A Little About David Chapman

Using Certificate Based Authentication

Summary

Recently a client had a need for putting a web application on the internet that end users could access. They wanted to lock it down so that not everyone on the internet could access. Whitelisting IP Address was not an option because they were remote users with dynamic IPs and the overhead of maintaining this whitelist would be problematic.

The use case was a password recovery tool that their remote users could use to reset and recover passwords. Simple authentication would not suffice. For starters if the users’ passwords expired they wouldn’t be able to easily log into the site. Along with that it would be a high profile target for brute forcing.

Why Not IP Whitelisting?

IP whitelisting used to be and still us for some organizations the de-facto method of filtering traffic. It can be very problematic though. Users today are on the go, working remotely or using their mobile device on cellular data as well as home internet. Other times it involves sales staff at client sites. Keeping up with these IP whitelists can be a chore. Updating this whitelist can be time sensitive to avoid halting productivity. When not maintained, there is a chance someone unexpected could gain access due to simply having an IP previously whitelisted.

A workaround for this is VPN but that requires a bit of support overhead in user training and support. This can be clunky for users that are not used to to using VPN.

Why Certificates

Many larger organizations already have internal Certificate Authorities in place. For Microsoft Active Directory deployments, when CA has been installed, end users are likely auto enrolling in user certificates. Domain joined workstations already have these and trust it the internal Root CA.

Certificates also have a built in expiration. In an auto enrollment environment, this expiration could be lowered substantially to below 1 year.

TLS Handshake

Once of the nice features of TLS is that it does include a mechanism for this. Below is an example of a TLS handshake where the server requests a certificate and the client provides it.

In Frame 19, the client makes the TLS request with a Client Hello. Frame 23 the Server response with a Server Hello. This is where they set parameters and negotiate things like TLS versions and encryption algorithms.

Frame 26 is part of the Server Hello but it was large and split up. Boxed in red is the “Certificate Request” where the server is requesting a certificate to authenticate.

Frame 33 is where the client actually provides it.

From here you can see this happens before the application level (HTTP) protocol communicates starting in frame 43. What this means is that before the user reaches the web application for authentication, the device requiring TLS Certificate Authentication is filtering the requests. Many times this is a reverse proxy or load balancer is not vulnerable to the same exploits as the web servers.

Browsers

When used properly and the client has a certificate, the browser will prompt users for a certificate to use such as pictured below.

Browser Certificate Authentication Prompt

Other Applications

A really neat application for this when you have a legacy plain text protocol in play but you want to open it up over the internet and secure similarly. Perhaps you have a legacy application that uses raw text and is not SSL/TLS capable. You can still put this on the internet through a reverse proxy like F5 LTM or stunnel.

Traditionally this type of traffic would be protected via IPSEC tunnel that is encrypted or a dedicated circuit such as MPLS. That does require specific hardware and/or monthly circuit costs to accommodate.

stunnel is extremely useful in this scenario as you can install it on the local machine that has the legacy application and configure it to connect to localhost on a random port and proxy information out over TLS and configure it to use the certificate based authentication.

Here is a graphical example of what that may look like with an stunnel server broken out. stunnel could be installed on the end user’s workstation though.

Legacy App Secured with TLS 1.2 or higher & Certificate Based Authentication

stunnel could be put on the local end user workstation to minimize that unencrypted leg. Typically on the server side the reverse proxy has a leg directly on the same VLAN/subnet as the application which minimizes exposure over that but this does help secure the application traffic over the untrusted internet.

Final Words

In this article we learned a little on Certificate Based Authentication. We also learned how it may help your organization better secure your applications and possibly avoid more costly solutions.

Internet Routing and BGP Looking Glasses

Summary

From time to time I get requests from colleagues, “Can you ping this address?”. Many times what is going on is they are bringing up a new internet link and want to check routing. Sometimes they areadding a public endpoint and want to make sure its accessible. They are asking me because within their network it works but they need to make sure it is accessible or routing properly over the internet.

BGP Looking Glasses are a great tool for this if you would like to be self sufficient. You can also get a wider view than just a few colleagues. My favorite one is HE.net’s https://lg.he.net

What is BGP?

BGP Stands for Border Gateway Protocol. It is the standard exterior gateway protocol for internet routing. While an internal network may use something like OSPF for its interior, BGP is better suited for exterior routing.

One of the few keys to understanding BGP at a high level is to understand it is a distance vector routing protocol. These routes are typically better suited for WAN routing as they are a bit more light weight. The downside is that each router’s perception of the internet is key. There is no unified single view of the internet routing. Each router has its own perception of the internet based on the BGP routes it receives.

This is why Looking Glasses are so important. You can see the perception of various points on the internet. This can help you determine internet traffic destined to your infrastructure is taking the expected and optimal path.

HE.net’s Looking Glass

Here is a small snippit of HE’s LG. They have various routers all over the world that would not fit into this screen shot. You can also see the various functions you can perform on the right hand side.

Ping and traceroute are fairly self explanatory. For ping it just returns the results of an ICMP ping and traceroute shows a list of routers in the path of getting to the destination.

HE.net Looking Glass - Traceroute — HE.net Looking Glass – Traceroute

The real value here is the “BGP Route” option.

HE.net BGP Looking Glass Details — HE.net Looking Glass BGP Details

Here we can see all of the BGP peers this particular router has learned the route to 1.1.1.0/24, the AS path it takes and which one it selects as the best path.

Autonomous Systems

If you are new to BGP and dynamic routing protocols you may be wondering what an AS (Autonomous System) is. In BGP world, it is basically a grouping of similar routers that announce a similar set of subnets or prefixes as they are called in BGP. BGP groups systems together by AS. As each router learns a route, it appends its own AS to the AS path before passing it along.

The above is a bad example because it shows a single direct AS path as HE appears to be directly peered with CloudFlare (AS 13335). CloudFlare is very well peered on the internet. Below is a better example. It at least shows it passing through AS 1299 (Telia) to AS 174 (Cogent)

It seems HE.net is fairly well peered but here is another router output that shows some decent AS paths and the differences. AS 174 being Cogent and AS 209 being CenturyLink and AS 3356 being Level3 it chooses the shortest AS path. Keep in mind the traceroute through CenturyLink could possibly be shorter actual router hops. A shorter AS path does not necessarily mean less latency or shorter traceroute hops.

#show ip bgp 73.0.0.0/8 
BGP routing table entry for 73.0.0.0/8, version 767462940
Paths: (2 available, best #1, table default)
  Advertised to update-groups:
     18        
  Refresh Epoch 1
  174 7922, (received & used)
    X.X.X.X from X.X.X.X (X.X.X.X)
      Origin IGP, metric 13031, localpref 100, valid, external, best
      Community: 174:21000 174:22013
      rx pathid: 0, tx pathid: 0x0
  Refresh Epoch 3
  209 3356 7922, (received & used)
    X.X.X.X from X.X.X.X (X.X.X.X)
      Origin IGP, metric 7800026, localpref 100, valid, internal
      rx pathid: 0, tx pathid: 0

Final Words

If you ever find yourself needing to ping or traceroute from a remote endpoint lg.he.net has you covered. Many carriers have their own looking glass. This is useful incase you want to see how your routes are perceived from their end. If you use BGP at your edge and receive full routes, this is another avenue of seeing those prefixes. With looking glasses, you can do this from various endpoints across the internet pretty easily.

Exciting News!

I get to help a diverse set of clients on a full time basis starting early March 2020! If you are wondering why I have not written an article recently, I had this big decision going on and was focusing on that.

I recently made the decision to enter into the consulting world again. I will be transitioning into this over the next month. Over 3 years ago, after recovering from a failed business, I was blessed to be an independent consultant with Pegasus for the greater part of a year. The opportunity came at an excellent time to help get me back on my feet. They then offered me employment when I needed more stability with flexibility and it was a mutual arrangement. A work home was made at Pegasus for the next two and a half years and it was great. I could not have planned this better even if I tried so it had to be His plan!

Most recently a few previous clients needing assistance drove me to adjust my current employment terms. Pegasus was flexible enough to allow me to make this transition and still take care of them.

With all of that said, I am always looking to acquire new clients to share my extensive knowledge base. Most of you know but I have been doing IT consulting for over 20 years, extremely detailed oriented and thought provoking in all aspects to a fault. Please keep me in mind should you have some IT needs or considerations, now or future. If you’d like to check out my resume, skills list or blog site – https://www.woohoosvcs.com

Review of KardiaMobile 6L by AliveCor

My review of the KarbiaMobile 6L by AliveCor. It is a pretty interesting device that can help detection if you are having some strange heart rhythm issues.

Summary

Earlier in the week I had some heart irregularities that scared me. Upon visiting my Primary Care he calmed my concerns but recommended a device I had actually already been looking into to help monitor at home.

The device was KardiaMobile by AliveCor. In doing my own research, I came across it but I wasn’t sure how accurate it was. Since my doctor recommended it and said he had one I was satisfied by the quality of the results.

Options

There are two main options. A Single lead which is their original product or the new Six Lead (6L). For me, for the extra quality of the EKG I opted for the 6L as it was only marginally more expensive and why not?

What Are Leads?

I won’t attempt to write in depth on this as I am just learning about it but do not confuse electrode for lead. Have a good read on this Wikipedia article – https://en.wikipedia.org/wiki/Electrocardiography#Electrodes_and_leads

In short, more leads equate to a higher quality EKG with more data points although for most of us, the single lead will do just fine for home monitoring.

Here is a picture of the measurements of a 6 lead. A single lead is simply the first “I” listed below. Leads 4-6 (aVF, aVL and aVR) are calculated and not actual. Its fun how triangles work, isn’t it 🙂

By Npatchett – Own work, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=39235282

Detection

The natural question is exactly what can this detect? It is FDA-Cleared to detect the following

Bradycardia
Tachycardia
Possible Atrial Fibrillation

The nice part about it is Kardia only uses the first lead to detect these so you do not always have to take the 6 lead test. It can sometimes be inconvenient if you are in a public place.

Unboxing

It arrived in a small box.

I opted to buy the carry pod as well since I plan on throwing this in my laptop bag and carrying around.

Recording

The initial setup and pairing was nice but unexpectedly I did have to disable NFC. I use this for mobile payments so it may be a pain to disable and re-enable constantly. Minor inconvenience but worth mentioning.

Here you can select the Single Lead or 6-Lead. The Single lead requires pointer and middle finger to touch the metal contact from each hand. The 6-Lead requires thumbs and the bottom center metal contact to touch part of your left leg.

Reviewing Results and Sharing

Simply hold for 30 seconds and it will record. when it is done it will provide this report. It will save the results locally but you can use the “Email EKG” to share. This is not limited to email, you can share it with any app on your phone such as FaceBook but it does generate a PDF file so the app needs to be able to accommodate transferring a PDF instead of an image file.

Here is an example of the output I took of my first 6 lead.

Final Words

At a first glance, I am happy with the 6 lead. It may never end up to be more than a toy I tinker with on occasion as I likely do not have any underlying heart issues but it is very convenient to have this available.

Unless you are highly proficient in reading EKG results, the intent should be to capture an event you are unsure of so that you can share with your doctor, whether it be a primary care or cardiologist. Many times you can walk into the ER having an event or even be at the doctor’s office and they not catch it on an EKG. This device gives you a better chance of catching it.

The Importance of Sharpening Your Knives

Dull Knives

This Thanksgiving was much like many of the past Thanksgivings. We smoke a turkey and have some family over. Not much deviated except for the fact that when it came time to carve the turkey I had some difficulties. My carving skills and understanding of turkey anatomy are fairly basic so I figured I just chose the wrong knife.

I chose another one, same thing. I repeated a few times and eventually cut it up with a pair of heavy duty kitchen scissors. A bit brute force but it worked!

How Did I Get Here?

My knives over the years had dulled. They actually had never been sharpened. My wife graciously gifted a knife sharpener for Christmas and it was night and day. I couldn’t believe I had let the knives get so bad. They were all practically glorified butter knives until sharpening them. They were not always this way but now they all cut everything like hot butter.

Why are you reading a blog about sharpening your kitchen knives?

While sharpening the knives, I drew the correlation to personal growth, career growth and overall being. So many things in our life take a toll. These are not necessarily bad things but they do cause some normal wear and tear on our personal wellbeing. We give without replenishing ourselves and resharpening our knives(skills). They can become dull over time too.

What Does This Mean For Me, The Reader?

Remember, all things in life take maintenance. Friendships become stale over time when one party is constantly trying to connect but the other does not reciprocate. The vast knowledge you acquired decades earlier can seem like it was another lifetime ago. Many time we are all too busy to even notice this happening. We have a funny way of getting wrapped up in life and following it without much intention. We have kids and they become our life and all we have time for, especially during the younger and more difficult years. It can be easy to just take a back seat to life for a while and let it go where it will.

What Can I do?

Set aside some time. For some people that may be 20 mins a week. Others may need some PTO to reflect or a nice vacation. Be intentional with this but do not let it consume you. Determine how much time you are going to spend on “sharpening your knives” and stick to it. Don’t over or under do it.

For each person, “sharpening your knives” may be a something different. It may be reconnecting with a family member and building that relationship. For others it may be refreshing on technical skills for your career.

This may even involve doing a self inventory of things that are taking away from your goals and having some hard conversations with people or bosses. Many times some personal baggage needs to be let go so that you can grow. Dealing with that could be an article in and of itself.

Final Words

I hope this has helped. This time of year many of us get some downtime and it is good to reflect and set the course for the new year. Let this be a conversation starter with your friends/significant others/coworkers or even drop me a line in a comment!

Remote Workers – Does It Really Work?

Summary

I have been a remote worker for the past few years. It is not my first time but certainly the longest stint I have done. I wanted to share a few success tips as well as provide some insights for those thinking about doing it.

If you are on site full time or 100% work remote/work from home, the grass may always seem greener. With everything, sometimes it is but it isn’t always!

Remote Work Benefits

Some of the benefits of working remotely can be easily apparent for anyone that is wishing to do this. The biggest one is lack of commute which decreases wear and tear on your vehicle. It also decreases wear and tear on your body due to lack of stress from driving in traffic.

It is almost like getting a small pay raise without actually getting one.

Another benefit is potentially less distractions. Can’t get any work done because people keep coming up to your desk or cube? You’ll immediately lose that foot traffic working remote.

You can take useful breaks. Need to step away for a few minutes and do something else for a bit. If you’re working from home you can start a load of laundry or do some dishes. You’re getting the downtime from what you were working on and being productive for the home as well. It just requires strong boundaries set to avoid getting distracted by all the things going on at home.

At the end of the day when you are done with work, there is no 30-60 minute commute to finish out the day. If you work from home you are already there. If you co-work, hopefully it is near your home and its a light commute.

Remote Work Downsides

For some it can be difficult adjusting to less social interactions. Water cooler talk or impromptu meetings that randomly happen out in the hall can be missed. You can find that you are the last to know random information because of this. Sometimes out of sight, out of mind.

Without a need to go into the office, personal grooming and schedules can become a blur. Asking yourself questions like “Do I really need to shower today?”.

People can get distracted by many things at home. From door to door sales people to never ending laundry, there is a plethora of things to distract you from your work tasks.

Its a rare edge case but I actually started having issues with my transmission in my truck because of the extremely low mileage on it. It is an adaptive transmission and it was not being driven enough under enough conditions to learn properly. – Link as evidence for those non believers. – https://static.nhtsa.gov/odi/tsbs/2016/SB-10081880-5448.pdf.

Another downside I found is that sometimes my commute is too short. I didn’t have the proper time to decompress between home life to work life and then back to home life. For example if I stop at 5:30PM and the wife and kids come home a few minutes later I find that I’m frantic and still trying to unwind from a busy day. The same is true if its a hectic morning getting the kids off to school and I walk into the co-work space with emails lined up that need responding.

Surviving Remote Work

I personally go to a co-working space. This can help mitigate some of the downsides. The space I go to is fairly economical and many places have plans that start at $99/month depending on your area and needs. It is about 5 miles from my house so the commute isn’t terrible by any means.

In some of the more active ones you can find people in similar industries and chat, network and meet like minded individuals.

It gives you a reason to get up on a schedule, shower, groom and be out and about. I also use my lunch break to use the gym a couple of times a week. I find running errands or actually going out to lunch helps to increase social interactions. Even for those that are anti-social or introverts, daily social interaction is important to help keep the mind sharp! Scientists have actually linked loneliness and Alzheimers – https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5764000/

Excelling At Remote Work

If you are working remotely you do not just want to survive but you want to make the best of it. Many times when it comes to coworkers that are not remote workers, you can be up against a perception issue. They imagine you are sitting around, doing laundry and watching TV. Particularly if they try to reach you and you are unavailable. One of the best ways to mitigate this can be to be overly responsive via various mediums your organization communicates. Communicate when you’re in for the day, when you take breaks and lunches and when you’re leaving for the day.

Prioritize the mediums they communicate with with. If its phone or IM/slack, make sure to respond immediately if possible even if its to say you’re busy and you’ll respond in a bit. Lean on the over-communication unless asked to dial it back.

Final Words

Working remotely can be a blessing or a curse. It is not always for everyone but hopefully I have shared a few tips to help you survive and excel at it if you find yourself pushed into it or wanting a remote work job.

OpenVPN with Encrypted Private Key – Issue Resolved

Summary

I was working on Azure Client VPN with OpenVPN and in testing I had removed the passphrase on the private key for authentication but wanted to put it back on there and it would not work. Some quick searches did not turn up much other than common complaints of this.

Reason

With certificate based authentication on OpenVPN, the public key and private key are put in the ovpn file. This is not the most secure with an unencrypted private key as anyone can simply obtain the file and connect.

With a passphrase on it, there is less concern over the ovpn being disseminated and the key reused.

Issue

The OpenVPN client logs indicated the following

2019-12-20 12:22:42-0600 [-] OVPN 40_89_167_211_p4967 ERR: ">FATAL:CLIENT_EXCEPTION: connect error: PEM_PASSWORD_FAIL: mbed TLS: error parsing config private key : PK - Private key password can't be empty"
2019-12-20 12:22:42-0600 [MyOMIClient,0,] FROM OMI: u">FATAL:CLIENT_EXCEPTION: connect error: PEM_PASSWORD_FAIL: mbed TLS: error parsing config private key : PK - Private key password can't be empty"
2019-12-20 12:22:42-0600 [HTTPChannel,224,] *** API CALL f=xmlrpc_Poll args=['sess_40_89_167_211_p4967_VuxJ7YkTyUVYXeKV_1', 10] kw={} ret=[{'active': True, 'timestamp': 1576866162, 'type': 'ACTIVE', 'last': None}, {'timestamp': 1576866162, 'type': 'FATAL', 'error': u"CLIENT_EXCEPTION: connect error: PEM_PASSWORD_FAIL: mbed TLS: error parsing config private key : PK - Private key password can't be empty"}]

It seemed like it was just not prompting me to enter the passphrase and using a blank one.

Solution

I came across the following article ( https://github.com/pivpn/pivpn/issues/372 ) which had quite a few tangents on it but most recently someone indicated using OpenVPN Connect 3.1.0 and it worked. I tried that and was surprised, it actually prompts me for the passphrase!

It seems the community version of the OpenVPN GUI client supported this but the OpenVPN Connect lacked the feature until recently. As of the time of this writing 3.1.0 is Beta but seems to work great!

I had tried upgrading from 2.5 to 2.7 without luck. Finally after installing 3.1.0 it worked again.

Azure Client VPN with OpenVPN

Summary

In my article Intro To Azure Active Directory Domain Services we discussed environments with minimal infrastructure. With all of the RDP exploits it is typically best not to expose RDP over the internet. Since Bastion is not yet fully available the next best thing aside from setting up a VPN appliance is to use the Point-to-site functionality of a Virtual Network Gateway.

Prerequisites

The first pre-requisite for client VPN using a Virtual Network Gateway is to actually provision one. For OpenVPN compatibility it does require at least SKU VpnGw1 and will not work with basic.

It will require 2 subnets, one for the inside leg of the gateway and another for the client-side pool.

The Virtual Network Gateway does want an inside subnet dedicated for use to the Virtual Network Gateway and not shared amongst other devices.

Authentication is handled either via radius or certificate based. If you are reading this article for a minimized infrastructure you probably do not have radius servers.

Provisioning

The provisioning process is fairly simple although it can take 30-60 minutes for the Virtual Network Gateway to fully provision before you can use the Point-to-site configuration. There are a few simple questions.

Virtual Network Gateway - Create — Virtual Network Gateway – Create

That’s really it for the initial provisioning.

Configuration

Some basic Point-to-site configurations need to be set.

The next part is the most difficult part of this. A root and at least one child certificate have to be provisioned. Microsoft has some good documentation on it. To do in Powershell, it does require Windows 10 or Server 2016 or higher.

The name is arbritrary but the “Public certificate data” is the area between the “—BEGIN CERTIFICATE—” section and the “—END CERTIFICATE”

The following Microsoft article describes and outlines the process much better than I can do so I will just share it here – https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

Client Configuration

Again – Microsoft does a really good job on instructions for configuring the client so I will just share this link – https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-openvpn-clients

Final Words

It can be a pain for those of us not familiar with certificates and command line tools like openssl. The idea is that you have a root certificate authority that then issues individual certificates per user or group of users. If that key becomes compromised you can then revoke the individual certificate or untrust the entire certificate authority. I like the idea of creating a CA chain per organization you grant access to.

In this article we walked through creating the resources required and configuring. We did rely heavily upon the Microsoft documentation but it was fairly complete and well shown.

Make sure you distribute your ovpn files with encrypted private keys! – OpenVPN with Encrypted Private Key – Issue Resolved

Intro To Azure Active Directory Domain Services

Summary

Recently I got the pleasure to stand up Azure Active Directory Domain Services (AADDS) for a client. It has some specific use cases and limitations but can be great for your environment.

This article walks you through the background, some of the limitations and also how to provision.

What is Azure Active Directory Domain Services?

This is a natural question. At a high level, let’s talk about the use case for it. In a small cloud environment with a minimal number of VMs, standing up redundant Domain Controllers can chew up a bit of your budget. From there you have to manage and monitor the domain controllers.

AADDS is a managed platform for this. On the back end it appears to be appliances that provide most of the functionality of Active Directory but with some limitations. It also offers a one way sync from Azure Active Directory (AAD) to AADDS. This allows you to use Azure Active Directory credentials to login to VMs.

Use Case

As touched on above, most administrators want a central credential repository for their cloud VMs. If they are used to Active Directory on prem but want to tie this to Azure AD, AADDS makes sense, particularly in small environments where there may not be a full budget to host, manage and maintain full domain controllers with adequate redundancy.

Limitations

There are some notable limitations so if you are looking for the full flexibility of native Domain Controllers, AADDS is not that.

One Way Replication

Replication only occurrs from AAD to AADDS. You can make changes in AADDS via normal Active Directory Users and Computers (ADUC) or other tools but they do not replicate back to AAD. AAD can however overwrite these changes.

Azure Active Directory does support AD Connect to connect to on prem domain controllers but it is not compatible with AADDS at this time.

No Custom Attributes

It does not support extending the schema or adding extra custom attributes

External Guests

While external guest accounts will replicate into AADDS, their password and hashes are inaccessible so you will not be able to login under these accounts. An AAD account local to tenant AD will have to be provisioned.

Lack of Control

When you create or change AAD attributes, you have no control over the replication interval. The initial sync may take an hour or two. The provisioning of AADDS takes quite a bit of time as well. In practice, on a smaller environment, replication does seem to happen within 5-15 minutes.

Provisioning

The first step is to select this from the Market and click create

On the basics tab, pay particular attention to the DNS Domain name. Best practices for domain naming has changed over the years. These settings cannot be changed after implementing.

Azure AD Domain Services - Basics — *Azure AD Domain Services* – Basics

For reference here is the output of the “Help me choose the DNS name”. Also – here is another Microsoft article on best practices – https://social.technet.microsoft.com/wiki/contents/articles/34981.active-directory-best-practices-for-internal-domain-and-network-names.aspx

On the networking tab it will by default create a new Virtual Network and Subnet. You can choose an existing virtual network which is highly likely. It does however, indicate you should use a not in use subnet for this. I have not found much information on that but it may have to do with the Network Security Group it creates and applies.

Azure AD Domain Services - Networking — *Azure AD Domain Services –* Networking

On the next screen you will elect who can manage this environment. Users in this group will function as the “Domain Admins” you are used to in Active Directory.

Azure AD Domain Services - Administration — *Azure AD Domain Services – Administration*

Next we can choose which objects to synchronize but typically it will be all objects. If you think you may want to scope it though, choose that first as you can go from scoped to all but have to recreate to reverse.

Azure AD Domain Services - Synchronization — *Azure AD Domain Services – Synchronization*

Finally, we review the config but pay note to this. In order for this all to work, your AAD hashes have to be stored in the AADDS.

Azure AD Domain Services - Review & Create — *Azure AD Domain Services – Review & Create*

Final Words

In this article we gave a brief overview of Azure Active Directory Domain Services and some use cases. We also went over some limitations and cases where it would not be a good fit. Finally we walked through the actual deployment.

Parsing CSV Files with Golang

Summary

I love coming across problems that require me to learn something new. I have written a few posts about Go (or Golang) such as Using Recursion on Golang to Solve a Problem and Unit Testing Golang on App Engine. Go is one of my favorite utility languages.

Earlier this year, my wife decided to start her own hair salon and do booth rental (Pretty Hare Salon). We set up square for appointment setting and credit cards. It has nice reporting features but there is literally no forecasting. Forecasting helps us determine pricing and when to increase or decrease marketing/advertisement.

Parameters of the Problem

To work around this lack of forecasting, I found an export feature that exports appointments in csv. Unfortunately it does not list the pricing associated with it. At the time, I implemented something in perl but decided to rewrite in Golang. The application inputs two CSV files (1 – appointments and 2 – pricing) and calculates weekly totals based on that.

Helper Function

Error checking and reporting requirements are fairly minimal for this so I use a helper function that is fairly basic.

func CheckErr(err error) {
	if err != nil {
		log.Fatal(err)
	}
}

Loading CSVs

In order to load the CSV into a variable, I opted to use os.Open() which takes the file path. I pass these in through command-line arguments using os.Args. os.Open returns a pointer to a file.

args := os.Args

	appointmentsFile := args[1]
	pricesFiles := args[2]

	af, err := os.Open(appointmentsFile)
	CheckErr(err)

	pf, err := os.Open(pricesFiles)
	CheckErr(err)

I then open the files return by these with cvs.NewReader

appointments := csv.NewReader(af)
prices := csv.NewReader(pf)

NewReader() expects an io.Reader but *os.File implements a reader so we are good.

These readers return a 2 dimensional slice with the left most dimension being the line number and second dimension being the field.

For the price records I read it in entirety. It is not very long.

priceRecords, err = prices.ReadAll()
CheckErr(err)

Iterating the CSV Line by Line

The Appointment file is the full history and we do not need all the data in it. It can get very large over time so it is best not to completely load it into memory. We also will have logic to ignore anything older than 2 weeks as this is a forecast and we do not care about historicals.

for {
	appointment, err := appointments.Read()
	if err == io.EOF {
		break
	}
	// Business logic in here
}

The appointment array in this can then be read as a single dimension. Something similar to what is below exists in the for loop previously shown.

if appointment[2] == "accepted" {
	// More business logic here
}

Looking Up Data

The pricing information which we fully loaded into the two dimensional slice can be iterated as follows

for _, price := range priceRecords {
	if price[0] == service {
		return strconv.ParseFloat(price[8][1:], 64)
	}
}

return 0, errors.New("Could not find service - " + service)

The “service” variable is the service we are looking up. In the price slice, the first or 0 position is the actual service name we are looking up and position 8 is the actual price.

The price field (8) has a dollar sign so I just used string slicing to omit the first character which is the dollar sign so I could parse the float like this

price[8][1:]

The pricing file is highly controlled so I have very little error checking here.

Final Words

In this article we discussed opening and iterating through CSV files using two methods. One involves fully loading the file into memory and the other involves iterating line by line. At this point you should have a good idea of which method to use and when.