I've a SF application with following structure.
Application1
- ServiceA -> Deployed to NodeType1
- ServiceB -> Deployed to NodeType2
- ServiceC -> Deployed to NodeType2
- ServiceD -> Deployed to NodeType2
ServiceA is a front-end service listening on TCP port and has some specific security requirements. Hence it is deployed on NodeType1.
Service B,C & D are back-end service, and deployed to NodeType2.
ServiceA requires NetworkServiceAccount to have access to a certificate which is installed only in NodeType1. And because this is not an endpoint certificate, I'm trying to define a SecurityAccessPolicy for this certificate resource. Initially I tried defining the following in AppManifest.xml.
<Principals>
<Users>
<User Name="SfServiceUser" AccountType="NetworkService" />
</Users>
</Principals>
<Policies>
<SecurityAccessPolicies>
<SecurityAccessPolicy ResourceRef="TLS Certificate" PrincipalRef="SfServiceUser" ResourceType="Certificate" />
</SecurityAccessPolicies>
</Policies>
<Certificates>
<SecretsCertificate X509FindValue="[TlsCertificateThumbprint]" Name="TLS Certificate" />
</Certificates>
While registering ApplicationType, it failed with "Service Fabric Error: Failed to ACL folders or certificates required by application. Error:FABRIC_E_CERTIFICATE_NOT_FOUND". This was because "TLS Certificate" is installed only in NodeType1, but SF was looking for this certificate in NodeType2 as well.
As a workaround, I tried defining SecurityAccessPolicy in ServiceManifestImport section of AppManifest.xml, as below.
<ServiceManifestImport>
<ServiceManifestRef ServiceManifestName="ProtocolGateway.Host.Fabric.FrontEndPkg" ServiceManifestVersion="1.0.0" />
<Policies>
<RunAsPolicy CodePackageRef="Code" UserRef="SetupAdminUser" EntryPointType="Setup" />
<RunAsPolicy CodePackageRef="Code" UserRef="SfServiceUser" />
<SecurityAccessPolicy ResourceRef="TLS Certificate" PrincipalRef="SfServiceUser" ResourceType="Certificate" />
</Policies>
</ServiceManifestImport>
But this failed with error too - "The ResouceRef 'TLS Certificate' in SecurityAccessPolicy is invalid. There is no matching Resource in the corresponding ServiceManifest."
Though SecurityAccessPolicy inside ServiceManifestImport section accepts ResourceType as Certificate, ServiceManifest doesn't support defining Certificate as a Resource. Only EndPoint is supported.
While I could define ServiceA in one ApplicationType and other services in a different ApplicationType, I don't intend to do that, as these are related services and I want to use SF versioning to manage upgrade and rollback.
Please suggest me alternate for handling this requirement.
Related
I am new to keycloak, I am using keycloak for both frontend and backend application but I am getting the different issuer in the token generated by keycloak when decoded in jwt.io.
Front end:
the issuer is the same as the base URL of the frontend application
For example:
If the front-end URL is https://example.org/portal then the issuer is the same as https://example.org/auth
Request via postman:
the issuer is the internal DNS name
I have tried below ways,
Proxy redirection(With preserve host) - Which generates the issuer with frontend base url.
Proxy redirection without preserving host - Which expects the private DNS to be resolved at front end application
Played around the keycloak configuration - updated frontendUrl to https://example.org/auth and forceBackendUrlToFrontendUrl to true which resulted in the same issuer both the backend and frontend but no hostname like https:/auth/relam/external(Refer #2 in reference).
Expected outcome:
I need the private DNS to be issuer it both the request from frontend and backend(for now it works direct backend request)
Thanks in advance.
Reference
https://github.com/keycloak/keycloak-community/blob/master/design/hostname-default-provider.md
Code block
<spi name="hostname">
<default-provider>fixed</default-provider>
<provider name="fixed" enabled="true">
<properties>
<property name="frontendUrl" value="https://example.org/auth"/>
<property name="forceBackendUrlToFrontendUrl" value="true"/>
</properties>
</provider>
</spi>
currently We have CAS SSO to our existing .net application, but now client is asking for Shibboleth SSO instead CAS. I'm totally new to Shibboleth.
Client has given the below details:
entityid= urn:mace:incommon:xxx.edu
metadata URL for test environment is:
https://shibboleth-test.xxx.edu/idp/shibboleth
By using guidelines from Shibboleth site, below are the steps i followed.
Installed Shibbolth Service provider (shibboleth-sp-2.6.1.4-win64.msi)
Installed Java with JCE
Installed Shibboleth Idp (in which jetty also checked)(shibboleth-identity-provider-3.3.3-x64.msi)
Web Application with self signed certificate
attached my Shibboleth2.xml file
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="180"> <InProcess logger="native.logger"> <ISAPI normalizeRequest="true" safeHeaderNames="true">
<Site id="2" name="shibboleth-test.xxx.edu" scheme="https" port="443" />
</ISAPI> </InProcess> <RequestMapper type="Native"> <RequestMap> <Host name="shibboleth-test.xxx.edu" scheme="https" port="443">
<Path name="secure" authType="shibboleth" requireSession="true"/>
</Host>
</RequestMap></RequestMapper><ApplicationDefaults entityID="urn:mace:incommon:xxx.edu" REMOTE_USER="eppn persistent-id targeted-id" cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2"> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https"> <SSO entityID=""urn:mace:incommon:xxx.edu" discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF"> SAML2 SAML1 </SSO>
<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1 <my system IP">/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<Errors supportContact="root#localhost"
helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/> <!-- Map to extract attributes from SAML assertions. --> <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationDefaults>
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
Problems I'm facing......
When i try to access https://shibboleth-test.xxx.edu/Shibboleth.sso/Status
getting error no metadataprovider available.
Noticed Problems:
1.when i try to add Metadataprovider Shibboleth daemon 2 service is getting
stopped and unable to start.if i remove it's is running.
2.Shibboleth Idp 3 deamon is getting stopped very frequently
When i run 'SC interrogate shibd_idp' in command prompt, results are
control service failed 1062
the service has not been started.
I donno what is wrong with my work.
Can any one please tell me what are the steps to be followed to accomplish this integration.
Thanks in advance,
Hema
There will be a tag in shibboleth2.xml called metadata provider, you will need to open that.
If you have done this but shill service is not getting started then you can check the log and give additional info in question.
Another reason I can think of is connection problem. Try downloading idP's metadata and store it physically in the SP configuration folder. Manually map the file, using following tag
<MetadataProvider type="XML" file="partner-metadata.xml"/>
All the issues has been resolved after we upgraded from Shibboleth 2.6 to 3.0.2. we are getting the Shibboleth Identity provider login page.We are able to see the attributes in Session.Now we are working on how to retrieve the attributes in our application and how to redirect to our application home page.Currently we created 1 sample html page under secure folder in our application. once we logged in we are able to this html page.But when i tried to redirect to our application home page, it's giving 500 error. Can any one knows like how to redirect to our app home page and retrieve the attributes in the application.
I have a guest executable service deployed to Service Fabric with the following Traefik tags:
<StatelessServiceType ServiceTypeName="MyServiceServiceType" UseImplicitHost="true">
<Extensions>
<Extension Name="Traefik">
<Labels xmlns="http://schemas.microsoft.com/2015/03/fabact-no-schema">
<Label Key="traefik.frontend.rule">PathPrefixStrip:/myservice</Label>
<Label Key="traefik.expose">true</Label>
<Label Key="traefik.frontend.passHostHeader">true</Label>
</Labels>
</Extension>
</Extensions>
</StatelessServiceType>
And the Traefik toml file is configured with the ServiceFabric backend as follows:
[serviceFabric]
clusterManagementUrl = "http://localhost:19080"
apiVersion = "3.0"
refreshSeconds = 10
However when i navigate to the traefik UI the service is displaying on the left hand side under the 'ServiceFabric' tab but the endpoints on the right hand side show no items in the table.
Is there something missing in order to get them to be displayed.
I have an existing WCF REST service running on an Azure Windows Server 2012 using IIS8. Let say 1x.2x.3x.4x:7777/InvService.svc/RESTquery is how my users currently use the service.
I am wanting to replace the IP address with a hostname, say www.testDomain.com so the user will can then use www.testDomain.com:7777/InvService.svc/RESTquery.
After obtaining the domain name from GoDaddy, assigning IP 1x.2x.3x.4x, and testing it (my default site on the server comes up, hence why I am using port 7777). When I try www.testDomain.com:7777/InvService.svc/RESTquery I get a "Connection Timed Out" error.
I believe I am needing to add or change something inside my Web.config file but cannot seem to find the right answer. Here is what my current unsuccessful Web.config file looks like.
<services>
<service name="WCFInventoryService.InvService">
<endpoint address="RESTquery" behaviorConfiguration="restPoxBehavior"
binding="webHttpBinding" contract="WCFInventoryService.IInvService" />
<identity>
<dns value="www.testDomain.com" />
</identity>
</endpoint>
<host>
<baseAddresses>
<add baseAddress="http://www.testDomain.com/"/>
</baseAddresses>
</host>
</service>
</services>
What am I doing wrong? or should try?
I solved my problem. The problem was how the domain was set up in GoDaddy. In the GoDaddy account, the domain was set up to forward to the IP address and not to point to. Once I removed the forwarding record and changed the A record to point to the IP address in the GoDaddy account, the WCF service was accessible by using www.testDomain.com:7777/InvService.svc/RESTquery
I am consuming an secured service hosted over basicHttpBinding
I have to pass credentials to the service for authenticatioon
Here’s the config setting for the client
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="None" proxyCredentialType="None"
realm="" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
While calling the service, I am getting following exception message
An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail.
Message = "An invalid security token was provided (Bad UsernameToken Values)”
I not sure how to get it working I am curious if somebody can help me out or provide me any url where I could find the solution
When you create your MyServiceClient object you can set the username and password on the clientInstance.Credentials.UserName object.