just wondering if anyone has successfully migrated the ADDS Managed Service from Classic VNET to ARM VNET. I would be grateful if someone can share their steps in deleting the ADDS Managed Service and re-provisioning in ARM.
Please note that this is not currently supported. Microsoft will deliver a mechanism to migrate your existing managed domain from a classic virtual network to a Resource Manager virtual network in the future.
Reference: Azure Active Directory Domain Services: Frequently Asked Questions (FAQs)
Related
I have 2-3 source systems which are on-prem databases. I am planning to use Logic Apps to connect to these source systems. As per the Azure documentation we need to install a On-Prem Gateway on a local computer.
I am skeptical of this methodology as it demands dedicated system, so not sure if this works in actual production scenario.
Please can you suggest what is the right way to do it.
Here is how to connect to on-premise data sources:
If the services are accessible over the internet then you call service endpoint over HTTP or HTTPS from azure logic apps. This article will help you with details steps to be followed: https://learn.microsoft.com/en-us/azure/connectors/connectors-native-http
If it is not accessible over the internet then this article will help with step by step process: https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-gateway-connection
Before you can access data sources on premises from your logic apps, you need to create an Azure resource after you install the on-premises data gateway on a local computer. Your logic apps then use this Azure gateway resource in the triggers and actions provided by the on-premises connectors that are available for Azure Logic Apps.
Also check this for reference.
You may also want to consider the costs.
Is it possible to connect an Azure logic app to an FTP server residing on an Azure VM that lives in a subnet under a private IP address ? I cannot, when trawling the internet, find many (-if any at all) references to anybody trialling this, although we felt it might be a valid test of a need to access sFTP under unusual network circumstances. We have such a server, initially created to act as a 'remote' development VM but accessible via another Azure VM which can connect with our on-premise network, acting as a 'jump' server.
It is not a showstopper if we cannot do this - we can, after all, set up non-private VMs to act as FTP servers. And I understand that 'private' might be private for a reason ! But I was surprised that I cannot find any definite content, from Microsoft or anyone else, that this isn't possible: it seems that the only way to engineer such connection might be through an expensive Azure Integration Account or Application Service Environment. But the hint that such connection might be possible via those additional Azure facilities has caused my organisation to investigate the possibilities via the usual logic-app connector features. Thanks
No, your supposition is correct. Private means private. You can't directly access your private VM on Azure for the same reason you can't access a private VM on an internal network.
But, all the same facilities are available. If it's a Windows VM, you can use the On Premise Data Gateway with the File Connector.
I am trying to configure log shipping from on premises server to azure Iaas SQL VM. Please let me know the method and limitations.
Mainly i wanted to know how we will configure network shared path between on prem , azure and how backup and restore will happen
So for the second question.
No different as you would backup and restore things between 2 VM's in your Datacenter. Don't see a point to expand on this one.
As for the first question. You would want to create a Site-to-Site VPN between Azure and your own Datacenter, after that you would treat you Azure VM as a VM in your Datacenter.
As for the setup guide: there are a lot of guides running around in the internet, I'll provide a link to the Azure documentation
, where you can look up both ARM and ASM ways to do that.
I would like to connect a volttron platform running on a raspberry pi connected to the local network of a building to a second volttron platform running on a virtual personal server.
I know that two volttron platforms can interact with each other using the Volttron Central Management Agent or using the ForwardAgent. However, it is not clear to me what security method is used. Our ICT manager only agrees to set up a connection if the information is exchanged through https.
Could you help me formulating an answer to ICT regarding the security issue? And give me some pratical tips on how to set up the volttron configuration files? I'm not very familiar with network/security technologies. Maybe important to know: the server has a proxy and a reverse-proxy security.
Thx!
Your security person is correct. You should only set the platform up in a "real" environment through https. Since you have a proxy, that should be forwarded to the volttron central agent.
internet (443) -> proxy -> http://127.0.0.1:8080
The proxy in this case is on the same machine as the volttron central platform.
This is how we are doing it with apache as our proxy. One could do the same thing with a different web server such as nginx.
Hopefully that helps
If you are indeed trying to connect from a single instance to another instance (e.g. the way the forwarder does). Then the answer is the security is using public/private key pairs with curve mq providing perfect forward security. All traffic between platforms is 100% encrypted and only authorized agents can transmit across the instances bus.
http://curvezmq.org/
I have a situation where clients connecting to my webservice(that exists on another server) must access SQL Server databases and SSAS servers.
It must use the credentials of the client that is calling the service when accessing the SQL Servers and SSAS cubes.
For this to work I do
var winId = HttpContext.Current.User.Identity as WindowsIdentity;
var ctx = winId.Impersonate();
//Access Database/SSAS
ctx.Undo();
in my service which works fine when accessing SQL Server databases.
However when I access the SSAS servers I get
"The connection either timed out or was lost"
There are a number of posts like
http://denglishbi.wordpress.com/2009/03/31/windows-server-2008-kerberos-bug-%E2%80%93-transport-connection-issues-with-ssas-data/
http://sqlblogcasts.com/blogs/drjohn/archive/2009/03/28/kerberos-kills-large-mdx-queries-on-windows-server-2008-ssas.aspx
on this but I am using Windows Server 2008 R2
where my service lives so this should not be a problem as this bug should have been fixed by Microsoft.
Any information as to how to best diagnose this problem would be appreciated.
To clarify the SSAS servers do have SPNs. This was actually working at one point but has now stopped. Appears no sign of duplicate SPNs or anything.
What is interesting is it works intermittently on one SSAS server but seems to work all the time for the other.
They both have named SPNs as mentioned by this document
https://support.pyramidanalytics.com/entries/22056243-Configuring-Kerberos-Delegation-for-Named-Instances-of-SSAS-with-Active-Directory-and-additional-pro
My production environment is a load-balanced (and under heavy load) on a very large corporate Active Directory network. The following took a lot of testing to finally nail down settings that work.
I also run on Windows 2008 Server R2
My web services are in ASP.NET in IIS. For authentication I enabled "Windows Auth" and "ASP.NET Impersonation". Kernel mode is disabled and provider is "Negotiate:Kerboros"
SPNS and Trusted Delegation are setup for an AD account. My AD account looks like sys_myservice (sys_ is just a naming convention at my company)
The Application Pool identity is set to use the sys_myservice
After you make all these changes in your dev env, restart the entire server. For some odd reason this is always necessary when we bring on new servers and configure them.
With this setup my web services access SSAS, SQL Server, and more that use Windows Kerboros auth and all queries are performed correctly under the user's credentials.
The difference in my setup from yours is ASP.NET Impersonation is enabled at the IIS level. I had trouble doing the impersonation in code which is what you are trying to do. If you get code-level impersonation to work with your workflow I would be really interested in seeing you post an update.
Forgot to mention. My services are in a MVC application, I apply a global filter to all Action methods to force the application to authenticate all connections.
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
filters.Add(new HandleErrorAttribute());
filters.Add(new System.Web.Mvc.AuthorizeAttribute());
}
and in my web.config system.web section
<authentication mode="Windows" />
<identity impersonate="true" />
I agree that the intermittently 'successful' SSAS instance is suspicious. I wonder if it's really using Kerberos all the time. Could be using a combination of negotiate/NTLM and Kerberos, with one auth method actually working and the other approaching failing. Might be worth another look at the SPN. This link might help: http://msdn.microsoft.com/en-us/library/dn194200.aspx
Did you try using Wireshark or any other Network Analysis tools to see anything red happening at that point of failure? Probably its better if you provide more troubleshooting observations from your end.
Also, does your web services has a Load balancer?
Regards,
Sasi.