One of the most important lessons I’d learned from working with Azure, over the last year or so, is that careful thought should be given to whether it’s better to implement a service as a ’low code’ solution, or as conventionally-developed software. The former isn’t always the fastest, cheapest or more efficient way to get something deployed.
I’m currently of the opinion that Azure’s Logic App system is quite good for integrations and basic scheduled tasks - and it has indeed made those kind of things easier to manage - and there aren’t any convoluted deployment pipelines to bother with.
One way to help understand how Active Directory, App Registrations, managed identities and Key Vaults work in Microsoft Azure is to look at a typical Logic App that authenticates itself with an API that provides data only to services registered with the organisation’s Active Directory.
The basic sequence for the authentication part of the Logic App here is this:
Get a password from an Azure Key Vault. Get an OAuth token for the Logic App from Active Directory.
Initially I thought it would be trivial to use SelectPdf to convert an HTML page into a PDF document as a service on Microsoft Azure, since I was easily able to do this as a .NET console app.
Everything was going well to begin with. I’d set up everything in the Resource Group: The Logic Apps that write to and read from the Service Bus, the Storage Account for the template files and generated documents, the Function App that’s supposed to handle the document generation itself… The first problem I ran into was the following console message:
Azure Key Vault is designed to store (and protect) secrets such as API keys, passwords, cryptographic keys, connection strings, etc. It can store the following categories of data:
Keys Certificates Secrets The Secrets storage can store arbitrary plaintext values, so Key Vault could potentially be used as a means of centrally managing a collection of usernames and passwords that could be copied and pasted straight from the Azure Portal. Is this a safe method of password management, though?
My brief encounter with Power BI began after one of the project managers had the idea of using Power BI Report Builder as a means for generating archived versions of what’s displayed on a site I developed not long ago, because he wanted a PDF export feature for that. ‘Why not just copy a couple of the API methods and add a PDF converter to them?’, I wondered, with the feeling I’d end up needing to do that anyway.
It is possible to query a MySQL database as a linked server from Microsoft SQL Management Studio (SSMS), indirectly, using OPENQUERY. Querying a Linked Server To select all records from a database table in the linked server:
SELECT * FROM OPENQUERY(LINKED_MYSQL_DB, 'SELECT * FROM databasename.databasetable') Or to find a record with a field matching some condition:
SELECT * FROM OPENQUERY(LINKED_MYSQL_DB, 'SELECT * FROM databaseame.users') WHERE name LIKE '%PersonName%'; There’s one problem with the above queries: They will read the entire table through the linked servers before the rows are filtered.
Recently I was tasked with implementing role-based security for a .NET API, based on the Active Directory groups the user is a member of. Easy, I thought initially, as there’s a well-documented way of doing this by adding [Authorize] annotations to controller methods.
The first problem I ran into was the API was designed to be used by a Node.js/React application. In this case (and this is a simplified description), users obviously don’t authenticate themselves directly with the API, but instead with the React application, via Active Directory Single Sign-On.
Notes initially published on my Bear Blog site.
A decade of software development and engineering taught me there are two design principles that I’d argue are more important than any particular pattern or design approach:
Code should be readable and self-explanatory. Each function or method (I use these terms interchangeably) should have a single, well-defined purpose. Code should be readable Programming languages are designed to provide human-readable abstractions of software, and, as such, code should be intelligible and relatively easy to work with.
Since dependency vulnerability scanning has been suggested by colleagues as something that could help with security/standards compliance and addressing legacy software, I’ve been looking into a few services to see how useful the available options could be.
NPM Audit Dependency scanning is performed by default with the install command for later versions of NPM, and by default, the output of npm audit will show a few lines of relevant information about each package with a reported vulnerability - its rating, a brief description of the vulnerability and whether an update is available.
After clicking ‘Create’, select ‘Develop in portal’, and HTTP Trigger or Service Bus Trigger, depending on the type of Function App being added.
Most the required information – function name, connection, queue name, etc. – can be copied from the original function’s JSON file.
In Code + Test, copy the code from the old function or the Visual Studio Solution.
In the Integration section, the values for Trigger, Inputs and Outputs also need to be copied over.
