDomain.CurrentDomain.SetData("APP_CONFIG_FILE", oldConfig)
                ResetConfigMechanism()


                disposedValue = True
            End If
            GC.SuppressFinalize(Me)
        End Sub

        Private Shared Sub ResetConfigMechanism()
            GetType(ConfigurationManager).GetField("s_initState", BindingFlags.NonPublic Or BindingFlags.[Static]).SetValue(Nothing, 0)

            GetType(ConfigurationManager).GetField("s_configSystem", BindingFlags.NonPublic Or BindingFlags.[Static]).SetValue(Nothing, Nothing)

            GetType(ConfigurationManager).Assembly.GetTypes().Where(Function(x) x.FullName = "System.Configuration.ClientConfigPaths").First().GetField("s_current", BindingFlags.NonPublic Or BindingFlags.[Static]).SetValue(Nothing, Nothing)
        End Sub
    End Class
End Class

SharePoint 2010–Set custom sign in page

2011-09-07T15:20:00.000+02:00

this one took me several hours. So much crap on Google but no solution anywhere.

If your SharePoint site is using Classic Mode Authentication

$webappurl = 'https://web.site.com'
Set-SPCustomLayoutsPage -Identity Login -RelativePath "/_layouts/something/login.aspx" -WebApplication $webappurl

To remove it again use

$webappurl = 'https://web.site.com'
Set-SPCustomLayoutsPage -Identity Login -reset -WebApplication $webappurl

If how ever your site is using Claims Based Authentication this wont work. Then use

$webappurl = 'https://web.site.com'
Set-SPWebApplication $webappurl -zone Default -SignInRedirectURL "/_layouts/wingu.SharePoint.Authentication/login.aspx"

And to remove it (reset it) again use

$webappurl = 'https://web.site.com'
Set-SPWebApplication $webappurl -zone Default -SignInRedirectURL ""

And a not to my self on how to do it on all websites

get-SPWebApplication | foreach-object {
    $_
    $ap1 = Get-SPTrustedIdentityTokenIssuer
    $ap2 = New-SPAuthenticationProvider -UseWindowsIntegratedAuthentication
    Set-SPWebApplication $_.Url -AuthenticationProvider $ap1, $ap2 -zone Default -SignInRedirectURL "/_layouts/wingu.SharePoint.Authentication/login.aspx"
}

Claimsbased authentication and WCF Services

2011-09-06T15:18:00.000+02:00

Update 22-09-2011: Code samples posted here
In the last few months I’ve spend a lot of time messing with claimsbased authentication. a lot of it have been toward implementing single sign on though various social providers. But some of it have also been involving working with SharePoint 2010 and CRM 2011 and developing and calling my own WCF services from both applications and websites.

I wanted to document what I learn, as I learned it, on this blog but the time just hasn’t been on my side, but I do how ever spend a little time on a piece of code I wrote that I think a lot people will find useful and can copy’n’paste a bit from.

Most of the actions and information I need in different places are all wrapped up in 1 WCF service, I call this WCF service from both other WCF services and websites and from various applications. I found it was easier for me to just create an Class Library that could talk with this WCF service and then reference that from all my projects.

Most of the code is about handling active federation against any kind of claimsbased identity provider, but I also put in a bit of code to handle passive federation that is needed when working with SharePoint 2010 though code.

I have client class that in a simple way make authentication against an identity provider and receiving a claims token back. I want to go though how to use this client to get a token and what can happen, since I have seen A LOT of forum post from people getting these errors and not getting an answer that fits.

We start by creating an instance of the client and choosing what kind of encryption we want to use.

Code Snippet
 Dim ClaimsClient As New ClaimsAuth.Client
ClaimsClient.TokenEncryption = Microsoft.IdentityModel.SecurityTokenService.KeyTypes.Symmetric
 

if we look in Microsoft.IdentityModel.SecurityTokenService.KeyTypes we see we can use Asymmetric, Symmetric or Bearer. Tons of post out there about this.

If you use Asymmetric you as requestor need to supply a key to encrypt the claims with. ( set "UseKey” )

If you use Symmetric the identity provider have all ready been told what certificate to use, to encrypt the claims with.

If you choose Bearer. The token get signed, but claims will not be encrypted. If a token signing certificate have been assigned on the Relying Party, claims will simply not be included at all.

When you request a token, the token gets signed (not encrypted) with a certificate installed on the Identity Provider ( ADFS ). If you add a certificate on a Relying Party Trust (RP) on the ADFS server, the claims inside the token gets encrypted with with that certificate. Only host/applications that have access to the private key of that certificate can now decrypt the token and read the claims. You don’t need to read the claims in order to authenticate your self. For instance if you have a WCF Service you want to call from within an application. You can from within that application still request a token from the ADFS server and then access the WCF service with that Token. As long as the WCF service have access to the private key and can read the claims, your application don’t need it.

If you choose Symmetric but the Relying Party on the ADFS have not been assigned a certificate to encrypt the claims with you will get

ID3037: The specified request failed.

and in the event log on the ADFS server they would also see

ID4007: The symmetric key inside the requested security token must be encrypted. To fix this, either override the SecurityTokenService.GetScope() method to assign appropriate value to Scope.EncryptingCredentials or set Scope.SymmetricKeyEncryptionRequired to false.

Either request a Bearer token or Asymmetric (not sure if you can this?) token, or add a certificate on the RP

To make it simple. If you want to make absolutely sure your ADFS server only issues tokens to the hosts you have given the certificate with private key too, sign the tokens with this certificate by taking the public part of the certificate and save to a file and then assign it on this tab.
If you need to authenticate from many places and don’t want to struggle with distributing a certificate including its private key around. or if you don’t care others can read the claim ( you need to successfully authenticate in order to get the claims in the first place so in theory they should have access to it anyway ) leave this field blank.

To add the certificate to the ADFS server, on the computer you have the certificate you want to use for signing claims with, open certificates and add Local computer or user, depending on where you have the certificate installed. Right click it and choose open

Go to Details and click Copy to file

Accept the defaults and save the file. Then use this file when adding a certificate on the RP on the ADFS server.

If you choose to get an Bearer token you cannot reuse this key to authenticate to other RP’s by authentication with the issued token, That will fail with

The signing token XXXX has no keys. The security token is used in a context that requires it to perform cryptographic operations, but the token contains no cryptographic keys. Either the token type does not support cryptographic operations, or the particular token instance does not contain cryptographic keys. Check your configuration to ensure that cryptographically disabled token types (for example, UserNameSecurityToken) are not specified in a context that requires cryptographic operations (for example, an endorsing supporting token).

When you have a token and you want read the claims inside, you will often see errors like

ID4022: The key needed to decrypt the encrypted security token could not be resolved. Ensure that the SecurityTokenResolver is populated with the required key.

Or from a asp.net website

ID4036: The key needed to decrypt the encrypted security token could not be resolved from the following security key identifier 'XXXXX'. Ensure that the SecurityTokenResolver is populated with the required key.

I think its pretty self explaining but there's a ton of forum post’s out there where people ask for help. Again, you have a token, its valid, you can authenticate your self with it, but when you try to read the token you get the above error. You get it be course a certificate has been added on the RP on the ADFS and you haven't given WIF the certificate including private key, needed to decrypt it. If using my code, just load it and add it on the TokenSigningCertificate Property. If you see this error on a websites you are probably missing the serviceCertificate in web.config

Code Snippet
 <microsoft.identityModel>
  <service saveBootstrapTokens="true">
    <certificateValidation certificateValidationMode="None" />
    <serviceCertificate>
      <certificateReference x509FindType="FindByThumbprint" findValue="7A41CF269D6BCDED80DDD9B6FD517E37891453B5" storeLocation="LocalMachine" storeName="My" />
    </serviceCertificate>
  </service>
</microsoft.identityModel>
 

And while at those errors. if you get something down the line of

ID4175: The issuer of the security token was not recognized by the IssuerNameRegistry. To accept security tokens from this issuer, configure the IssuerNameRegistry to return a valid name for this issuer.

you are missing the certificate from the Identity Provider ( ADFS )

Code Snippet
 <microsoft.identityModel>
  <service saveBootstrapTokens="true">
    <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
      <trustedIssuers>
        <add thumbprint="86AC2E62900DF9451B0596562D52F7212AC31065" name="http://adfs.wingu.dk/adfs/services/trust" />
      </trustedIssuers>
    </issuerNameRegistry>
  </service>
</microsoft.identityModel>
 

Back to the code, Next I choose what I want to access (realm) and who to authenticate me (identity provider / ADFS) and how I want to authenticate

Code Snippet
 Dim ClaimsClient As New ClaimsAuth.Client
ClaimsClient.TokenEncryption = Microsoft.IdentityModel.SecurityTokenService.KeyTypes.Symmetric
ClaimsClient.IdentityProvider = "https://adfs.wingu.dk/"
ClaimsClient.Realm = "https://admin.wingu.dk/ssi2/"
ClaimsClient.authenticateBy = MessageCredentialType.Windows
'ClaimsClient.username = txtUsername.Text
'ClaimsClient.Password = txtPassword.Text
'ClaimsClient.ClientCertificate = MyPersonalCertificate
'ClaimsClient.IssuedToken = OtherIssuedToken
'Dim ClaimsID As Microsoft.IdentityModel.Claims.ClaimsIdentity = _
'DirectCast(HttpContext.Current.User.Identity, Microsoft.IdentityModel.Claims.ClaimsIdentity)
'Dim BootstrapToken As System.IdentityModel.Tokens.SecurityToken = ClaimsID.BootstrapToken
'ClaimsClient.ActAsToken = BootstrapToken
ClaimsClient.authenticate()
 

AuthenticateBy can be either Certificate, IssuedToken, UserName or Windows. Just for fun I showed other ways to authenticate in the remarks. On that is particular interesting is the ActAs . This is what you would normally do from within an asp.net application that needs to call an WFC service on behalf of the user. Either Authenticate by Windows or username/password form within the asp.net application and then attach the user’s bootstrap token. you need permission to do this of course. That is what the Delegation Authorization Rules are for on the RP Claims rule dialog

Back to the code, so inside the client class I have my authenticate function.

Code Snippet
 Function authenticate() As System.IdentityModel.Tokens.SecurityToken
    Select Case _authenticateBy
        Case MessageCredentialType.UserName : _IssuedToken = GetADFSTokenUsernamemixed()
        Case MessageCredentialType.Windows : _IssuedToken = GetADFSTokenKerberos()
        Case MessageCredentialType.IssuedToken
            If _IssuedToken Is Nothing Then Throw New Exception("No token found to issue new token with")
            _IssuedToken = GetADFSTokenIssuedToken()
        Case Else : Throw New Exception("unknown authentication schema")
    End Select
    Return _IssuedToken
End Function
 

most of this code can be reused against any kind of Claimsbased authentication identity provider but for now I have only done the logic for ADFS and SharePoint.
GetADFSTokenUsernamemixed and GetADFSTokenKerberos is almost the same, GetADFSTokenIssuedToken is a bit more tricky

So here they are

Code Snippet
 Private Function GetADFSTokenUsernamemixed() As System.IdentityModel.Tokens.SecurityToken
    Dim Token As System.IdentityModel.Tokens.SecurityToken
    Dim UserNameMixed As String = _IdentityProvider & "adfs/services/trust/13/usernamemixed"
    Dim STSbinding = New Microsoft.IdentityModel.Protocols.WSTrust.Bindings.UserNameWSTrustBinding
    STSbinding.SecurityMode = SecurityMode.TransportWithMessageCredential
    Dim trustChannelFactory As New WSTrustChannelFactory(STSbinding, New EndpointAddress(UserNameMixed))
    trustChannelFactory.TrustVersion = System.ServiceModel.Security.TrustVersion.WSTrust13
 
    trustChannelFactory.Credentials.SupportInteractive = False
    trustChannelFactory.Credentials.UserName.UserName = _Username
    trustChannelFactory.Credentials.UserName.Password = _Password
 
    Try
        Dim rst As New RequestSecurityToken()
        rst.RequestType = WSTrust13Constants.RequestTypes.Issue
        rst.AppliesTo = New EndpointAddress(_Realm)
        rst.KeyType = _TokenEncryption
        rst.TokenType = _TokenType
 
        If _ClientCertificate IsNot Nothing Then
            Dim clause As System.IdentityModel.Tokens.SecurityKeyIdentifierClause = _
                New System.IdentityModel.Tokens.X509RawDataKeyIdentifierClause(_ClientCertificate)
 
            rst.UseKey = New UseKey(New System.IdentityModel.Tokens.SecurityKeyIdentifier(clause), _
                                     New System.IdentityModel.Tokens.X509SecurityToken(_ClientCertificate))
        End If
 
        'This part will give you identity of logged in user 
        If _ActAs IsNot Nothing Then rst.ActAs = _ActAs
 
        If _requestClaims.Count > 0 Then
            For Each claim In _requestClaims
                rst.Claims.Add(claim)
            Next
        End If
        Dim channel = trustChannelFactory.CreateChannel()
        Dim rstr As RequestSecurityTokenResponse = Nothing
        Token = channel.Issue(rst, rstr)
    Catch ex As Exception
        Throw New Exception(ex.Message, ex)
    Finally
        Try
            If trustChannelFactory.State = CommunicationState.Faulted Then
                trustChannelFactory.Abort()
            Else
                trustChannelFactory.Close()
            End If
        Catch generatedExceptionName As Exception
        End Try
    End Try
    Return Token
End Function
 
Private Function GetADFSTokenKerberos() As System.IdentityModel.Tokens.SecurityToken
    Dim Token As System.IdentityModel.Tokens.SecurityToken
    Dim KerberosMixed As String = _IdentityProvider & "adfs/services/trust/13/kerberosmixed"
    Dim STSbinding = New Microsoft.IdentityModel.Protocols.WSTrust.Bindings.KerberosWSTrustBinding
    STSbinding.SecurityMode = SecurityMode.TransportWithMessageCredential
 
    Dim trustChannelFactory As New WSTrustChannelFactory(STSbinding, New EndpointAddress(KerberosMixed))
 
    trustChannelFactory.TrustVersion = System.ServiceModel.Security.TrustVersion.WSTrust13
    trustChannelFactory.Credentials.SupportInteractive = False
    trustChannelFactory.Credentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Impersonation
    trustChannelFactory.Credentials.Windows.ClientCredential = System.Net.CredentialCache.DefaultNetworkCredentials
 
    Try
        Dim rst As New RequestSecurityToken()
        rst.RequestType = WSTrust13Constants.RequestTypes.Issue
        rst.AppliesTo = New EndpointAddress(_Realm)
        rst.KeyType = _TokenEncryption
        rst.TokenType = _TokenType
        If _ActAs IsNot Nothing Then rst.ActAs = _ActAs
 
        If _requestClaims.Count > 0 Then
            For Each claim In _requestClaims
                rst.Claims.Add(claim)
            Next
        End If
        Dim channel = trustChannelFactory.CreateChannel()
        Dim rstr As RequestSecurityTokenResponse = Nothing
        Token = channel.Issue(rst, rstr)
        Dim t = rstr.RequestedSecurityToken.SecurityToken
        Dim s As String = ""
 
    Catch ex As Exception
        Throw New Exception(ex.Message, ex)
    Finally
        Try
            If trustChannelFactory.State = CommunicationState.Faulted Then
                trustChannelFactory.Abort()
            Else
                trustChannelFactory.Close()
            End If
        Catch generatedExceptionName As Exception
        End Try
    End Try
    Return Token
End Function
 
Private Function GetADFSTokenIssuedToken() As System.IdentityModel.Tokens.SecurityToken
    Try
        Dim Token As System.IdentityModel.Tokens.SecurityToken
        Dim IssuedtokenMixed As String = _IdentityProvider & "adfs/services/trust/13/issuedtokenmixedsymmetricbasic256"
 
        Dim binding = New Microsoft.IdentityModel.Protocols.WSTrust.Bindings.IssuedTokenWSTrustBinding()
        binding.SecurityMode = SecurityMode.TransportWithMessageCredential
 
        Dim factory = New WSTrustChannelFactory(binding, New EndpointAddress(IssuedtokenMixed))
        factory.TrustVersion = TrustVersion.WSTrust13
        factory.Credentials.SupportInteractive = False
 
        Dim rst = New RequestSecurityToken() With { _
         .RequestType = WSTrust13Constants.RequestTypes.Issue, _
         .AppliesTo = New EndpointAddress(_Realm), _
         .KeyType = WSTrust13Constants.KeyTypes.Symmetric _
        }
        rst.TokenType = _TokenType
        rst.KeyType = _TokenEncryption  
        factory.ConfigureChannelFactory()
 
        If _requestClaims.Count > 0 Then
            For Each claim In _requestClaims
                rst.Claims.Add(claim)
            Next
        End If
 
        Dim channel = factory.CreateChannelWithIssuedToken(_IssuedToken)
        Token = channel.Issue(rst)
        Return Token
    Catch ex As Exception
        Throw ex
    End Try
End Function
 

I need to wrap up a few more loose ends and add a few comments but the class library and a simple test application will be available for download on this blog in a few days

Web services and wildcard certificate

2011-09-04T15:16:00.000+02:00

I’m fiddling with web services that uses claims based authentication, and spend a few hours banging my head against the wall with this scenario.

Image you have the following code

Code Snippet
 Dim binding = New WS2007FederationHttpBinding(WSFederationHttpSecurityMode.TransportWithMessageCredential)
binding.Security.Message.EstablishSecurityContext = False
binding.Security.Mode = WSFederationHttpSecurityMode.Message
Dim factory As New ChannelFactory(Of wsClaimsCloudAPI.ClaimsCloudAPIChannel)(binding, "http://admin.wingu.dk/CloudAPI/ClaimsCloudAPI.svc")
factory.ConfigureChannelFactory()   '(Of wsClaimsCloudAPI.ClaimsCloudAPIChannel)()
factory.Credentials.SupportInteractive = False
Dim channel = factory.CreateChannelWithIssuedToken(Token)
Dim s = channel.getToken
MsgBox(s)
 

and get this error back

Identity check failed for outgoing message. The expected DNS identity of the remote endpoint was 'admin.wingu.dk' but the remote endpoint provided DNS claim 'wingu.dk'. If this is a legitimate remote endpoint, you can fix the problem by explicitly specifying DNS identity 'wingu.dk' as the Identity property of EndpointAddress when creating channel proxy.

m using a wildcard certificate on the webserver and I guess that’s what confusing things. Some people claim you can fix this by setting the host identity on the web service binding on the server, but that didn’t seem to work for me. but doesn’t matter, the error it self explains what to do. Explicitly specify the identity. so the code becomes

Code Snippet
 Dim EndpointURI As New Uri("http://admin.wingu.dk/CloudAPI/ClaimsCloudAPI.svc")
Dim EndpointIdentity As EndpointIdentity = EndpointIdentity.CreateDnsIdentity("wingu.dk")
Dim remoteAddress As New EndpointAddress(EndpointURI, EndpointIdentity, New System.ServiceModel.Channels.AddressHeaderCollection)
Dim factory As New ChannelFactory(Of wsClaimsCloudAPI.ClaimsCloudAPIChannel)(binding, remoteAddress)
 

And everything works like a charm.

Note if using CreateChannelWithIssuedToken() and supply nothing or an illegal token, you will get back.

The address of the security token issuer is not specified. An explicit issuer address must be specified in the binding for target 'http://admin.wingu.dk/CloudAPI/ClaimsCloudAPI.svc' or the local issuer address must be configured in the credentials.

So make sure the token your testing with is valid.

Exchange 2010 Service pack 1 Hosting mode and Claims based authentication

2011-07-14T16:53:00.001+02:00

I was a happy user of Windows Identity Foundation and ADFS 2.0 against out Exchange 2010 servers, so when messing about with service pack 1 I naturally also tried setting up the c2wts service and configurering claims based authentication up.
That isn't as easy as it sounds so here's a short guide. ( loosely based on information from this document and this guide )

Following this guide will “break” the ECP website. you need to run though all of this again on the Exchange Control Panel website. The difference from OWA to ECP is that you don’t need to “remark out” location.

Also, user controls will fail loading in ECP with an

WebHost failed to process a request.
Sender Information: System.ServiceModel.ServiceHostingEnvironment+HostingManager/59085005
Exception: System.ServiceModel.ServiceActivationException: The service '/ecp/RulesEditor/InboxRules.svc' cannot be activated due to an exception during compilation. The exception message is: Required attribute 'name' not found. (C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\ecp\web.config line 1859). ---> System.Configuration.ConfigurationErrorsException: Required attribute 'name' not found. (C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\ecp\web.config line 1859)

To fix this, change <binding> to <binding name="ws2007Federation">

Download and install Microsoft Windows Identity Foundation and Windows Identity Foundation SDK on all CAS servers.

First off, the configuration utility gets massively confused over the web.config file, so first open C:\Program Files\Microsoft\Exchange Server\V14\Client Access\Owa\web.config and remark out the <location> tag. ( begin tag is at line 4, end tag is at line 26 )

Open Windows Identity Foundation Federation Utility and point to C:\Program Files\Microsoft\Exchange Server\V14\Client Access\Owa\web.config . Type in the external URL of your OWA site.

Type in metadata url for your ADFS server ( for instance https://adfs.wingu.dk/FederationMetadata/2007-06/FederationMetadata.xml )

The rest is default.

Open web.config again and un-remark the location tags.
Add WIF modules to configuration –>system.webServer –> modules
Before:
<modules>
<add type="Microsoft.Exchange.Clients.Owa.Core.OwaModule, Microsoft.Exchange.Clients.Owa" name="OwaModule" />
<add name="exppw" />
</modules>
After:
<modules runAllManagedModulesForAllRequests="true">
<add name="WSFederationAuthenticationModule" type="Microsoft.IdentityModel.Web.WSFederationAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler"/>
<add name="SessionAuthenticationModule" type="Microsoft.IdentityModel.Web.SessionAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler"/>
<add type="Microsoft.Exchange.Clients.Owa.Core.OwaModule, Microsoft.Exchange.Clients.Owa" name="OwaModule" />
<add name="exppw" />
</modules>

Force users to be authenticated.
configuration-> system.web –> Add the following

Enable UPN. configuration –> system.serviceModel –> bindings –> ws2007FederationHttpBinding –> binding –> security –> message –> claimTypeRequirements. Unmark UPN
<add claimType="http://schemas.xmlsoap.org/claims/UPN" isOptional="true" />

Tell WIF to create a Windows Token instead of passing the SAML token to OWA.
microsoft.identityModel –>service-> Add

<securityTokenHandlers>
<add type="Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
<samlSecurityTokenRequirement mapToWindows="true" useWindowsTokenService="true"/>
</add>
</securityTokenHandlers>

Tell WIF to redirct users to your STS /ADFS,
microsoft.identityModel –>service-> Add

<federatedAuthentication>
<wsFederation passiveRedirectEnabled="true" issuer="https://adfs.wingu.dk/adfs/ls/" realm="https://test01exc01.test01.local/owa/" requireHttps="true"/>
<cookieHandler requireSsl="true"/>
</federatedAuthentication>

Open a Exchange powershell console and run

get-owavirtualdirectory | Set-owavirtualdirectory -FormsAuthentication:$false
get-owavirtualdirectory | Set-OwaVirtualDirectory -WindowsAuthentication $true
iisreset /noforce

Lastly, enable c2wt, by first openinig C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config and umark <add value="NT AUTHORITY\System" />

Open Services and set “Claims to Windows Token Service” service to start automatic (start/restart the service now)

Copy C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\Owa\FederationMetadata\2007-06\FederationMetadata.xml to your ADFS server and add owa as an relying Party Trust.
Add the following to Rules.
Pass Through or Filter an Incomming Claim –> UPN

Transform an Incomming Claim –> E-Mail Address –> UPN

Open properties for your new relying part and change –> Advanced SHA-1

Encryption,. remove it ( if the WIF wizard forced you to choose one )

EndPoints –> Add a WS-Federation endpoint