Securing AppFabric Service bus with ACS

23 בנובמבר 2011

55 comments

I was working with a customer that wanted to use AppFabric Topics to push notifications to clients. as We all know anyone who wants to listen or send messages using service bus has to authenticate first. Traditionally authentication to the service bus was done by presenting a secret key before a connection was established.It is reasonable to put the secret key in a software package deployed on a server (Some can argue with that and say it is a security violation) but providing the key to numerous clients? This is a true security breach.

So How can we make clients listen on the service bus without having to provide them with our secret key?

Access Control Service is the solution.
The new version of Service bus which was released few weeks ago uses ACS to federate its authentication. We can use ACS to create new identities or federate with other identity providers so the actual user can use its own credentials to get a token that can be used against service bus. We can assign different permissions to the service bus users. It is possible to give listen, send, and manage permissions so we can make sure that users can execute only the actions we allow them to.

How do we set this?

Well for each service bus namespace (such as "manublog") a twin namespace (e.g. "manublog-sb") is created in ACS.
Let us open the management portal for service bus and select out namespace. By pressing on the Access Control Service button the portal of ACS for the twin namespace will be opened.

image

image

here we can register other identity providers that we want to federate with (such as a custom STS or ADFS 2.0)

In the relying party section we register the uri of the service bus resource we want to expose to our user. For example a queue a topic or a relay service (e.g. http://manublog.servicebus.windows.net/mytopic/subscriptions/manu)

In the rule group section we add rules that will be used to create a claim of type "net.windows.servicebus.action" with the value "Listen or Send or Manage".

In the portal we will find a definition of a relying party referencing the root of our service bus namespace. we can reference that as an example for defining new relying parties.

image

In the namespace there are existing rules for the super user "owner" that have full access to the entire namespace. we can reference these rules as examples for creating new ones. 

image

In the portal we will find the definition of the super user "owner"
We can reference this as an example for our new identities definition.

image

Clemens Vasters recorded a great video describing all these capabilities in details. I strongly recommend to watch it.

To summarize

ACS is now integrated with AppFabric Service bus. This allows us to have full control who will use our communication channels implemented in service bus without exposing our secrets.

Enjoy

Manu

Add comment
facebook linkedin twitter email

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

*

55 comments

  1. Higgins10 בדצמבר 2012 ב 11:25

    It's remarkable to visit this site and reading the views of all friends concerning this paragraph, while I am also zealous of getting experience.

    Reply
  2. Clawson28 בדצמבר 2012 ב 1:16

    Auf unserem Geschenke des weiteren Geschenkideen Blog präsentieren unsereins schöne Dinge und auch Wohnkamine.
    Wir ziehen umher und sehen kontinuierlich mal was uns sehr
    gefällt und das präsentieren wir hier. Freilich können Sie die meisten Produkte auch sogleich kaufen,
    doch ausschließlich per amazon, damit der Einkauf
    sicher ist!

    Reply
  3. Moten23 בינואר 2013 ב 21:24

    Useful short article! I checked out something rather similar in a computers
    and technology website. Actually worth checking out

    Reply
  4. Donahue24 בינואר 2013 ב 0:56

    I'm not sure why but this blog is loading extremely slow for me. Is anyone else having this problem or is it a issue on my end? I'll check
    back later on and see if the problem still exists.

    Reply
  5. Slaughter26 בינואר 2013 ב 20:40

    Excellent article. I will be facing a few of these issues as well.
    .

    Reply
  6. Starks27 בינואר 2013 ב 22:32

    said in a press release on Think – Geek's blog, "It was never our intention to cause a National crisis and misguide American citizens in regard to the differences between pig and unicorn. The god Apollo was worried about the hunter Orion's designs
    on his sister Artemis, so he set this scorpion on him.

    Do you think that somewhere, somehow, he had surgery to alter
    his horse body to fit that of a human man.

    Reply
  7. Crutchfield28 בינואר 2013 ב 21:37

    I constantly spent my half an hour to read this blog's content daily along with a mug of coffee.

    Reply
  8. Orozco30 בינואר 2013 ב 2:13

    This is my first time pay a visit at here and i am truly
    pleassant to read all at one place.

    Reply
  9. Laflamme30 בינואר 2013 ב 8:10

    Great article, just what I wanted to find.

    Reply
  10. Moss30 בינואר 2013 ב 22:24

    I think the admin of this website is actually working hard in support of his web page, for the reason that here
    every material is quality based information.

    lawyer

    Reply
  11. Dietrich1 בפברואר 2013 ב 8:05

    What's up, after reading this awesome paragraph i am too delighted to share my knowledge here with friends.

    Reply
  12. Underhill2 בפברואר 2013 ב 23:44

    I know this site offers quality depending articles and other material, is there any other site which provides these kinds of information in quality?

    Reply
  13. Wilbanks3 בפברואר 2013 ב 12:24

    What's up, after reading this amazing post i am as well delighted to share my knowledge here with mates.

    Reply
  14. Hutchins6 בפברואר 2013 ב 23:02

    Outstanding post but I was wanting to know if you could write a litte more on this
    subject? I'd be very grateful if you could elaborate a little bit more. Many thanks!

    Reply
  15. Skaggs8 בפברואר 2013 ב 7:53

    I blog frequently and I seriously thank you for your information.
    This great article has really peaked my interest. I will take a note of your website
    and keep checking for new details about once per week.
    I subscribed to your RSS feed as well.

    Reply
  16. Caraballo8 בפברואר 2013 ב 11:24

    I am actually thankful to the owner of this website who has shared this
    impressive post at here.

    Reply
  17. Grogan13 בפברואר 2013 ב 3:35

    Can you tell us more about this? I'd care to find out some additional information.

    Reply
  18. Dowdell13 בפברואר 2013 ב 15:00

    I used to be able to find good information from your articles.

    Reply
  19. Webb13 בפברואר 2013 ב 23:08

    I'm gone to inform my little brother, that he should also pay a quick visit this webpage on regular basis to obtain updated from newest information.

    Reply
  20. Medina16 בפברואר 2013 ב 21:59

    I truly enjoy simply reading all your sites.
    Simply wished to let you know that you have people much at
    all as i am who value work. Undoubtedly a fantastic publish.
    Hats on a person! The data you have found here
    is very helpful.

    Reply
  21. Cameron20 בפברואר 2013 ב 8:06

    Great article! We are linking to this great article on our website.
    Keep up the great writing.

    Reply
  22. Harder24 בפברואר 2013 ב 9:03

    Thanks for sharing your thoughts on Azure. Regards

    Reply
  23. Sauer2 במרץ 2013 ב 10:45

    Great info, valuable and superb design, because reveal nutrients with plans and
    ideas, lots of great details and inspiration, both of which I would like, because of provide such a helpful tips here.

    Reply
  24. Duff2 במרץ 2013 ב 18:54

    What a great blog site you've below. Make sure you update this more frequently. This particular topics is my personal attention. Thanks.

    Reply
  25. Mcfarlane2 במרץ 2013 ב 23:20

    Thanks for finally talking about >Securing AppFabric Service bus with ACS – Manu Cohen-Yashar's Blog Reply

  26. Kraft8 במרץ 2013 ב 16:28

    It's an remarkable article in support of all the online visitors; they will get benefit from it I am sure.

    Reply
  27. Penn8 במרץ 2013 ב 22:50

    I was able to find good info from your articles.

    Reply
  28. Corbett22 במרץ 2013 ב 10:55

    Hello, I enjoy reading all of your post. I like to write a little comment to support you.

    Reply
  29. Burke26 במרץ 2013 ב 23:24

    What's up, this weekend is fastidious in support of me, since this point in time i am reading this great educational article here at my home.

    Reply
  30. Church28 במרץ 2013 ב 3:21

    I am in fact grateful to the owner of this website who has shared this fantastic article at
    here.

    Reply
  31. Milliken29 במרץ 2013 ב 6:03

    2 is release and lets a feature in the ACP. You were very vociferous with your choke
    charges, employing capital letters and what not. After
    all members of our tour group were safely evacuated, some by helicopter, we skirted the closed airport and were transported to Johannesburg
    via a bus. The pattern of police-state deception,
    however, goes far beyond Fox and News of the World . Against the claim that the teaching
    as a whole is Gnostic, Met.

    vip loan shop

    Reply
  32. Gilson31 במרץ 2013 ב 3:29

    I tried The Thirteenth Tale last night, but really hated
    the writing. (They did sell the 2010 model in the US, too, but
    some argue that point.) I bought my 2007 after having one as a rental.
    The article also incorrectly stated that Kahn’s adviser at
    the State University of New York at Stony Brook encouraged him to
    attend Markovic’s lecture. The International Union Against Tuberculosis and Lung Disease (The Union),
    the World Health Organization (WHO) and the World Diabetes Foundation in
    association with the Indian government conducted a pilot project this year screening more than
    8,000 tuberculosis patients for diabetes, and over 10,000..
    . @jamesmichie : @PatParslow I would like to
    see communities of learning inc.

    Reply
  33. Noyes2 באפריל 2013 ב 4:42

    To some extent the debate turns on whether international criminal law requires that those who aid and abet merely have knowledge of the principal
    crime, or must instead have a purpose to facilitate the crime.
    Now, I’ll go home to Australia now where I’ll take a little break from racing.
    Since the release of the ERB results, nearly 900 Sailors
    have attended career forums hosted by SM2WM and the program’s website has
    received over 14,000 hits since inception. For the post of Airport Operations, LMV license is essential.
    My shirt is also just something I’ve had
    for a long time: I’ve always really liked the 1940s look, so this is something with the collar and polka dots and some pretty ruffles .

    Reply
  34. Pierre3 באפריל 2013 ב 8:00

    Stunning story there. What happened after?
    Take care!

    Reply
  35. Randolph5 באפריל 2013 ב 5:37

    One should be cautious of the data being developed by COSIA,
    which will produce non-binding recommendations with no actual set goals or timelines
    for any environmental protection or stewardship.
    The FCC may not conduct or sponsor a collection of information unless it displays a currently valid control number.
    Zelda kept silent looking down at the glass and narrowing her
    eyes. En France, c’est monnaie courante. His son, Ken Jr.
    , said the principal tossed him against a wall, loosening one of his teeth, which eventually fell out
    during his lunch break.

    Reply
  36. Slater20 באפריל 2013 ב 11:33

    Heya i'm for the first time here. I found this board and I find It really useful & it helped me out a lot. I hope to give something back and help others like you aided me.

    Reply
  37. Breeden21 באפריל 2013 ב 0:29

    Heya i am for the primary time here. I came across this board
    and I in finding It really helpful & it helped
    me out much. I hope to present something again and help others such as you aided me.

    Reply
  38. Crouch21 באפריל 2013 ב 2:50

    Tremendous things here. I'm very happy to look your post. Thank you a lot and I'm looking forward to touch
    you. Will you please drop me a mail?

    Reply
  39. Marchand21 באפריל 2013 ב 8:49

    There is definitely no hassle; there are no other points to do aside from putting it around your waist.

    Reply
  40. Dunaway21 באפריל 2013 ב 9:16

    I don't even know how I stopped up here, but I assumed this publish was once good. I don't recognize who you
    are however definitely you are going to a well-known blogger should you
    aren't already. Cheers!

    Reply
  41. Walker21 באפריל 2013 ב 10:59

    Hi to every one, it's truly a fastidious for me to go to see this website, it contains helpful Information.

    Reply
  42. Ledford22 באפריל 2013 ב 0:46

    Excellent post! We will be linking to this great post on our site.
    Keep up the great writing.

    Reply
  43. Levine22 באפריל 2013 ב 3:02

    Hey I know this is off topic but I was wondering if you knew of any
    widgets I could add to my blog that automatically tweet my
    newest twitter updates. I've been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

    Reply
  44. Prieto4 במאי 2013 ב 6:52

    Good post. I learn something totally new and challenging on sites I stumbleupon
    on a daily basis. It will always be useful to read
    articles from other writers and practice a little something from
    other sites.

    Reply
  45. Dillard5 במאי 2013 ב 3:10

    this can be a great web site lotrs of good info i can't hold out to try some of these products

    Reply
  46. Regan5 במאי 2013 ב 13:48

    There are, of course, tricks to circumventing the effects of hyperbolic
    praise, but ultimately the only way to enjoy a film that’s
    been targeted by overwhelming positivism lies in tempering the critical response in one’s mind beforehand
    and forcing oneself to see the picture through fresh eyes.
    A version of this review appeared in print on
    March 2, 2012, on page C 21 of the New York edition with the headline:
    A Survey of a Different Color. How Do You Know If Your Decision-Making
    Process Is Creative? WE ARE THE POWER. – je dus admettre : – oui c’est bien
    moi.

    Reply
  47. Hundley6 במאי 2013 ב 3:17

    “We didn’t do the movie because of how we thought people were in 1885, we were interested in 1885 shedding light on
    – not so much on politics now, though partially that – but also just how we still are.
    Please return later. Churches across rural Manitoba actively participated
    in the world day of prayer, including those close to home.
    The media because of its own complicity in this affair will attempt to keep a lid on matters
    but given the diminishing importance of MSM, that will
    ultimately prove unsuccessful. The tattooed pitcher was wild off
    the field, too, known for pelting Yankees teammates in the face with cream pies following
    game-winning hits.

    Reply
  48. Lanier9 במאי 2013 ב 3:01

    Hey I know this is off topic but I was wondering if you knew
    of any widgets I could add to my blog that automatically tweet my newest twitter updates.

    I've been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

    Reply
  49. Stiles9 במאי 2013 ב 12:13

    Hey! This is my first visit to your blog!
    We are a team of volunteers and starting a new project in a
    community in the same niche. Your blog provided us useful information to work on.
    You have done a wonderful job!

    Reply
  50. Treadwell11 במאי 2013 ב 7:21

    Thank you for the kind remarks, please do come back and let us know
    how you get on. i love to hear feedback off their ecig customers, whether newbies or aged veterans.
    My own aim the following was to aid people increase the risk for switch to electronic cigarettes and
    to cover the cost of an informed option. Electronic cigarettes have revolutionized my entire life and every time
    one of my personal readers gets in contact to inform me their own story it warms me
    to know think that I may possess helped an individual make the move from
    smoker to vaper!.

    Reply
  51. sarah.marygold398@gmail.com15 במאי 2013 ב 21:09

    Howdy! I know this is somewhat off topic but I was wondering if you knew where I could get a captcha plugin for my comment form? I'm using the same blog platform as yours and I'm having trouble finding one? Thanks a lot! breast actives reviews http://breastactivesdigest.com/

    Reply
  52. Gladney24 במאי 2013 ב 2:23

    ::: Sandstorm – Darude. Dance your cares away under the throbs of the
    music that will beat in your head, long after the song has ended.
    House is not just a form of music, but is a religion supported by devoted practitioners the world over.

    Reply
  53. Schuster25 ביולי 2013 ב 13:34

    It's nearly impossible to find well-informed people in this particular subject, but you seem like you know what you're talking about!

    Thanks

    Reply
  54. Emanuel16 באוגוסט 2013 ב 18:05

    Your way of describing everything in this post
    is really pleasant, all can effortlessly be aware
    of it, Thanks a lot.

    Reply