How to Add Simple Authentication to Azure Website

During my last Azure Website project, we had to setup a staging environment in order to test the website being deployed. By nature, all Azure Websites are opened to everyone to see, however the need to protect the content being tested came up for several reasons. We were running on a tight deadline and we did not want to spend too much on configuring this authentication. The solution we found was to leverage from the provided IIS and .NET capabilities already provided by Azure and setup a simple authentication mechanism using a static username and password.

Blueprint

For this case we needed 3 things:

1. a web.config file with the authentication configuration
2. a Login.aspx page that comes up for the visitors to enter the credentials
3. a javascript hookup binding the page and the web.config

Once you have all these elements, what you do is to upload these files (via FTP) to your Azure Website. The IIS hosting will automatically recognize them and the changes will take effect immediately.

Solution

The solution took about 10 minutes to build and to save you this valuable time here is the code for both web.config and login.aspx (included with the javascript) you need:

<?xml version="1.0"?>
<configuration>
    <system.web>
        <compilation debug="false" />
        <authentication mode="Forms">
            <forms>
                <credentials passwordFormat="Clear">
                    <user name="AddYourUserNameHere" password="AddYourPasswordHere" />
                </credentials>
            </forms>
        </authentication>
        <authorization>
            <!-- Allow access to all who can match the username and password -->
            <allow users="*" />
            <!-- Denies access to anonymous users -->
            <deny users="?" />
        </authorization>
    </system.web>
 
    <system.webServer>
        <modules>
            <remove name="FormsAuthenticationModule" />
            <add name="FormsAuthenticationModule" type="System.Web.Security.FormsAuthenticationModule" />            
            <remove name="UrlAuthorization" />
            <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />
        </modules>
    </system.webServer>
</configuration>

And here’s the code for the login.aspx file you will need.

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Web.Security" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<script runat='server'>
public void Login_OnClick(object sender, EventArgs args)
{
    if (FormsAuthentication.Authenticate(UsernameTextbox.Text, PasswordTextbox.Text))
    {
        FormsAuthentication.RedirectFromLoginPage(UsernameTextbox.Text, NotPublicCheckBox.Checked);
    }
    else
    {
        Msg.Text = "Login failed.";
    }
}
</script>
<html xmlns="http://www.w3.org/1999/xhtml" >
<head><title>Simple Login Authentication</title></head>
<body>
    <form id="form1" runat="server">
    <h3>Simple Login Authentication</h3>
    <asp:Label id="Msg" ForeColor="maroon" runat="server" /><br />
    Enter the user name: <asp:Textbox id="UsernameTextbox" runat="server" /><br />
    Enter the password : <asp:Textbox id="PasswordTextbox" runat="server" TextMode="Password" /><br />
    <asp:Button id="LoginButton" Text="Login" OnClick="Login_OnClick" runat="server" />
    <asp:CheckBox id="NotPublicCheckBox" runat="server" />
    </form>
</body>
</html>

Well, that’s it. I hope you liked and it saved you some Google searches and time

by Edge Pereira

Office 365: Privacy, Compliance and Data Leakage Protection

Thank you everyone who attended my presentation at Infrastructure Saturday #infrasat on Office 365 : Privacy, Compliance and Data Leakage Protection. Fantastic crowd. Great engagement and questions. Feel free to reach out if needed anything. 

Here are the slides: http://1drv.ms/1v767mF

by Edge Pereira

How to host json file on Azure Website

Recently our project team developed an application and we intended to host it using an Azure Website, due to its convenience, price and easy of use. It worked well in the local drive and in the local web server..so if we just copy the site to another place it should work, right?

Wrong, if the other site is an Azure Website. If you do, you will note that all accesses to the JSON file will result in a 404 error.

The Problem

To make short a long story, that's because Azure Websites have a few MIME file types blocked by default and .json is one of them. And for the record, .svg is another one. 

The Fix

Luckily all Azure Websites are really IIS servers running on .Net. If you have some basic knowledge of IIS and .Net you know that we can control these security things via web.config. And that is what you need to do: Place a web.config file that tells IIS to allow the file extension.

To save you the trouble, here's the code to allow json and .svg to be served on Azure Website:

<?xml version="1.0"?>
<configuration>
    <system.webServer>
        <staticContent>
            <mimeMap fileExtension=".json" mimeType="application/json" />
     </staticContent>
    </system.webServer>
</configuration>

Just save this as a web.config and copy to the root folder of your application.

I hope this little trick saved you lots of time!

Cheers,
by Edge Pereira

Do What You Love

Don’t Let Failures Stop You

Working with CSS (sigh..)

By Edge Pereira

How to Upgrade SharePoint 2013 Trial to Licensed

If you are using a trial version of SharePoint Server 2013 and want to upgrade to a licensed product edition, you can purchase a license and perform the upgrade on the SharePoint Central Administration itself. Below are the steps to upgrade from trial to licensed.

If you have a trial you will see the following options in Central Admin.

 

Just click it and type the serial key you just purchased and SharePoint will take care of the rest. The whole licensing process should take just a couple of minutes. Suffice to say the server must be connected to the internet.

  

by Edge Pereira

How to Get a Random Value Variable on Command Prompt

Here’s a nice trick to get a random value on command prompt: Use the macro %random%

This is pretty useful to setup values not to be known, like for example to set the Administrator password to a unknown value.

net user administrator edge%random%pereira

by Edge Pereira

How to Call Administrator Command Prompt at the Windows Login Screen

Quick Summary: We are going to learn how to hack Windows 8 and get administrator rights to anyone without knowing the login information. This was my solution during a hackaton that happened here in Australia some time ago and I decided to share with you guys.

If you’re really in a hurry, here’s how it works…

Before the solution, a quick chit-chat…

The debugger process takes very high execution precedency in Windows. As a matter of fact, the debugger actually is running at the moment in your windows background and you never realised that.

If you’ve been around long enough to remember the old MS-DOS days, back then there was an application called SideKick. SideKick was executed at the computer boot and then stayed there hibernating. Then when the used pressed Ctrl+Alt, it magically appeared in the screen. It was awesome! Best thing ever! You could call this application from anywhere. It was done because during the initial execution, SideKick placed itself between the keyboard pressing command and the actual call in the CPU. It was a “man in the middle” kind of application, for the good.

That’s the same principle here, and to prove the point that the debugger is always running on Windows we will do this cool experiment in 3 Steps:

1) Open RegEdit and find the Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

2) Create a new string key called DisplaySwitch.exe. In this key set Name: Debugger, Data:cmd.exe

3) Lock your windows and press WindowsKey+P

Amazing hey! You’re calling the Command Prompt from your windows login screen. How about that for a power show-off with your infrastructure friends

The Explanation

The Debugger process is always running and intercepting all the calls made on windows, even during the login screen, and checking against the list defined in that registry key we talked about at the beginning. Now we only had to find an application, a service or anything that can be executed and send the instruction to the debugger to execute something else for us. That’s where the DisplaySwitch.exe comes into play.

DisplaySwitch.exe is executed when we press WindowsKey+P to allow us to select multiple monitors. The registry entry says “If the DisplaySwitch.exe gets called, call the Debugger instead and pass the parameter cmd.exe”. We are intercepting the keyboard call and making it execute the command prompt. Neat hey!

by Edge Pereira

032789_NSASecretListener - NSA Secret Listener Service in Windows

I was debugging some services in one of my Azure servers when I came around the command sc which allows to communicate with the Windows Service Control Manager. My problem required me to retrieve the SID for my local SQL Server Service. To make a short a long story, I ended up playing around with the service names and IDs, such as the command below.

C:\>sc showsid trustedinstaller

Why I started doing this? for nothing. Sheer curiosity, fishing for something new to learn. Then I came across this service called “NSA Secret Listener”.

C:\>sc showsid 032789_NSASecretListener

Note that it has a hardcoded numeric value at the beginning, which I believe it was put there on purpose just so it does not become so obvious..but again why use the NSA name on it and why this prefix?

Obviously we can see that the service has the status: Inactive; however I am curious to see the reasoning behind it.

Another point: If I run the command to get the display description, it shows that the service does not exists. “Security by obscurity” maybe?




Anyone has any hints? I would love to know the ins-and-outs of it.

Women in IT

Percentage of women age 15 or up who participate in the labour force, around the world.

Pocket Supercomputers

Recommended car speed for city

The case for recommending a maximum speed of 30km/h within the CBDs.

New York Respect Cyclists, Pedestrians

Nice, clear message from New York city to its residents.

How Boot in Safe Mode on Windows 8

Back in the days when our Windows was slow or crashing we used to press F8 during boot and it would take us to something called “Safe Mode”, which is the minimum set of programs loaded just enough for windows to function. But if you try to do this in Windows 8, it does not work. There is no access to Safe Mode pressing F8. So, how to do it?

Just type “msconfig” in the start menu and when you get to this screen choose these options.

Additionally, by doing this, it allows you to perform a selective boot where you can disable which services should or shouldn’t be started.

Also it is great for PowerShell with enough power to do remote access to someone else’s computer, since you can’t remotely press F8 on other machines.

by Edge Pereira