<b>ars Technica:</b> "GNOME has attracted a vibrant community of open source artists who are collaborating to produce aesthetically sophisticated visual styles for the desktop environment"
<b>Eleven is Louder:</b> "I was reading through some news on Google and came across this article on bild.de. The Commodore 64 is due to be rereleased with an Intel Core 2 Quad, 4GB RAM, a 500GB HDD, Intel chipset, and a bunch of other features."
Google patches Chrome for eight vulnerabilities that could have left users at risk. The fixes come just as white hat hackers are set to go to town in a vulnerability search contest.
From usual suspects like Apache, Google and Sun and some lesser-known players, January 2010 brought a steady stream of code releases for Java and open source developers' toolboxes.
<b>fsckin w/ linux:</b> " Awhile back I read the small print about Microsoft’s Moonlight software distribution. It specifically mentions the stuff they don’t like about the GPLv3. Interesting. Let’s see what they are worried about."
From usual suspects like Apache, Google and Sun and some lesser-known players, January 2010 brought a steady stream of code releases for Java and open source developers' toolboxes.
The latest threat to data center security isn't really an IT threat at all. Today's biggest threat is an underground economy fueled by stolen data and the pursuit of maximum criminal financial gain.
We're using MapKit on an iPhone app to display a Google Map with terrain view. However, the terrain view only shows when the user has an active Internet connection, the moment the user's Internet is off, the terrain on the map disappears and it appears flat.
Is there any way to keep the terrain view on even when the user isn't on an active internet connection?
Thanks!
Adam
As discussed in the introduction article this walkthrough will explain how you can implement WCF security with the Windows Azure Service Bus to ensure that you can protect your endpoint in the cloud with a shared secret but also flow through a username token so that in your listening WCF service you will be able to identify who sent the message. This could either be in the form of an application or a user depending on how you want to use your token.
Prerequisites
Before going into the walk through I want to explain a few assumptions about the scenario we are implementing but to keep the article shorter I am not going to walk through all of the steps in how to setup some of this.
In the solution we have a simple console application which will represent the client application. There is also the services WCF application which contains the WCF service we will expose via the Windows Azure Service Bus.
The WCF Service application in this example was hosted in IIS 7 on Windows 2008 R2 with AppFabric Server installed and configured to auto-start the WCF listening services. I am not going to go through significant detail around the IIS setup because it should not matter in relation to this article however if you want to understand more about how to configure WCF and IIS for such a scenario please refer to the following paper which goes into a lot of detail about how to configure this. The link is: http://tinyurl.com/8s5nwrz
The Service Component
To begin with let's look at the service component and how it can be configured to listen to the service bus using a shared secret but to also accept a username token from the client. In the sample the service component is called Acme.Azure.ServiceBus.Poc.UN.Services. It has a single service which is the Visual Studio template for a WCF service when you add a new WCF Service Application so we have a service called Service1 with its Echo method.
Nothing special so far!....
The next step is to look at the web.config file to see how we have configured the WCF service.
In the services section of the WCF configuration you can see I have created my service and I have created a local endpoint which I simply used to do a little bit of diagnostics and to check it was working, but more importantly there is the Windows Azure endpoint which is using the ws2007HttpRelayBinding (note that this should also work just the same if your using netTcpRelayBinding).
The key points to note on the above picture are the service behavior called MyServiceBehaviour and the service bus endpoints behavior called MyEndpointBehaviour. We will go into these in more detail later.
The Relay Binding
The relay binding for the service has been configured to use the TransportWithMessageCredential security mode. This is the important bit where the transport security really relates to the interaction between the service and listening to the Azure Service Bus and the message credential is where we will use our username token like we have specified in the message/clientCrentialType attribute.
Note also that we have left the relayClientAuthenticationType set to RelayAccessToken. This means that authentication will be made against ACS for accessing the service bus and messages will not be accepted from any sender who has not been authenticated by ACS.
The Endpoint Behaviour
In the below picture you can see the endpoint behavior which is configured to use the shared secret client credential for accessing the service bus and also for diagnostic purposes I have included the service registry element.
Hopefully if you are familiar with using Windows Azure Service Bus relay feature the above is very familiar to you and this is a very common setup for this section. There is nothing specific to the username token implementation here.
The Service Behaviour
Now we come to the bit with most of the username token bits in it. When you configure the service behavior I have included the serviceCredentials element and then setup to use userNameAuthentication and you can see that I have created my own custom username token validator.
This setup means that WCF will hand off to my class for validating the username token details. I have also added the serviceSecurityAudit element to give me a simple auditing of access capability.
My UsernamePassword Validator
The below picture shows you the details of the username password validator class I have implemented. WCF will hand off to this class when validating the token and give me a nice way to check the token credentials against an on-premise store.
You have all of the validation features with a non-service bus WCF implementation available such as validating the username password against active directory or ASP.net membership features or as in my case above something much simpler.
The Client
Now let's take a look at the client side of this solution and how we can configure the client to authenticate against ACS but also send a username token over to the service component so it can implement additional security checks on-premise.
I have a console application and in the program class I want to use the proxy generated with Add Service Reference to send a message via the Azure Service Bus. You can see in my WCF client configuration below I have setup my details for the azure service bus url and am using the ws2007HttpRelayBinding.
Next is my configuration for the relay binding. You can see below I have configured security to use TransportWithMessageCredential so we will flow the username token with the message and also the RelayAccessToken relayClientAuthenticationType which means the component will validate against ACS before being allowed to access the relay endpoint to send a message.
After the binding we need to configure the endpoint behavior like in the below picture. This is the normal configuration to use a shared secret for accessing a Service Bus endpoint.
Finally below we have the code of the client in the console application which will call the service bus. You can see that we have created our proxy and then made a normal call to a WCF service but this time we have also set the ClientCredentials to use the appropriate username and password which will be flown through the service bus and to our service which will validate them.
Conclusion
As you can see from the above walkthrough it is not too difficult to configure a service to use both a shared secret and username token at the same time. This gives you the power and protection offered by the access control service in the cloud but also the ability to flow additional tokens to the on-premise component for additional security features to be implemented.
Sample
The sample used in this post is available at the following location:
https://s3.amazonaws.com/CSCBlogSamples/Acme.Azure.ServiceBus.Poc.UN.zip
<b>Linux Journal:</b> "Last month's release of the KDE 4.4 desktop environment restored the faith of many after what has been something of a roller coaster two years."
When a full-blown commercial WAFS implementation is more than you need, consider open source alternatives using FreeBSD, Linux and a number of helpful tools.
The rugged switches and routers that drive networks on oil rigs, power stations and research operations in Antarctica don't always feature high-end enterprise capabilities. Sixnet is out to change that.
<b>Intellectual Property Watch:</b> "“Apple is selling directly to consumers, who aren’t the best guardians of their own self-interest. The open PC model works for knowledgeable users who know what they are doing and how to protect themselves, but not so for 15-year-old fashionistas and techno-phobic geriatrics,” Kahney said."
The Linux/Free Software/Open Source world is cram-full of first-class security applications. Best of all, they're not just for Linux, but protect Mac and Windows too. Cynthia Harvey collects 75 to share with us.
If you don’t know where to start when setting Oracle auditing parameters, just start with what Oracle recommends. In this article, we set the default auditing as recommended by Oracle.
<b>Computerworld UK:</b> "The big announcements by Facebook last week have started alarm bells ringing around the Net. Here's the kind of thing that is sending shivers down many people's spines:"