Showing posts with label HTTP(S). Show all posts
Showing posts with label HTTP(S). Show all posts

Tuesday, November 21, 2023

SharePoint Online - Custom Raw Http calls using Graph SDK v5

The Graph SDK is a nuget library to interact with Graph API from .Net applications. Earlier this year they released¹ Graph .Net SDK v5. That highly simplified the coding with fewer lines than v4 but has breaking changes from v4 even in the basic interactions. The good part is that the Graph SDKs simplify the HTTP operations to Graph API but in some cases, we may need to deal with Raw HTTP calls. 

This post discusses such scenarios. A basic idea about Kiota and building API clients using Kiota² is helpful to easily understand the code.

Problem - Custom Url

Support we are dealing with the cutting edge of Graph API, sometimes the API or property in the result may not be available in the Graph SDK as the SDK needs some time to catch up. Unfortunately, no examples can be included due to NDA. In such cases, we need to craft the URL ourselves but we don't need to deal with the authentication. How can we customize the URL in Graph SDK with the result object using the known types in Graph SDK?

Solution

Below is the notebook³ that has the code
Hope the code is self-explanatory. The catch here is the V5 SDK will serialize the result for us. Here we are getting the known Drive object

Problem - Custom URL and Raw JSON results

Sometimes we need to deal with totally custom URLs and the result JSON. In such scenarios, we can only leverage the authentication mechanism of Graph SDK only not even the result object. How can we have a custom HTTP URL and raw JSON result using Graph SDK?

Solution - Using IRequestAdapter

One way is to use the IRequestAdapter and have NativeResponseHandler. The code in a notebook⁴ is below. This uses a dummy object to satisfy the adapter and get the JSON via NativeResponseHander.

Solution - Using native HttpClient

The above does not fully give the native experience. To get the feel of native experience we can have the below approach⁵ that uses familiar HttpClient.

Please have a look at the warning.

References

¹ - https://devblogs.microsoft.com/microsoft365dev/microsoft-graph-net-sdk-v5-is-now-generally-available/

² - https://learn.microsoft.com/en-us/openapi/kiota/quickstarts/dotnet

³ - https://github.com/dotnet-demos/graph-sdk-sharepoint-online-notebooks/blob/main/custom-rawhttp-calls.ipynb

⁴ - https://github.com/dotnet-demos/graph-sdk-sharepoint-online-notebooks/blob/main/custom-rawhttp-IRequestAdapter-json.ipynb

⁵ - https://github.com/dotnet-demos/graph-sdk-sharepoint-online-notebooks/blob/main/custom-rawhttp-HttpClient-json.ipynb

Tuesday, April 5, 2016

What is Microservice Architecture to me?

Microservice is a buzzword in current Software engineering world. Everyone wanted to say we are building microservices or eagerly want to adopt it.

Reasons for micro services

Microservice - Bring Agile to Architecture

If we look at definition, we can see its an architectural style, where system is divided to small autonomous processes which are coupled with programming language/platform independent API. But we had similar kind of architecture in SOA (Service Oriented Architecture). They were also communicating kind of stable independent APIs. But what is the main difference or advantage.

Frequent releases

Yes the ability to release  more frequently is the key. We cannot deny other advantages that system is clean with small services which knows how to do its duty well, system can easily be built with different programming languages, scale only required components/services instead of whole system. etc...

If we remember the introduction of agile, there were so many advantages advertised. Working code over documentation, customer collaboration, responding to change were some to mention. But what is the real key? The key was 2-3 week based sprints which delivers something. As of my understanding most of the service companies adopted agile only because there will be a release in 2-3 weeks and developers will work night and weekend every 2nd week. In waterfall, the night and weekend parties were once in 6 months. Most of the places only the concept of sprint was taken but other concepts like maintaining backlogs, avoiding documentation over code were discarded. There would be no release happened in the world without documentation saying that code is working. 

What is there in Microservice? Independent teams who take ownership of small services. The size of the service, kind of relates to the size of the team who delivers it. And deliver daily, twice a day or if possible hourly.

Yes most of the places we can see an emphasis on TDD when adopting Microservice. But that is something might be discarded to rush to release.

What is the bottom line? The architecture will be agile. A Microservice could be introduced at any time in the development phase. Servers are going to be flooded with services. The complexity of the system is going to be in the orchestration of Microservices.

Design Microservice

Whatever we think, the Microservices architecture is a reality and soon most of our apps are going to be Microservice based. As the software engineering is still evolving, only fittest will survive. Currently it seems Microservice is a fittest one. Of course there are some problems to which Microservices approach is not the best solution.

Here lets see what are the characteristics of Microservices? 

Independent release

If a service can be released independently of the other parts of the system, it can be considered as Microservice. Sometimes the new API methods we released in the Microservice might not have any consumer components as the consumers can release only after the service release. 

The concept of independence is really important, if we want to release too often. If it depend on other components we cannot release fast & often.

Independent data store

If we want to have independent release of a service, it's data store should be independent. If there is a database table and a component release upgrade the schema causing other components to fail, we cannot consider that component as a Microservice. In short Microservice should be the only one to own it's data store. If other components in the system want to write something to the store they should call service.

Independent development team

If we want independence, probably it should be done by independent team. This is something not with the technology. Organization structure needs refactoring and is tough. 

The speed of delivery is prone to errors as well and it is advised to have development team supporting the service. If the team is shuffled after each release or members change often, they cannot support service as their own baby and the micro service architecture might feel a failure.

Independent framework/platform/language

This is not a mandatory thing. If there is a pressing need for adopting a particular technology which is different from regular technology stack, Microservice is recommended. But only if the above 3 criteria are met. Even we can have Microservice based systems with one language and technology.

Adopt only if

Do not jump just into Microservice without proper assessment and planning. If everything is independent who coordinates all these to work as a complete system which cater business need? Below are the things to make sure before jumping into Microservice world.

Defined integration guidelines between components. http(s)

If you don't have defined integration strategy of Microservices, it will simply fail. The recommended integration if through http(s) protocol if the interaction is synchronous. If the integration if asynchronous, adopt message queuing, service bus etc... But make sure there are enough design sessions and agreements before adoption.

Upfront design on the API

The real world systems / business problems are always complex. In monolithic system, we were handling the complexity in big components. But in Microservice era, the individual components are simple, but the complexity is shifted towards the interaction of services.

This requires carefully designed APIs for each Microservice. API is always like Mumbai underworld. Once we enter, there is no coming back. Once we publish an API, we don't know who are all calling it. Correcting the API and communicating the same to all consumers to redirect to new API is always costly.

Deployment is easy and automated.

We have seen one of the major advantage of Microservice is the frequent releases. Is the installation going to be done manually every time? If so we will immediately feel that the Microservice is a bad idea.

Deployment should always be automated. A continuous integration and delivery pipeline is always essential.

Strong automation testing. Prefer 100% test coverage

There is no human required for day to day deployment. They just setup the CI & CD in the beggining and system will do deployment automatically. What about testing? Are we expecting a manual tester to test all the changes before we release daily?

That's again should be automated. Developers should write proper test cases for the API. Most of the companies are employing a separate team / person for testing, is on the assumption that a developer doesn't want to break his own code or psychologically they cannot find out errors in the system what they build . When developer test, he tests only positive or usual scenarios because he knows how the system works. But here in Microservice world. we are not entertaining separate manual testing team,So how to tackle it?

Its very easy to tackle. Some other developer needs to write the tests. If the existing testing team knows how to code API tests, integration tests, they can also do. Please note we are against manual click QA. Automation QA is always welcome.

Service monitoring & management

We are talking about explosion of services. There are chances that each class/component in your existing system such as logging, caching will become a service. Some services will be versioned services, some will be cumulative/in place update. We need to add more service instances and load balance when services show load. Some might not be even used. A machine which hosted a service might go down and we need to relocate the service without zero or a little downtime. How do we deal with all these scenarios? 

The answer is a strong service monitoring and management infrastructure. Easy way is to host in cloud, where this is free with cloud provider. We don't need to develop infra management application for increasing number of machine and deploying the service to it. Or to move service from one machine to another machine etc...

Versioning, dependency management, retirement strategy

V2 of Service A may require V4 of Service B to be present in the system where V1 of Service C require V3 of Service B. This means V3 of Service B cannot be retired until Service C is retired.

Why we need to retire a service. Over the time some services will be legacy and there will be nobody calling it. But it just stays in the production environment. It is the decision of the stakeholders to retire or not. If we plan to retire everybody should be notified that, it is retired so that no new service call these retire ones.

Another interesting scenario is whether the a service say Service X should know the location of other service Y? Though the Location has many things to consider, here let's take as the url of service. If we decide to keep the location of Y in X, we cannot move the Service Y to other machine or environment. Hard coded location will cause trouble. Suppose we started with all the services on premises and due to load, if we decide to move Service Y to cloud Service X, will simply fail in calling Y.

This requires a service registry which keeps track of all the services and their dependency. This can be another service but in fixed location of course.

If you have access to production

If the development is for a product your company owns and is server based, Micro services works great. If the product is delivered as an installer to your clients, it would be really difficult to manage, as they may be still installing the morning release when you give evening release.

So basically better choose, if the CI & CD pipeline can reach till production. We can refactor the other systems to Microservice based but will never get the advantage of frequent release.

What to do with UI

Till now, we were talking mainly about services, what about UI? Are we going to deliver UI twice a day? That is something interesting and will discuss in a future post.

Disclaimer - I work in a project which have 100+ services, though we officially not adopted the Microservices architecture. It just came like that and many services are sharing same data store. We are not doing independent release of services due to data coupling. So the above view is not from a real time successful Microservie based project rather from reading and sufferings of service management.

Tuesday, August 25, 2015

How to make .Net 4.0 & 4.5 use TLS 1.2

Basics of HTTP(S)

Unless its not for fun, all the web sites need to be hosted using http(s). Is http(s) that much important? I will say yes. Otherwise, there are chances that our site will be viewed by people with different content than what we published. The web page is not directly sent from webserver to the client computer. It goes through various devices which can manipulate the content inside the site. eg: I as a free Wi-Fi provider can inject my own ads into the sites if they are simply using plain http connection. There were incidents happened as well.

Yes, it is important to have our web site served via http(s) to make sure our customers are seeing what we are sending them. How http(s) is solving this. Simply saying, it uses encryption when the web page contents are transmitted. So no one can see the content who has access to the intermediate devices. Even if they inject some content, it won't get displayed in our browser as the browser will not be able to decrypt the modified contents.

People who are curious about internal will have many questions by now. If our browser for example Chrome can decrypt the content why can't someone who has Chrome browser source code decrypt the same to see the contents?

Welcome to the world of security!!! There are concepts of encryption keys. Only people with the key can decrypt the encrypted content. Ok in this case if we have the key to decrypt the contents why can the attacker obtain the same key from the webserver by accessing the same site from the browser? That is solved with key exchange and usage of asymmetric and symmetric encryptions wisely. What is the key exchange? It is a sequence of steps involved to establish communication between 2 parties and here its web server and the client browser. This process is called the secure HTTP protocol.

Its enough and getting more complicated. Interested readers can please go through the links below to understand it more. 

Others just continue on the assumption that http(s) is the silver bullet to make sure what our viewers seeing is what we sent from the server.

Versions of http(secure)

Ensuring security is always a continuous process. There are chances that there may be a new flaw in the protocol in the future and we need to fix that issue. It becomes the next version of the protocol. When the issue is fixed by specs the existing web servers and browsers also needs to be fixed and it leads to their next version or patch. 

But can we expect all the people in the world update their browser as soon as the new fixed version or patch is released? Can the new fixed browsers assume that all the web servers its communicated are updated with the latest protocol version? Absolutely no. This requires different versions of this communication protocol to be live side by side in the internet. It is the duty of the communicators to settle in what protocol to be used. When we say protocol it includes the encryption details, key exchange details, etc...

Wiki will give more details on secure HTTP versions and the latest as of today is TLS 1.2 and TLS 1.3 is in the draft.

Fallbacks

As we saw earlier, https is a protocol before starting both parties involved in communication needs to agree on the method. It is not much complicated. Obviously, one party needs to tell that what it is supported and the server selects the latest technique. Though one party is capable of using the latest protocol, it may not use that as the other end doesn't know and this is called fallback.

Check what is our client browser is using

We saw that http(s) will solve a big security issue. It needs a server-side webserver software and client-side browser software who understands the encryption algorithms. Also, it is versioned

Is our browser capable of working with latest http(s) which is TLS 1.2? Just browse to the below URL to see what is the protocols supported in our browser.

https://www.howsmyssl.com/

They provide API as well which our application can call and understand what it can support. We will be seeing how an application can check this shortly

https://www.howsmyssl.com/a/check

Check whether the web site is using SSL/TLS?

Similarly, if we want to check whether a particular site is using secure HTTP go to below URL and enter the web site URL.

https://www.ssllabs.com/ssltest/

Tools to inspect the network communication

If we want to ensure the protocol at the low levels of the system, we can use tools such as Wireshark and all. Those tools help us to inspect the messages in the byte level.


How to host a web site in https

Whatever we discussed above was all general and nothing related to software development. Let's see how a web site can be hosted with a secure HTTP protocol.

The basic need for this is a certificate which is used as a key in encryption. We can create a self sighed certificate or buy from the certificate-issuing authority. Once we have the certificate, it can be associated with our web site via the web server. How to associate the certificate with web site changes from technology to technology.  Below is a link which explains how a site can be hosted securely using https protocol in IIS web server.

How to access SSL site from .Net

We can write applications which can request web sites for web pages as well as data in the same way browser application is requesting data. In Microsoft .Net there are many ways such as WebClient, WCF etc...

Below is the code which can be used to access https://www.howsmyssl.com API from C#.Net application.

var response = WebRequest.Create("https://www.howsmyssl.com/a/check").GetResponse();
var responseData = new StreamReader(response.GetResponseStream()).ReadToEnd();
Console.WriteLine(responseData);


On console we can see response similar to this.

Hosting WCF Service using http(s)

Hosting WCF using http(s) is not much different than hosting a web site using https. Differences mainly include changes in the web.config file to use Transport security. Below is a link which explains how we can host a WCF web service via http(s)

Accessing HTTP(s) WCF Service from .Net client

Similarly when we are consuming WCF service hosted via https, we need to make sure the service client is configured to use Transport security. Below link explains how a .Net client can access http WCF service. Just change the binding security to Transport in web.config

Why TLS 1.2

Let's come to TLS 1.2. As we have seen above, the latest version of the secure HTTP protocol is TLS 1.2. It means there were problems in earlier versions and its fixed in 1.2. So we need to make sure that as a security-conscious user our browsers need to be upgraded to support TLS 1.2. Will upgrading browser make sure all the connections are using TLS 1.2 protocol? 

No, if we are accessing a web site which is hosted in an environment without TLS 1.2, our browser will fall back to an older protocol version. If we want to avoid falling back to TLS 1.2, we can change the settings in all modern browsers such as Chrome, Firefox and IE to always use TLS 1.2 and that is recommended.

More interested readers can google and see what are the changes happened in TLS 1.2 which is based on TLS 1.1.

Obviously, as a responsive software engineer, we should make sure all our web applications must be supporting TLS 1.2 which is the latest at this moment. Need to use proper web servers and technologies to support the same. If we are not moving with the crowd it is very difficult to sustain in the market.

Enable TLS 1.2 at OS level

Not every windows operating system is equipped with TLS 1.2 by default. Below is a link explains how to enable TLS 1.2 in Windows 2008R2, Windows 7 and IIS 7.5. I believe people are still using these versions. 

http://www.derekseaman.com/2010/06/enable-tls-12-aes-256-and-sha-256-in.html
http://tecadmin.net/enable-tls-on-windows-server-and-iis/

In Windows Server 2012 & Windows 8.1 TLS 1.2 is enabled by default.

Not that this will make sure the TLS 1.2 is enabled at the OS level. Also, the default apps such as IIS web server and IE browser will also follow the same protocol by default. Basically, there is a system-level dll called schannel.dll which is responsible for this secure communication and applications are calling the API provided by it to have secure communication. Obviously, there are applications which are not replying on schannel to do communication. eg: Chrome and Firefox are not using this schannel so they can use TLS 1.2 even when they are running inside Windows Vista.

Similarly, when we say Windows Vista, 2008 and below are not supporting TLS 1.2, we should understand that their schannel.dll doesn't have support for the protocol.


TLS 1.2 and Microsoft.Net

Now let's focus on using TLS 1.2 in the .Net world. We need to make sure that the web sites are served via TLS 1.2 protocol and client apps which are consuming the same need to support TLS 1.2. .Net is running on top of the operating system and mostly its windows. If host windows support TLS 1.2 .Net can also support TLS 1.2 as it relies on schannel.dll1

The first task here is to make sure we are using the right tools and technologies.

TLS 1.2 and .Net Framework 4.5

.Net is also versioned. Versions below 4.5 don't know how to communicate via TLS 1.2.In .Net 4.5 the TLS 1.2 is enabled by default. Simply compile our applications in, Net 4.5 and we will get TLS 1.2 communication for our applications.

How to make .Net 4.0 app talk using TLS 1.2

Technically speaking just recompile the existing older application to .Net 4.5 to get TLS 1.2 support. It sounds simple as everybody expecting that there are no breaking changes in .Net 4.5 and our application will function as is. But if we are serious about delivering quality software we also need to test the entire app in 4.5 before shipping. It really adds cost.

Let's see if there are any ways to use TLS 1.2 by .Net 4.0 apps.

System.dll overwrite

When we install .Net 4.5 its basically adding changes on top of .Net 4.0. In other words, the System.dll used for 4.0 apps will be overwritten to 4.5 version of System.dll. So there are possibilities that .Net 4.0 apps will execute 4.5 code when they access functions in System.dll. Which means if we have .Net 4.5 installed in the machine where our .Net 4.0 is running it can take advantage of TLS1.2. All our solutions below are depending on this factor.

Below links explains the .Net versioning and overwriting.

1. Code change in 4.0 to use TLS 1.2

Now its the matter of changing the default protocol used by 4.0 to TLS 1.2. This can be done by forcefully changing the protocol as below.

ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;//SecurityProtocolType.Tls1.2;


If we look at the SecurityProtocolType enum for .Net 4.0, we will not be able to see the TLS1.2. But in 4.5 we can see that. So .Net 4.0 will not compile if we use TLS1.2 enum value. But if we use the TLS1.2 enum number it will compile and at runtime since the .Net 4.0's System.dll is replaced with 4.5 the cast will work. 

Please note that this will fail if we are running the same app in a machine which don't have 4.5 installed. Recommended only for servers where its easy to manage the .Net version.

2. Registry change to force .Net 4.0 to use TLS 1.2

If we inspect the .Net 4.5 ServicePointManager source code we can see that the default protocol is depending on the below registry entry.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319: SchUseStrongCrypto to DWORD 1

The default value will be 0. Simply change this to 1 to get .Net 4.5 System.dll use TLS 1.2. Since our 4.0 application uses 4.5 System.dll 4.0 gets TLS 1.2 support.

http://stackoverflow.com/questions/28286086/default-securityprotocol-in-net-4-5

Update 22May2019

Below is the Microsoft official link on .Net and TLS. It talks about .Net 4.7 as well.
https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls

References

https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Client_.28Browser.29_Configuration
https://www.simple-talk.com/dotnet/.net-framework/tlsssl-and-.net-framework-4.0/
https://msdn.microsoft.com/en-us/library/system.security.authentication.sslprotocols(v=vs.110).aspx
https://istlsfastyet.com/
http://blogs.msdn.com/b/benjaminperkins/archive/2014/11/04/using-tls-1-2-with-wcf.aspx
http://blogs.msdn.com/b/benjaminperkins/archive/2011/10/07/secure-channel-compatibility-support-with-ssl-and-tls.aspx
http://www.dotnetnoob.com/2013/10/hardening-windows-server-20082012-and.html


1 - This is as of my understanding. Was not able to get any authentic links.
*-As far as my understanding TLS 1.2 support came from .Net 4.5. I am using 4.5.2 currently.