Category Archives: Windows

Ay of Microsoft’s Operating Systems. From Windows Server 2000 up to the most modern and their client operating systems.

Philips Hue PowerShell

I’ve been quietly working on a little project (or two) of my own on GitHub since I got some Philips Hue lights a while back.

Philips makes accessing the bulbs programmatically very easy with the API that exists on the Bridge device but I wanted a scriptable solution to allow me to exert much more fine grained logic control over the states and colours of my lights.

Being pretty advanced with PowerShell (at least, I think I am), I set about writing a PowerShell interface (not a GUI) to allow me to access the properties and set the state of my Hue lights.

The result is a PowerShell 5 class that simplifies the interaction with Philips Hue bulbs and lights that I’ve dropped on to GitHub for use by any and all. I realise this is focussed purely on Windows users but that’s what I am and I use PowerShell extensively for other things too.

The project is called PoSHue and is located on GitHub.

It allows you to do things like this from PowerShell.

Feel free to have a look and see how you can use it. Just 4 lines and you’re off and running.

HueLight

One example is something I’m using the classes for currently but is logically quite complicated. The script executes on a schedule, that schedule is set from the previous execution and is obtained from an API call to a service providing sunset times. The script turns the lights on just before sunset but only if me and/or my fiancee are home.

I then have a second script which is executed by the “turn lights on if it’s sunset and people are home” script which monitors if we go out. If we go out, the lights are turned off by this script and, so long as it’s before 23:00, the turn lights on only if we’re home script is executed again to wait for us to come home again.

Basically, the scripts work in conjunction and cyclically to ensure the lights don’t turn on before sunset and only when we’re home and they also turn the lights off if we go out but would turn them on again if we came home before 23:00.

Let me know if you’d be interested in seeing the scripts and tasks (yes they’re scheduled tasks that monitor for return events from the scripts!) and I’ll see what I can do about packaging them up somewhere.

-Lewis

 

 

Filtering objects from Azure Active Directory

Microsoft recently made Azure AD Connect generally available and in doing so introduced a method for filtering users based on their membership in a specific group. Unfortunately, this is considered a pilot mode for Azure AD Connect – this means that if you wish to permanently filter objects based on their group membership, you’ll forever be in pilot mode. Another caveat is that you cannot change this group easily. You would need to remove Azure AD Connect and re-install it to select a different group. Indeed if you upgraded from Azure Active Directory Sync Services as I did, this option is completely unavailable to you unless you’re willing to remove and re-install Azure AD Connect.

The reason, as far as I can ascertain, is that there is no attribute of a user object that looks like memberOf on which you can perform some logical decision with the Synchronization Rules Editor.

So how do we filter? There are three methods: Domain, OU and Attribute. In my getting started with Azure Active Directory Sync Services series earlier this year, I showed how to do both of these. The first, Domain, is the obvious one. If you want objects from a domain, you would attach to it during installation. The second, OU, is buried a little deeper inside miisclient.exe but it’s something I’ve demonstrated already in my getting started guide, so I’m not going to cover old ground. The third, Attribute, is what this post is about.

When I say user attribute, what do I mean? These:

Simply put, we’re able to filter objects that are to be synchronised with Azure AD using these attributes. I’m going to demonstrate how users can be filtered in the following steps and I’m also going to demonstrate a method of using PowerShell in conjunction with the attribute filtering rule to enable the use of group membership to identify who should get an Azure AD account – pseudo group filtering. Continue reading Filtering objects from Azure Active Directory

Integrating SimpleSAMLphp with ADFS 2012R2

In my previous two posts, I’ve discussed two solutions for using Azure Active Directory authentication from a bespoke PHP web application.

In the first post I essentially re-wrote an article that originally was written on the Azure website which unfortunately no longer seems valid (EDIT 07/2016: Has since been completely removed!). The solution written there used SimpleSAMLphp and libraries written by Microsoft to implement WS-Federation for authenticating custom PHP applications with Azure AD. My first post clears up some issues and demonstrates a more logical method of configuring SimpleSAMLphp on IIS.

In my second post, I showed a more elegant solution that did away with the Microsoft WS-Federation libraries and used only SimpleSAMLphp and SAML2 to authenticate a custom PHP application with Azure Active Directory. I also showed how you can configure an Azure application to pass through groups claims in the token.

In this third (and hopefully final) post, I’ll combine components of the two previous posts and demonstrate how you can use SimpleSAMLphp to integrate directly with ADFS 2012R2.

Pre-requisites

  • A working ADFS 2012R2 implementation.
    Apologies but this isn’t something I’ve blogged about yet (I will, soon). For now, there are plenty of fantastic articles on setting up ADFS out there but when you do it, make sure you’re setting up ADFS 2012R2 (It’s on Windows Server 2012R2 of course). Why am I telling you to set it up on Windows Server 2012R2? Simple, Alternate Login ID.
  • Access to a Linux box with an updated version of OpenSSL.
    OK, so strictly you don’t need a Linux box – it’s just easier if you have access to one. We need to generate a certificate and key for token signing purposes and fiddling with installations of OpenSSL on Windows isn’t something I want to document. Spin one up in Azure and bin it once you’re done with it!

Continue reading Integrating SimpleSAMLphp with ADFS 2012R2

Single Sign-on to Azure AD using SimpleSAMLphp

In my last mammoth post, I posted an update/re-write to an article originally written on the Azure website that used some libraries provided by Microsoft to enable custom PHP applications to sign-on to Azure AD using WS-Federation. In that post I described a method for installing and configuring SimpleSAMLphp to IIS that enables it to be used by any number of sites on the same server, all that’s required is to add a simple Virtual Directory to each site. If you want to configure SimpleSAMLphp on IIS, check that post out.

The intention with this post is to do away with Microsoft’s libraries altogether and use only SimpleSAMLphp in a more integrated way. The purpose is to avoid having to re-write a lot of functionality already provided by SimpleSAMLphp that’s likely to be missing from Microsoft’s libraries, and of course open up access to SimpleSAMLphp’s documented API.

I will assume you have configured SimpleSAMLphp already using the method documented in the last post. In order to proceed in this post, you also need to have configured an application within Azure Active Directory. Again, you can find instructions for that included in the previous post.

The largest difference with this post is, as I mentioned, better integration with SimpleSAMLphp – as such, there’s more configuration to complete within SimpleSAMLphp than there was in the previous post.

  • We’ll import federation data from our Azure application in to SimpleSAMLphp.
  • We’ll configure SimpleSAMLphp as a Service Provider.
  • We’ll create a little code to get us authenticating.

Continue reading Single Sign-on to Azure AD using SimpleSAMLphp

Single sign-on with Azure AD in PHP

So, what’s this massive post about? I recently read an article on the Azure website about using Azure AD authentication with bespoke PHP applications. While the article is quick and concise – it has a number of serious issues.

First and foremost, the end result is that the solution just doesn’t work. It obviously took the writer a good amount of time to write the code for the article (assuming he did that is) but despite that, it has suffered from bit rot and a lot of people have tried and failed to use the article as a learning tool.

I’d still suggest using the article as reference material – everything has its value at the end of the day but if you do actually want custom PHP applications with Azure AD authentication to work, that article won’t give you a working solution. I’ve re-written the article and explained a few more of the concepts and expanded on a few decision points that are useful to the reader while doing battle with the code and its bit rot.

As per the original article’s introduction:

This tutorial will show PHP developers how to leverage Azure Active Directory to enable single sign-on for your own custom PHP applications. You will learn how to:

  • Install and configure SimpleSAMLphp on to an IIS web server.
  • Obtain and edit the necessary sample code associated with the original article.
  • Create and configure a custom Azure application inside Azure AD.
  • Protect the application (err, page) using WS-Federation.
  • Demonstrate actual authentication with Azure AD as well as federated authentication with an on-premises domain via Azure AD.

Continue reading Single sign-on with Azure AD in PHP

Upgrading to Azure AD Connect from AADSS

Microsoft recently released to GA (Generally Available) Azure AD Connect which is a much simplified installation and replacement for DirSync and Azure Active Directory Sync Services. Under the hood, it’s the same as Azure Active Directory Sync Services except it improves the installation experience. For an introduction to Azure AD Connect and why you might want to use it, give this place a visit.

I thought that, since I’ve already done a series on Azure Active Directory Sync Services, I’d simply show the process to upgrade from Azure Active Directory Sync Services to Azure AD Connect. It is pretty idiot proof so let’s get to it.

First, download Azure AD Connect. Once you’ve downloaded it, copy it to the server that is currently running DirSync or Azure Active Directory Sync Services and double-click it.

Continue reading Upgrading to Azure AD Connect from AADSS

How to block updates in Windows 10

Microsoft Windows 10 introduces seamless update installation – but what should you do if it’s installing an update or driver that keeps breaking your PC?

On the sly, Microsoft have announced a troubleshooter to block updates that might be giving you problems – yes, you heard me, a troubleshooter.

The article in question is titled: How to temporarily prevent a Windows or driver update from reinstalling in Windows 10 and is KB3073930.

Once there, scroll past the initial few paragraphs and click:

How to block updates in Windows 10

Download the linked file, run it, select Hide Updates then select the update that keeps breaking your machine to hide it until the next driver update that supersedes that is deployed. I personally was battling with an Atheros driver issue that has caused Blue Screen Of Death (BSOD) at every update/release on my trusty old Toshiba R850-169.

-Lewis

Handling website maintenance in IIS

I’m the proud owner of a few websites, all of which run from an IIS 8.5 server. I also help friends and family run a few sites from the same server and some are business sites that, ideally, shouldn’t be offline for long periods of time. From time-to-time, that server needs a reboot for updates or some other type of maintenance. My friends and family are very understanding that, for the low-low price of free* they occasionally suffer downtime while I patch the server and give it a bounce so they suffer a little website maintenance message.

With some of the websites I help host being business sites, there’s half a chance that a search engine is crawling the site when I’m merrily going about my patching. Having a site become completely unresponsive, or worse, sending a 404 isn’t good for search rankings so it makes sense to use the best solution for dealing with search engines while still being informative for users as well.

While a site is temporarily unavailable, it is best to send an HTTP 503 Service Unavailable status code. Continue reading Handling website maintenance in IIS