How to connect to Mongo Atlas from Robo 3T

If you use a local instance of MongoDB, you might be a great fan of Robo3T. However, if you are using Mongo Atlas, the Atlas web interface provides everything you need to manage the database.

If you want to continue your love with Robo3T, below are the detailed steps you need to follow:

• From the Atlas web dashboard, go to the Clusters tab. Click on the cluster and get the primary and secondary node address Ex: <<>>. mongodb.net:27017
• From the Clusters tab, click connect, select connect with mongo shell. Select the option “I don’t have mongo shell installed” and select version 3.4. From the connection set, find a replica set. <<>>net:27017/myFirstDatabase?replicaSet=atlas-vdequy-shard-0
•  Create a new connection. Type -> Replica set

• Name -> name of your choice
• Members -> cluster address from step #1
• Set Name -> replica set from step #2
•   Authentication tab, add user name and password.
•  Go to the TLS tab and select the option “Self Signed Certificate.”
•   Test your connection and save.

Azure B2C Custom Attributes

Azure B2C Custom Attributes

Azure B2C provides a set of built in user claims. As an example Given Name, Sur Name. However, every customer facing application has some unique requirements to collect additional attributes. As an example – collect business address.

Azure B2C provides an option to create custom attribute and the steps are defined here (https://docs.microsoft.com/en-us/azure/active-directory-b2c/user-flow-custom-attributes)

Example:

Once these custom attributes are defined, it will be available as part of Azure b2C user journeys (built in or custom) or it can be accessed (add, update) using Graph API.

However, Microsoft documentation on Graph API usage for custom attribute is not that clear.

Before explaining the Graph API approach for accessing custom attribute, let us look at how Azure B2C interacts with Azure Active directory to manage user data.

When an Azure AD B2C tenant is created, it creates a default application b2c-extension-app. This application can be found under the blade –> Azure AD B2C  -> App registration (Preview)

Azure B2C use the naming convention extension_<<this application id without dashes>>_custom attribute name to store the custom attributes.

Ex: extension_123456789107899533_BusinessName

To retrieve data using graph API, the following steps needs to be done:

Create an application that has access to Graph API or legacy AAD API.

For this navigate to Azure AD B2C -> App Registration Preview -> New Registration

 Provide API permission for Graph or legacy Azure AD API

1.  Select the app created at the previous step.
2.  Go to API permissions tab
3. Select Add API permission. From Microsoft API, select Graph or Azure Active Directory Graph
4. Add application permission. Select Directory. Based on the application requirement (read or write access), select the permission.
5. Once permission is added, provide admin consent. Select the button “Grant Admin permission for <<your AAD name>>
6.        Based on the API selected – Graph or legacy AAD, use the token end point to get an access token. Use content type - application/x-www-form-urlencoded

Graph:

AAD token end point

Get or update user data

Please note to send the token as part of Authorization header

More love towards Linux

My journey towards AZ solution architect needs more hands own with Linux. So, today (still on PTO and recovering from a medical procedure) I decided to find my old HP Envy 2008, the one which I had abandoned and install Linux - Ubuntu Desktop version.

The process took me an hour:
1. downloaded Ubuntu iso image
2. decided  to burn the image to a CD. If you would like to flash to a USB drive, there are a lot of applications available (https://unetbootin.github.io/)
3. Updated BIOS settings to load from the internal CD drive.

Fun time with Linux

After suffering a lot of chronic sinus issues, I had decided to do a sinus endoscopic procedure. After that I took a few days off from wok. Apart from fun times with my kids, I felt a little bored and started to play around with Linux as my first step towards AZ SA certification.

As the first step, I tried to install Centos on my laptop using Virtual box. Since its a new machine, I haven't installed Linux distro and planning to do that for the last few months.

When I opened virtual box, the 64 bit variant is missing and the below two steps bring back the 64 bit option.

1. enable Virtualization from the BIOS (based on the laptop model - for HP spectra series use esc key and F10.)
2. Turn off hyper V feature from windows features (turn windows features on or off)

More details can be found here - http://www.fixedbyvonnie.com/2014/11/virtualbox-showing-32-bit-guest-versions-64-bit-host-os/#.XUmqVvZFzOZ

Adding certificate permission for app pool

Go to mmc, select local computer and add certificate snap-in. 



From the personal store, select the certificate, right click → Tasks → Manage Private Keys and add permission to IIS_IUSRS and IIS AppPool\app pool name

HATEOAS provider for ASP.NET Core

When comes to API maturity model there are two major models:

1. Richardson Maturity Model

2. Amundsen Maturity Model.


To attain RMM 3.0, an API defines resources, respect HTTP protocol and provide self discover able links to  other resources.


To attain AMM 3.0, the APIs are focused on the actions the API affords and consumers can take.


So, to reach maturity level 3, the API or resource MUST provide an action or a list of  actions a client can identify on that API at the run time. This translates to HATEOAS.


While doing some research on Hypermedia As The Engine Of Application State(HATEOAS), I came across some great HATEOAS providers for ASP.NET Core, but they didn't quite fit my need, so I created my own one.


You can read more details from my github page 


- https://github.com/ajopjo/AspNetCore.HypermediaLinks

Headless CMS .NET Core

Inspired from Soctt Hanselman blog:

Most of the traditional CMS systems are monolithic, UI, back end systems, admin tools..etc. Since the world is rallying towards REST, headless CMS systems are becoming popular (integrate content via APIs).

A Headless CMS is a back-end only content management system (CMS) built from the ground up as a content repository that makes content accessible via a RESTful API for display on any device.

So, if you are doing some projects using ASP.NET Core, the below are the few headless CMS frameworks:

• https://github.com/jamesej/lyniconanc
• https://github.com/ButterCMS/buttercms-csharp
•  https://github.com/umbraco/Umbraco-CMS (ASP.NET web site is based on this)
•  https://docs.squidex.io/architecture/01-overview

Git flow simplified

I always get confused when it comes to git flow - from where to branch and merge. So, I kept the below cheat sheet.

• A develop branch is created from master
• A release branch is created from develop
• Feature branches are created from develop
• When a feature is complete it is merged into the develop branch
• When the release branch is done it is merged into develop and master
• If an issue in master is detected a hotfix branch is created from master
• Once the hotfix is complete it is merged to both develop and master

pic courtesy -> https://www.atlassian.com/git/tutorials/comparing-workflows/gitflow-workflow

.NET framework and ASP.NET , MVC and EF and WebAPI version cheat sheet

OSWAP (Open Source Web Application Security Project) Replay attack

OSWAP (Open Source Web Application Security Project) focused on improving the security of a software and they provides “OSWAP top 10”, a collection of most frequent vulnerabilities exist in a Web, IoT and mobile applications.

Everyone who develops web, mobile or any IoT project MUST know about OSWAP and you may be wondering why I am writing this post now. 

I lead an initiative to migrate the payment provider for our existing B2B and B2C portfolios. The following are the integration flows:

•  Application(s) use a back end service to authenticate with the payment provider and then authorize for the $ amount.

• The payment provider authorizes and redirects to an external hosting page to enter credit card details

•   After the payment, the third party provider redirects to an application page with the payment status.

•  Based on the payment status, an application can decide what's the next steps.

Since the payment provider redirects back to an application URL, there is a potential chance of a replay attack. An attacker can use the URL in another transaction.

To mitigate the risk, we used a token-based approach - a signed token is send to the payment provider during the authorization process. After the payment, the token will be send along with the redirect URL and on the confirmation page; the token will be invalidated so that the same token cannot be used in another session.

Change audio input and volume windows 10

Original post: https://www.hanselman.com/blog/AutomaticallyChangeYourAudioInputOutputAndVolumePerApplicationInWindows10.aspx


I use multiple headsets and I find it very hard to manage these headsets when I jump into conf calls.

The two utilities mentioned by Scott will be a life saver :)

Audio Switcher: A simple app runs as part of the notification area, that help you to switch default audio input and output devices. There is no down load available. You have to copy code from git and build it. Once build is completed, find the exe from the bin folder and run the AudioSwitcher.exe program.

https://github.com/davkean/audio-switcher

EarTrumpet:https://www.microsoft.com/en-us/p/eartrumpet/9nblggh516xp?activetab=pivot%3aoverviewtab

Converting Odata Specification to OpenAPI

Last week I was working on on-boarding a few SAP Odata APIs to API Management gateway. The APIM tool used by my organization supports JSON or YAMAL specification file to on-board an API.

So, I have reached out to OpenAPI team and they informed me that Odata will soon be part of OpenAPI and mean while the below mentioned tools/process can be used to convert Odata specification to OpenAPI specification

• Odata to Open API conversion tools are available at https://github.com/oasis-tcs/odata-openapi/tree/master/tools
•  Download or clone tools folder
•  Create a folder and name  examples at the same level as of “tools” folder. This folder is used to keep Odata Edmx files.
•  If you have node installed, install the following npm packages (for windows machine)
•   $ npm install -g node-gyp
•   npm install --global --production windows-build-tools
•  Once the above packages are installed, then open command window at the tools folder location and run npm install –g. This will install a few packages based on the package.json located at tools folder
•   Once the packages are installed, to convert Odata to Open API, run the command odata2openapi -drp <<MyMetadata.xml>> (The file MUST be inside examples folder)
•   By default the tool converts to Open API 3.0 specification. To convert to 2.0 (swagger) specification, use the below options

Options:

--basePath              base path (default: /service-root)

-d, --diagram           include YUML diagram

-h, --help              show this info

--host                  host (default: localhost)

-o, --openapi-version   3.0.0 or 2.0 (default: 3.0.0)

-p, --pretty            pretty-print JSON result

-r, --references        include references to other files

--scheme                scheme (default: http)

-u, --swagger-ui        URL of Swagger UI for cross-service references

• .      Once the file is converted, I used swagger editor and modified a few values and finally on-boarded it to APIM

HTTPClient for ASP.NET core 2.0

The following articles explain the issue using HttpClient class:

https://aspnetmonsters.com/2016/08/2016-08-27-httpclientwrong/

http://www.nimaara.com/2016/11/01/beware-of-the-net-httpclient/

As per ASP.NET 2.1 road map a default HttpClient Service will be available. Until the framework available, I'm using the below implementation of HttpClient

https://gist.github.com/ajopjo/796ddf8d2f44dd3dbf6268da179cb239

If you find any issues with the implementation, please let me know.

Integrating Serilog to ASP.NET Core

If you are not using the seri log configuration package and want to set up serilog based on app specific configuration use

webHostBuilder.ConfigureLogging((hostingcontext, logging) =>
            {
                var logSettings = new LogConfiguration();
//my custom section
                hostingcontext.Configuration.GetSection("LogSettings").Bind(logSettings);
                if (logSettings.Sink.Equals("rollingFile"))
                {
                    Log.Logger = new LoggerConfiguration()
                                     .MinimumLevel.Debug()
                                     .MinimumLevel.Override("Microsoft", Information)
                                     .Enrich.FromLogContext()
                                     .WriteTo.RollingFile(logSettings.Url)
                                     .CreateLogger();
                }
                else
                {
                    Log.Logger = new LoggerConfiguration()
                                    .MinimumLevel.Debug()
                                    .MinimumLevel.Override("Microsoft", Information)
                                    .Enrich.FromLogContext()
                                    .WriteTo.Seq(logSettings.Url)
                                    .CreateLogger();
                }

                var levelSwitch = new LoggingLevelSwitch();
                int.TryParse(logSettings.LogLevel, out var level);
                levelSwitch.MinimumLevel = (LogEventLevel)level;
                logging.AddSerilog(dispose: true);
            });

Autofac dependency injection per request based on header parameter ASP.NET Core2.0

   builder.Register(c =>
            {
                string dependencyName= c.Resolve<IHttpContextAccessor>().HttpContext.Request.Headers[Constants.CountryHeader];
             
                return c.ResolveNamed<interface>(dependencyName);
            }).InstancePerLifetimeScope();

and in the module
   protected override void Load(ContainerBuilder builder)
        {
            //register modules here
            builder.RegisterType<ClassName>().Named<Interfacer>("Name of dependency");
}

API Dev Ex Journey

When I had a chit chat with the business I'm working with, they told me often they see a lot of fraud transactions originating from one of the their  eCommerce B2C web sites. Most of the fraud transactions exhibit a pattern – either billing address or shipping address is invalid. The eCommerce site doesn’t implement  an address validation for billing or shipping address. If the validations do exist, without correcting the address issues a user cannot navigate to the payment page. So, I looked at some of the address validation services. As a developer what I did is relevant for any API seekers J

1.     Searchability/Discoverability of an API

As the first step, a developer MUST go to any available search engines and hunt for an API they are interested in. So, if we are doing any commercial APIS, it’s very important to make sure that the APIS are ranked properly by the search engines and it MUST bubble up when a user search for any API related key words.

2.     API documentation

After the API hunt, I found a lot of companies, UPS, USPS, Experian, Smart streets offer address validation service. Various criterions I used to weigh the API offerings from different companies are:

1.     How easy and fast I can apprehend the APIs

2.     Simplicity of API methods, request and response – From smarty street, most of the APIS, request and response object are self-explanatory. I don’t even  go through their API documentationsJ - I think the APIs directly talk with the developer.

3.     Try it yourself – After reading the APIs, the immediate step a developer took is to see the APIs in action. Some API providers provide a try it now link that  allows a user to test the APIs without logging in or without even request for an API key.
Able to try out an API without logging in or providing 100 steps of information is another key aspect of Dx.

3.     Integration

Another criteria I considered is how easily I can integrate the APIs to my application. For this, I look for any SDKs available from the API provider. Most of the companies provides SDK that supports various programming languages.  Another aspect I considered is, how often the APIs are versioned and how often the companies publish their SDKs.

Other aspects like, cost of usage (fixed vs pay per use), support …etc are considered. However, I wish to share the above three core aspects. Please share your thoughts?

Get Solarized

I was watching Scott Hanselman and Maria's MVA course and Scott's command prompt looks eye catchy and later I've read his blog on getting solarized.

https://www.hanselman.com/blog/GetSolarizedAwesomeCommandPromptColorsForVSVSCodeCmdPowerShellAndMore.aspx

If you prefer an awesome command prompt, VS code or VS,  refer his blog. In short:

For command prompt, I downloaded the package and installed the dark theme

regedit /s solarized-dark.reg

VS code was pretty easy

Short cut for Theme - Ctrl +K, Crtl +T  and select solarized theme

Visual Studio Console:

Refer - https://github.com/leddt/visualstudio-colors-solarized

Man in the Middle Attack (MitM) Troy Hunt webinar

Great talk, explained why companies need to plan to use HTTPS (TLS use interchangeably :))

• MitM attack from the router, ISP.
• Content injection on an insecure page (HTTP)
• HTTP2 works with TLS. H2 protocol loads resources very fast  (httpvshttps.com)
• All major browsers are planning to show warning, not secure on form fields, that will scare the end customer away from using the websites.
• chrome://flags/ - you can change settings to explicitly show when a connection is not secure
• Trust on First use (TOFU) problem
• Add secure header, set the max age, include sub domains, preload hsts
• hstspreload.org - registering HSTS, refer submission requirements

Dream and project

I read an interesting article about dreams. From wiki - A dream is a succession of images, ideas, emotions, and sensations that usually occur involuntarily in the mind during certain stages of sleep.

Most of the IT projects are a result of a dream, an idea. A dream occur in the REM stage of the sleep and it lasts for a few seconds or minutes. During a dream, I can watch a full length colorful movie, Avatar, in a few seconds. In reality, Avtar took 10 years to make - http://tech.firstpost.com/news-analysis/avatar-took-10-years-to-make-we-wonder-why-12779.html

As I mentioned any projects are a result of a dream. To materialize the dream, it takes considerable effort and time, else the dream turns into a failed project.

In my experiences, the team wants to execute the ideas as they see in their dreams and the best way to execute is "Agile".  I don’t complain agile is wrong, you need some discipline while doing agile projects, may be Disciplined Agile Development (big fan of it). However, the team usually forget the time and effort needed to plan the project - drafting a proper screen play, identify the right actors, actresses, technicians, the locations.......

I had worked in a project where the team wants to build a cool idea, so the business said (directed) - let’s use this vendor, let’s use this component and let’s integrate things together. End of the story, the vendor never understood what they are building, the internal team never analyzed what's the external provider offers and the one month project (integration of components) took three months and I don't know whether the project is materialized. I forgot to mention, there is another team who does UI :) and if you ask anyone what they are trying to achieve, you will get different opinions and the only person who knows the end goal is the "test lead" for that project.

So, bottom line is - dream takes a few seconds to minutes. A successful project needs right vision, right people, proper planning and a good team attitude :)

Create a meeting by using the EWS Managed API

Our team has used EWS API's Appointment service to book a meeting room. During our testing, its been  noted that  the room was not blocked on the exchange server and  over lapping meetings can be booked for that room.

I had gone through the code and found that the meeting room was added as part of the required attendees list
meeting.RequiredAttendees.Add("roomid@contoso.com");

In this case, the room  has to accept the request so as to get the calendar blocked. The MSDN document didn't give any clue to add a meeting room. It specifies a "Location" field, however it wont block the meeting room for the specified time range.

https://msdn.microsoft.com/en-us/library/office/dn495611(v=exchg.150).aspx

After a few trail and error, we found that, the meeting room must be added as part of the resources
 meeting.Location = "Location name";
meeting.Resources.Add("roomid@contoso.com");

Updated Code -  assuming an exchange service object has been created:

Appointment meeting = new Appointment(service);

// Set the properties on the meeting object to create the meeting.
meeting.Subject = "Team building exercise";
meeting.Body = "Let's learn to really work as a team and then have lunch!";
meeting.Start = DateTime.Now.AddDays(2);            
meeting.End = meeting.Start.AddHours(4);
meeting.Location = "Conference Room 12";

meeting.Resources.Add("ConferenceRoom12@contoso.com");

meeting.RequiredAttendees.Add("Mack@contoso.com");
meeting.RequiredAttendees.Add("Sadie@contoso.com");
meeting.OptionalAttendees.Add("Magdalena@contoso.com");
meeting.ReminderMinutesBeforeStart = 60;

// Save the meeting to the Calendar folder and send the meeting request.
meeting.Save(SendInvitationsMode.SendToAllAndSaveCopy);