Configuring NuGet server to use Authentication - authentication

The release notes for NuGet 1.5 state
NuGet now supports connecting to private repositories that require basic
or NTLM authentication.
However, the link contained in there simply leads to the hosting your own nuget feeds page, without any further mention of how to set up authentication.
I would like to set up a NuGet server that is accessible via https from the internet, but only allows people who can successfully authenticate to view or download the packages on the server.
I did create an application without auth as described in the Creating Remote Feeds section in the documentation, and it works nicely on the intranet. What do I have to do to enable authentication on this repo?
An additional requirement would be that solution should not cost hundreds of dollars (the first two answers promote products that might solve the problem but cost a lot).

This can be done by enabling Windows Authentication on the Web Site and adding credentials on the build server via the Sources command-line option, by default the credentials are stored using a DPAPI key restricted to the current user on the current machine (thus, for a build server, you would need to add credentials while logged in under the service account.)
For Developer workstations you only need to add the feed in NuGet Package Manager and then input/store credentials when refreshing the feed (you should be prompted.)
Step 1 - Require Authentication on NuGet Server (IIS Configuration)
You need to make sure the authentication module you wish to use is installed for IIS, for NTLM auth you will need the Windows Authentication module. Once installed you can open IIS Manager and drill down to your website, open the Authentication settings and Enable Windows Authentication, be sure to disable any authentication modules you do not want to support (such as Anonymous, Basic, etc.)
To ensure that user credentials are used, right-click on the Site and select "Advanced Settings", then click on the button for "Physical Path Credentials". In the dialog ensure that "Application User (pass-through authentication)" is selected.
More detailed information about standard IIS configuration for Windows Authentication can be found on TechNet including configuring from a command-line and enabling Negotiate (if that was your goal.)
Step 2 - Add Sources to NuGet Config (Build Server, Publishers)
nuget.exe sources add -Name "Fabrikam Feed" -Source "https://nuget.fabrikam.com:443/nuget/"
nuget.exe sources add -Name "Fabirkam Publish" -Source "https://nuget.fabirkam.com:443/"
Here we are adding two entries, one which will be used as the normal, authenticated Feed URL (for fetching packages from the server.) The second will be used for publishing to the server (adding or updating nupkg files.)
Step 3 - Update Credentials for Added Sources (Build Server, Publishers)
nuget.exe sources update -Name "Fabrikam Feed" -Source "https://nuget.fabrikam.com:443/nuget/" -UserName "Developer" -Password "g0d"
nuget.exe sources update -Name "Fabrikam Publish" -Source "https://nuget.fabrikam.com:443/" -UserName "Developer" -Password "g0d"
Here we have added credentials to the config, if you view %APPDATA%\NuGet\NuGet.config you should see the feeds you have added as well as encrypted credentials.
If you do not have the ability to log in as the server it is possible to store credentials in clear text by utilizing the StorePasswordInClearText option, but this is not advised in a shared environment.
Step 4 - (Optional) Disable the Publish URL in Visual Studio (Developers)
Open Visual Studio and navigate to the NuGet Package Manager Settings Dialog, untick the "Fabrikam Publish" feed. This will not affect your ability to publish, however, if you do not disable this feed you will receive errors when you try and refresh packages for "All" sources (as it is a publish URL, not a feed URL.)
Step 5 - (Optional) Store Windows Credentials in Visual Studio (Developers)
Open Visual Studio and navigate to the NuGet Package Manager, click on "Fabrikam Feed". You should be prompted for credentials. You can enter credentials here and tick the save/remember options. This ensures that attempting to refresh the feed in Visual Studio doesn't constantly ask for credentials. In the latest releases of NuGet Package Manager the feed is fetched using a standard HTTP request and the credentials you've stored to nuget.config are NOT used.
Notes:
You do not need a third party solution to host private, secure feeds. NuGet server is freely available and NTLM/AD/Windows security is supported by both IIS and NuGet tooling.
Developers who do not need to publish to the feed do not need to store credentials in their config. They also do not need a 'Publish' feed configured. This is only necessary for build servers or other publishers (re: Steps 2 and 3.)
All developers who will use the package feed will be interested in Step 5, this should be all that is required for most developers. They can simply add the feed from within Visual Studio, then enter their credentials when prompted.
If credentials change you can navigate to Start -> Manage Windows Credentials and delete "VSCredentials_nuget.fabrikam.com".
Step 2 can be performed in visual studio, but for clarity I've given the command-line here. Step 3, however, must be performed via command-line (or using the NuGet APIs.)
In a future release of NuGet rumor is credential information can be stored at the solution or project level (details are unclear), this is likely only of interest to people in a multi-tenant build environment where they do not have access to the build server.
Hope this helps someone else out there!

The solution I actually chose was to use TeamCity as NuGet server; while it's a bit of a hassle to set up because it lacks nuget push functionality, it now works nicely and at no additional cost serving NuGet packages to authenticated users only.

Related

What is still missing in my attempt to host a blazor-server app?

I've been hitting my head against this wall for days now and to my knowledge I've followed every direction I've found. But I'm still getting a 500 Error when I browse to the URL.
What I've got to work with is a Windows Server 2012 R2 with IIS 8.5. I'm not married to IIS but I'd prefer not to dip into YET another tech just to get this running.
What I've done:
Old-style blazor-server app (with Program / Startup pair) without authentication. Dependencies:
SharpZipLib
LiteDB
published it using dotnet publish -o bin/publish --self-contained -r win7-x64
copied that folder to the server
On the server:
installed urlrewrite2
installed everything under Windows Features Word Wide Web Services and Web Management Tools
restarted
created a new site in IIS
set the application pool to unmanaged
set the physical path to the folder I copied from my dev system
What I haven't done:
Anything regarding Visual Studio as I'm currently forced to contend with Visual Studio Code and none of that applies/is possible here.
Provisional Workaround
running dotnet my.dll --urls http://*:1234 does work to expose the app to the network
the command needed to be run inside the application folder otherwise the app would fail to load the connection string.
I've also had to provision a production database and modify my appsettings.json accordingly
This is workable for now but not having the app "auto start" with the server is unsatisfactory.

VS2019 Cannot launch .NET Core ASP 2 web site and browse from another computer on the same network

I have been trying to browse a website run under IIS Express VS2019 from another computer on the same network. I see the following error.
Bad Request - Invalid Hostname
I found several discussions where people suggested adding bindings and I did try adding so many different bindings in applicationhost.config with specific hostname, IP, hostname+ip, wildcards. When I add any binding or modify the existing localhost binding VS 2019 start giving me the following error
Unable to connect to web server 'IIS Express'
I am running VS2019 as an admin. What else I am missing?
Here is what I discovered. I do not have admin privileges on my local PC. Our sysadmin had created a shortcut for me which launches VS2019 as an admin. However, the VS was still not run as elevated Admin privileges. Turns out, you need to be an admin, and you must right-click the VS2019 shortcut and choose Run As Administrator with a shield and say Yes to the warning. The shortcut wasn't doing none of that. Now my custom IIS Express bindings are picked up from applicationhost.config without any issue.

Jenkins and Visual Studio Online integration authentication

right now I am trying to Setup Continuouse Integration - Delivery for a basic WCF Service, which will be hosted on a Microsoft Azure VM. The Project is Version Controlled through Visual Studio Online. So I installed Jenkins (also on the Azure VM), TFS plugin etc. and started the first Test Build:
As Server URL I used "[VSO Adress]/DefaultCollection"
and for Login purposes my Microsoft Account (I can Access VSO with that). The Problem is, when I run the Build I get the following error in Jenkins:
Started by user Developer
Building in workspace C:\Program Files (x86)\Jenkins\jobs\test\workspace
[workspace] $ "C:\Program Files (x86)\TEE-CLC-11.0.0.1306\TEE-CLC-11.0.0\tf.cmd" workspaces -format:brief -server:[VSO Adress]/DefaultCollection ****"
An error occurred: Access denied connecting to TFS server [VSO Adress] (authenticating as har****#*******o.com)
FATAL: Executable returned an unexpected result code [100]
ERROR: null
Finished: FAILURE
So my question is, whether it is generally possible to connect Jenkins and VSO that way and if so, which login credentials are needed
You will not be able to authenticate with your Microsoft ID as Jenkins is not able to get the encrypted token. If you head over to VSO you can open your profile (top right) and configure alternative credentials you can use them to login.
Also you can get service account credentials through the API. I created a simple tool for this: http://nakedalm.com/tfs-service-credential-viewer/
It's crude but usually works.

Login failure: unknown user name or bad password

We are running Visual Studio 2012 and Team Foundation Server 2012. In the Team Explorer window, I am able to successfully connect to our TFS environment. However, when I select the Security link under Team Project or Team Project Collection, I receive a message "Team Foundation Server: Login Failure: unknown user name or bad password".
I have not found a log file or anything in any event viewer file that helps debug this problem.
Is there a log file I can search for that contains some 'hints' as to want the connection problem is?
where are your credentials stored on your locale machine that are used to connection team foundation?
We realized that the root cause for this issue is that Visual Studio is trying to open a browser using the same credentials used to connect to TFS. If those credentials are not allowed to run processes on your machine (I suspect in your case it’s domain users on a different domain which is not trusted by the client domain) then opening the browser will fail. That explains why you can hit those URLs using a browser instance that is opened using your own credentials.This will be fixed in a future release of visual studio.
In TFS 2012, the management interface for permissions and project settings has largely shifted to Team Web Access.
Clicking any of the following settings from Team Explorer 2012 will produce the "Logon failure: unknown user name or bad password" error:
•Team Project Collection > Security
•Team Project Collection > Group Membership
•Team Project > Security
•Team Project > Group Membership
•Team Project > Work Item Areas
•Team Project > Work Item Iterations
•Team Project > Project Alerts
I have the same problem. To correct it (temporaly), you must run VS 2012 with this command:
C:\Windows\System32\runas.exe /netonly /user:{domain\loginname} "C:\Program Files (x86)\Microsoft Visual Studio 11.0\Common7\IDE\devenv.exe"
Change {domain\loginname} by the domain and login name of your tfs domain account. A console will ask for your password and all works!
I also experienced the same issue with TFS. I found a solution for that. You have to remap your workspaces in your PC or Remote server. If you have any uncommitted changes in your projects, you have to keep backup, otherwise you will lost your changes.
Steps -
Go to Workspaces in Visual Studio
File-> Source Control -> Advanced -> Workspaces
Remove the current workspaces.
Remap the projects again.
I was experiencing the same issue with TFS Express 2012. I don't know if my situation applies to you but here are the facts:
My TFS instance was running on a remote server.
Neither that server or my local machine were on a domain.
I was using the same user account name on both machines but with
different passwords.
Setting the passwords to be same fixed the problem.
The functions that weren't working were the ones that launch the project website, which I could navigate to directly anyway.
Managed to fix the issue myself by mapping a drive to the area where TFS appears to have A cache located - but then I have 2 separate workspaces going across 2 separate domains

SQLExpress connection fails in IIS 7 w/ user instance error - "Failed to generate a user instance

Mainly looking to answer my question #1 below, but more knowledge would be appreciated.
I tried to use these resources during my investigation, but was unsuccessful:
http://social.msdn.microsoft.com/Forums/en/sqldatabaseengine/thread/f5eb164d-9774-4864-ae05-cac99740949b (For this error: Failed to generate a user instance of SQL Server due to failure in retrieving the user's local application data path. Please make sure the user has a local user profile on the computer. The connection will be closed.)
http://social.msdn.microsoft.com/forums/en-US/sqlexpress/thread/6dfdcc22-7a81-4e8f-a947-c1ce6982d4b3/ (For this error: CREATE DATABASE permission denied in database master. An attempt to attach an auto-named database for file ? failed. A database with the same name exists, or specified file cannot be opened, or it is located on UNC share.)
Questions
1.) Why does this error occur while running the Telerik Rad Controls for ASP.NET AJAX "Live Demos" project with IIS 7 (Running Telerik Live Demos works fine using ASP.NET Development Server with this connection string)
Failed to generate a user instance of SQL Server due to failure in retrieving the user's local application data path. Please make sure the user has a local user profile on the computer. The connection will be closed.
2.) How is creating a SQL Server Express instances different in IIS 7, from ASP.NET Development Server & SSMSE
3.) Are there certain attributes of a SQL connection string not allowed when running a website on different contexts (based on #2).
Environment:
I'm not running the "Live Demos" .NET 3.5 ASP.NET web application via the ASP.NET Development Server (feature that pops up in your system tray and picks a port for you after clicking play in Visual Studio). That works just fine! I'm running the website on IIS 7. SQL Server Express is using the NETWORK SERVICE user in Control Panel > Administrative Tools > Services > SQL Server (SQLExpress).
Using this connection string provided with the installed "Live Demos" web application demo project:
<add name="NorthwindConnectionString"
connectionString="Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|Northwind.mdf;Integrated Security=True;User Instance=True"
providerName="System.Data.SqlClient" />
I've tried setting "User Instance=False", but that just throws another error:
CREATE DATABASE permission denied in database master. An attempt to attach an auto-named database for file ? failed. A database with the same name exists, or specified file cannot be opened, or it is located on UNC share.
(where "?" is the path of the *.mdf file - C:\Users\\MyDocuments\Visual Studio 2008\Projects\TelerikDemos\Telerik\RadControls for ASP.NET AJAX Q2 2011\Live Demos\App_Data\Northwind.mdf .. Stack Overflow italics is broken with some of those characters, so I had to remove that path)
Someone answered me on a previous question to set this "User Instance=False", but it appears User instances have nothing to do with whether or not you use SQL Express. User Instances are simply a feature of SQL Express that allows a very unprivileged user to host a database instance in it's own user context.
Note, this Northwind database is stored in an *.mdf file in the App_Data folder (under the "Live Demos" root application directory) along with the *.ldf (log file). I did previously try attaching the *.mdf files as actual databases under the "Databases" folder (in the SSMSE Object Explorer tree), but later removed them.
Web application "Live Demos" root folder (and nested folders/files) have the following users assigned with ALL privileges:
- IIS APPPOOL\Telerik ("Telerik" is the name of my application pool in IIS 7 for this site)
- IUSR
- NETWORK SERVICE
Making a note for myself about this SQLExpress master database query:
SELECT * FROM sys.dm_os_child_instances
Also tried different combinations of *.mdf & *.ldf permissions while also changing the user on the SQL Server (SQLExpress) Windows 7 service (Control Panel > Administrative Tools > Services) .. and also restarted the service after making those changes.
To reproduce:
download the Telerik Rad Controls for ASP.NET AJAX. Set the permimssions I mentioned in the "Live Demos" folder under Program Files\Telerik, change the .NET version of the web application to .NET 3.5, switch out their 3.5 web.config file with the normal web.config file in that folder. You have to use Visual Studio 2010, but I am running this in Visual Studio 2008 (with a little grunt work I did because our company is not yet on VS2010). Also switch out the proper Bin35 assemblies into the "Live Demos" folder Bin folder. Compile the solution. Create an IIS 7 website. Add Windows authentication. Enabled anonymous and Windows authentication.. all others are disabled. Set application pool to use Classic and 32 bit.
Then navigating to this URL and clicking the "First Look" image.
http://localhost/combobox/examples/overview/defaultcs.aspx
====================
More evidence will be provided if requested.
You are using a connection string with trusted authentication = true. This means that the connection uses the security context of the calling process.
When you run with the development server you are running in the security context of the logged in user, so every thing works fine.
When you run in IIS you are in the security context of the application pool process, which is NETWORK SERVICE, which does not have a user profile, therefore it crashes.
You can fix it by either:
Change the identity of the application pool to a normal user with access to the database
Use a connection string with user name and password
IIS doesn't load the Windows user profile, but certain applications might take advantage of it anyway to store temporary data. SQL Express is an example of an application that does this. However, a user profile has to be created to store temporary data in either the profile directory or in the registry hive. The user profile for the Network Service account was created by the system and was always available. However, with the switch to unique Application Pool identities, no user profile is created by the system. Only the standard application pools (DefaultAppPool and Classic .NET AppPool) have user profiles on disk. No user profile is created if the Administrator creates a new application pool.
However, if you want, you can configure IIS application pools to load the user profile by setting the LoadUserProfile attribute to "true".
https://learn.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities