Azure App Service Managed Cert Bindings

Recently we've been experiencing issues adding domain bindings to our app services that are hosted behind traffic manager.

Key Takeaways

• Azure seriously struggles and often fails to attach app service bindings to the Traffic Manager instance that they sit behind.  This used to work fine, but recently started failing.  When we configure geo-redundant app services, host them behind a Traffic Manager that uses Performance routing, and then try to assign SSL bindings to the Traffic Manager hostname using App Managed Certs the process almost always fails (and takes a long time to do so). 
• To get Traffic Manager bindings you must use Priority routing in Traffic Manager and you'll only then be able to apply bindings to the instance that is the top priority.  You must then cycle through each app service updating the bindings for each service when it's configured as the most prioritized route.
• Custom Domain names work fine.  Bindings get applied just fine using TM Performance based route even with App Managed Certs.  These certs all get deployed quickly without issue.  This is the part that's a bit confusing and that Microsoft Support failed to explain.

Learnings as of February 2022

.NET 6.0 Overview

https://andrewlock.net/series/exploring-dotnet-6/

SameSite settings that broke our login page

https://devblogs.microsoft.com/dotnet/upcoming-samesite-cookie-changes-in-asp-net-and-asp-net-core/

Covid Standard Time

Covid Standard Time

Latest as of 10/26/2021

Recently I've been working with the following:

Azure Managed Certificates

• Azure Managed Certificates became GA in March of this year.  I've now used them across dozens of my personal and business services to bind to custom domain names and to Traffic Manger.  They're really handy.

Azure Resource Locking

• Finally implemented Azure Resource Locking for all my team's resources.   On my old team the developers had limited permissions when it came to creating, editing, and deleting resources.  However, on my new team the developers have Contributor access so can accidentally or maliciously edit and delete resources.  I implemented Resource Locks in our pipelines to prevent accidental changes to our resources.   This helps me sleep at night.   Our automated pipelines could always re-deploy most resources.  However, there'd be downtime if Compute got deleted or broken and there'd much worse implications if our Data resources got deleted.

Azure DevOps Whitelisting ServiceTags

• I also just implemented IP Whitelisting for Azure DevOps.  This used to be hard or impossible, but as of recently there are service tags for AzureDevOps.

Latest Happenings as of June 2021

 Azure B2C

• Azure B2C is an Identity provider used by businesses to manage their customer accounts.  I've been using this at work now and having some fun learning some new tech.

Azure App Service Certificates

• For a long time now SSL certificates have been available for free from LetsEncrypt.  Now they're free from Azure as well.  As of May 25, 2021 Azure App Managed Certificates are Generally Available.  I'm not using these for a variety of services and have used them to bind my applications to both custom domain names as wells as Azure host names for Traffic Manager.

Tools

• Medelio: a free open-sourced UML and BPMN modeling tool.  
• Stoplight Studio: Open API modeling tool. 

Finds:

• API Intersection Podcast: hosted by the folks at Stoplight, this podcast dives into best practices around API design.  It's fairly new and seems to include new episodes every Thursday.  Perfect for my summer lunch jogs.

How to Link a Custom Domain to My Okta Tenant

 I have a developer tenant in Okta and would like to add a custom domain.  This should be possible, all I need is a few things:

1. A Developer Okta tenant
2. My own custom domain
3. A certificate, which I will get by using Lets Encrypt

Error retrieving certificates from Azure Key Vault

When retrieving certificates from Azure Key Vault I get the following error in my .NET Core 3.1 app service.  The file is read from the Key Vault just fine, but throws an exception when converting the secret to a x509 certificate:

Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException at Internal.Cryptography.Pal.StorePal.FromBlobOrFile

VERY Slow Windows 10 Right Click

For a while now whenever I R-click in my Windows 10 File Explorer the system hangs for about 10 seconds and then finally responds.  I've cleaned out a few of the programs that show up in the context menu, but no luck.  I just found this article, which sounds promising.

https://www.raymond.cc/blog/fix-for-very-slow-or-hang-when-right-click-on-a-file-or-folder/

Awesome!! This worked.  Following these steps and running ShellXView to see the context menu programs was VERY eye opening.  There are about 40 programs using the context menu.  In my case it was TortoiseGit that was slowing me down.  Once I realized that it was the culprit, I uninstalled it (since I no longer need it) and now my life is 1000% times better.  R-click is lightning fast again. 

Azure ARM Template Error Deploying Certificate From Key Vault: The parameter certificateEnvelope.Properties.KeyVaultId has an invalid value.

I've been deploying an App Service along with an SSL certificate that's stored in a Key Vault.  After renaming the Key Vault, I've been getting the following error when deploying the SSL certificate to my App Service via an ARM Template.

"The parameter certificateEnvelope.Properties.KeyVaultId has an invalid value." 

"Message": "The parameter certificateEnvelope.Properties.KeyVaultId has an invalid value."

To get this fixed, I had to delete the App Service, which I think fixed the problem because it removed the certificate that was deployed from the original Key Vault altogether from Azure.

Here's the article that helped solve my issue:

https://peter.orneholm.com/post/155342103823/using-azure-key-vault-with-azure-web-apps-the

C# / .NET - The breakpoint will not currently be hit. No symbols have been loaded for this document

I recently couldn't figure out why my breakpoints weren't working in a sample project that I downloaded from GitHub.  When I'd hover over my breakpoints, I'd see the following message:

The breakpoint will not currently be hit. No symbols have been loaded for this document

Could not load file or assembly Microsoft.Data.Entity.Build.Tasks.dll or one of its dependencies

I created a new project in Visual Studio 2015 and when I attempted to build, received the following error:

The "EntityClean" task could not be loaded from the assembly c:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll.
Could not load file or assembly 'file:///c:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll' or one of its dependencies

Running Node.js (npm) behind a proxy

At work I've installed and used node.js (npm) several times.  Every time I use npm it generates the following errors when it's first run:

    
    npm ERR! network connect ETIMEOUT
    npm ERR! network This is most likely not a problem with npm itself
    npm ERR! network and is related to network connectivity.
    npm ERR! network In most cases you are behind a proxy or have bad networ settings.
    npm ERR! network
    npm ERR! network If you are behind a proxy, please make sure that the
    npm ERR! network 'proxy' config is set properly.  See: 'npm help config'

These errors indicate that you Here's how I fixed it. It turns out to be pretty basic. npm uses a series of configuration settings, which can be accessed by using npm config as follows:

• call npm config list to see all of the current configuration settings
• call npm config get to retrieve the value a specific configuration setting
• call npm config delete to remove a specific configuration setting
• call npm config set to set a value for a specific configuration setting

So to fix my problem behind the firewall, I just needed to run two commands to configure my proxy:

npm config set proxy http://proxy.mycompanyname.com:8080
npm config set https-proxy http://proxy.mycompanyname.com:8080

The type 'DbContextOptionsBuilder' is defined in an assembly that is not referenced. You must add a reference to assembly 'EntityFramework.Core

I'm building my first ASP.NET 5 application.  I've added my references to my project.json file, but when I added the latest 7.0.0-rc1-final SQL references it broke my DbContextOptionsBuilder class.  I get the following error:

The type 'DbContextOptionsBuilder' is defined in an assembly that is not referenced. You must add a reference to assembly 'EntityFramework.Core'

Here's what my project.json file originally looked like after I updated several of the SQL references to 7.0.0-rc1-final.  The EntityFramework.SqlServer didn't have a 7.0.0-rc1-final version:

  "dependencies": {
    "Microsoft.AspNet.IISPlatformHandler": "1.0.0-rc1-final",
    "Microsoft.AspNet.Mvc": "6.0.0-rc1-final",
    "Microsoft.AspNet.Server.Kestrel": "1.0.0-rc1-final",
    "Microsoft.AspNet.StaticFiles": "1.0.0-rc1-final",
    "Microsoft.AspNet.Mvc.TagHelpers": "6.0.0-rc1-final",
    "EntityFramework.Core": "7.0.0-rc1-final",
    "EntityFramework.Commands": "7.0.0-rc1-final",
    "EntityFramework.SqlServer": "7.0.0-beta8"
  }

Fix:  It turned out that theEntityFramework.SqlServer got renamed to EntityFramework.MicrosoftSqlServer.  Once I referenced the new name, my errors went away.  Here's my updated dependency list.

  "dependencies": {
    "Microsoft.AspNet.IISPlatformHandler": "1.0.0-rc1-final",
    "Microsoft.AspNet.Mvc": "6.0.0-rc1-final",
    "Microsoft.AspNet.Server.Kestrel": "1.0.0-rc1-final",
    "Microsoft.AspNet.StaticFiles": "1.0.0-rc1-final",
    "Microsoft.AspNet.Mvc.TagHelpers": "6.0.0-rc1-final",
    "EntityFramework.Core": "7.0.0-rc1-final",
    "EntityFramework.Commands": "7.0.0-rc1-final",
    "EntityFramework.MicrosoftSqlServer": "7.0.0-rc1-final"
  }

The dependency Microsoft.AspNet.Mvc >= 6.0.0-rc1-final could not be resolved.

I got this error when adding MVC to my ASP.NET 5 project.   My project.json contained the following dependencies, and I was getting an error that it couldn't resolve the second one.

  "dependencies": {
    "Microsoft.AspNet.IISPlatformHandler": "1.0.0-rc1-final",
    "Microsoft.AspNet.Mvc": "6.0.0-rc1-final",
    "Microsoft.AspNet.Server.Kestrel": "1.0.0-rc1-final",
    "Microsoft.AspNet.StaticFiles": "1.0.0-rc1-final"
  },

The error I was getting was:

The dependency Microsoft.AspNet.Mvc >= 6.0.0-rc1-final could not be resolved.

Fix:

It turned out that I just needed to run "dnvm upgrade " from my command prompt with VS closed.

Once I'd run this command, VS then resolved the dependency correctly.

Your Are Not Authorized to access visualstudio.com

I can't login to Team Foundation Server from within Visual Studio, I get the following error:

"Your Are Not Authorized to access visualstudio.com"

Invalid Configuration Files for locally hosted applications

After moving to a new PC and re-hosting my applications in local IIS, I was getting errors that the configuration file was invalid or couldn't be read.  

Error occurred during a cryptographic operation. System.Security.Cryptography.CryptographicException: Error occurred during a cryptographic operation.

I build a web application that worked in Dev and QA, but then demonstrated some unpredictable behavior in production, where it was load balanced between 2 servers.  The error log reported the following error:

Error occurred during a cryptographic operation.
System.Security.Cryptography.CryptographicException: Error occurred during a cryptographic operation.
   at System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.HomogenizeErrors(Func`2 func, Byte[] input)

This has to do with the Machine Key, which is used for decrypting and encrypting resources.  By default, the machine key is auto-generated by IIS.  The default works fine if your application is only running on one server.  But if the application is hosted across multiple servers, the application needs to be configured to use the same Machine Key across all servers.

I found a bunch of posts about this error.  I then populated a web.config section for my application that looked like this:

    <machineKey 
        decryptionKey="ABCDEFGH....." 
        validationKey="ABCDEFGHIJKLMNOPQRSTUVWXY....." 
        validation="SHA1"
        decryption="Auto"
    />

This key belongs in the <system.web> section.

I generated the keys using IIS:
http://docs.orchardproject.net/Documentation/Setting-up-a-machine-key

Here is the post related to this issue:
http://stackoverflow.com/questions/3855666/adding-machinekey-to-web-config-on-web-farm-sites

Github error through proxy: Failed connect to github.com:443

I was trying to clone a Github repository from behind a proxy.  I kept getting connection errors,

fatal: unable to access 'https://github.com/Netflix/ice.git/': Failed connect to
 github.com:443; No error

This is how I fixed it.

405 Method Not Allowed in my Web API

Today I went back to an existing project that I spend my time on and I started getting errors when doing PUTs to my Web API.  The errors didn't happen before, but I've now pulled down the latest code so something's changed.

SQL Server Alias

Our team of several developers is building an application connects to SQL Server.  Well all have local instances of SQL Server, but the connection strings vary from developer to developer.  Rather than having each developer use a different connection string, we figured we'd configure SQL Server Aliases on each of our PC's so that we could all use the same connection string.

This approach worked well.  It took a little fiddling to get my local alias working, so I figured I document the steps here.

SQL-89 versus SQL-90 JOIN Syntax - What's the Difference???

What's the advantage of using the "JOIN" syntax when joining SQL tables???

I work in a mixed environment where we use both SQL Servers and Sybase Servers.

All of the SQL Server developers write their joins using the SQL-92 syntax like this:

    SELECT c.name, a.state FROM 
        Customers c JOIN Address a ON c.CustomerId = a.CustomerId

But all of the Sybase developers continue to write their joins using the SQL-89 syntax like this:

    SELECT c.name, a.state FROM Customers c, Address a
        WHERE c.CustomerId = a.CustomerId

I don't see much difference on these smaller queries, but I always get frustrated trying to read the SQL-89 syntax on larger queries.  What's the difference and why do developers still use SQL-89 syntax???