Identity Server - OAuth and OIDC

Overview:  The current version of Identity Server is 4.  Identity server is basically a .NET Core 3.1 application that is an Identify Provider (IdP) similar in role to PingId, SiteMinder, AAD b2C.  Identity server allows application (native mobile, web sites and servers) to securely authenticate users.

OAuth2 Grant Types:

Flow	Description	Client	Grant Type
Authorization with PK	Authorization Code Grant Type.  Default choice for authorization.	Native mobile Apps, Windows app, Browser Apps	Code
Client Credential	Server-to-server (S2S) communication also refereed to as Machine-to-machine (M2M).	Server,Consoles,Services	ClientCredentials
Implicit	Rather use the Authorization Code Flow with PKCE	Native Apps & SPA's often use Implicit Flow	Implicit
Hybrid
Device
Resource Owner Pswd

Scopes: The authorisation Server specifies the "scope" that the user has consented too.  So for an API you can limit the actions the user can perform.  Always name your scopes by the API and the Verb e.g. "pauls_api.read" is better than "read".

APIM High Availability and Performance across Regions

Overview:  APIM can be setup in multiple regions and incoming request will be routed to the closest APIM endpoint.  If there is only 1 APIM region, it is best to ensure the API/App Service/Function is hosted in the same region.  With multiple APIM's you can also host a API in the same region.  The routing is either done automatically using Azure Front Door or via policy on the APIM.

More Info: 

https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-deploy-multi-region

App Insights - Website and API Monitoring

Overview:  App Insights has functionality to run scheduled web requests and log the output in App Insights.  There are multiple advantages to this including end to end active monitoring of web sites and API's, and keeping the application warm.

Below I show a simple request to my blog (public website) and the results, Azure refers to this test type as a URL Ping test which is basically a URL HTTP GET request.  

Wait a few minutes and Refresh to see the results:

Very easy way to include a constant check that your API or Website is running.  There is also the options to create "Multi-step web test" using Visual Studio.  You can record the authentication and assert for known response content to build advanced constant monitoring.

Tip: The URL does need to be publicly available.

The content I used to test out the functionality comes from the Microsoft Docs site.

Also see Live Metric Stream that is part of App Insights.

More Info: 

App Insights MultiStep Tests  Replacement Option for MultiStep Test based on Azure Functions

App Insights - Basic Introduction

Overview:  Azure App Insights is a great platform for collecting logs and monitoring cloud based applications on Azure.  All Azure Services can push logging information into App Insight instances.  This can be errors, usages, perferformances logging that in turn is easy to query.  There are SDKs for developers that can be used to add custom logging to applications.

Retension:  App Insights can keep 730 days worth of logs.  For long term storage, "Continious Export" can be used to push data into storage accounts as soon as it arrives in AppInsigthts.  Retaining the App Insight logs for 90 days has no additional cost, so the default to store logs should be set to 90 days at least in most situations.

What is logged and what can be logged:  

• All Azure Services can be configured to send service logs to a specific App Insight instance.
• Instrument packages can be added to services to capture logs such as IIS, or background services.  You can pull in telemetry from infrastructure into App insights e.g. Docker logs, system events.
• Custom code can also call the App Insight instance to add logging and hook into exceptions handling.  There are .NET, Node.JS, Phyton and other SDK's that should e used to add logging, exception capturing, performance and usage statistics.

App Insights has a REST API to query the logs.  The "API Explorer" tool is awesome for querying App Insights online.  

The data below comes from Microsoft Docs.

"What kinds of data are collected?

The main categories are:

• Web server telemetry - HTTP requests. Uri, time taken to process the request, response code, client IP address. Session id.
• Web pages - Page, user and session counts. Page load times. Exceptions. Ajax calls.
• Performance counters - Memory, CPU, IO, Network occupancy.
• Client and server context - OS, locale, device type, browser, screen resolution.
• Exceptions and crashes - stack dumps, build id, CPU type.
• Dependencies - calls to external services such as REST, SQL, AJAX. URI or connection string, duration, success, command.
• Availability tests - duration of test and steps, responses.
• Trace logs and custom telemetry - anything you code into your logs or telemetry."

Azure Dashboards: 

Secure APIM using AAD B2C

Overview:  I have never connected AAD B2C to APIM myself, other on my project teams havde done it so I went thru it and it was super easy.

Followed the instructions: 

https://docs.microsoft.com/en-us/azure/active-directory-b2c/secure-api-management?tabs=applications-legacy

Postman to validate:

PB APIM Series:

APIM Notes

APIM Testing with Postman

APIM Mocking

APIM Mocking part 2

Secure APIM with AAD B2C

Building better Software Thoughts

Overview:  I see a lot of development teams, and they always seem to have areas they are good at and capabilities teams need improvement on.  Key is culture and building a happy team where team members trust and help one another.

Building a culture where teams enjoy code reviews is also key for successful Software projects.   To improve software, reviewing various areas not only code reviews are essential.  For me, clear requirements are the number 1 factor in improving teams performance.  

Companies are getting better at building software; I aim to work on these topics to improve the delivery of software within scrum teams:

1. Code Reviews & Peer Reviews (Daily reviews are awesome, should be pretty short and enjoyable not someone trying to show off or hours long)
2. Collaboration (Standups, Slack/Teams, Code tools have collaboration built in)
3. Documentation & Requirements Reviews
4. Better tooling including better CI/CD tooling including static analysis tools
5. Unit Testing, automate coding standards, Integration testing, UI Testing, and API testing 
6. Requirements (Use Stories are clear and Acceptance Criteria)
7. Cadence is improving thanks predominately to Agile practices; I like short release cycles (2-3 weeks depending on the team and industry).  Changing requirements, indecision kills software projects.  Agile helps, but decisive knowledgeable product owners increase the likelihood of the project succeeding.

Benefits of Code, Documentation and Requirement Reviews:

1. Improved software quality & product delivery
2. Share domain knowledge
3. Training team members (useful for onboarding new team members)
4. Reduce support and fix costs
5. Lower cost & faster development

Options Layering API's on Data Sources - Micrososervices kind of

Hasura takes data sources such as SQL, Postgress & MySQL and converts it into GraphQL API's.  SQL Server is in preview.  Service is available on Azure and hooks into AAD and AAD B2C.  Hasuru looks extremely interesting and useful.  Potentially a great time saver.

CDS/DataFelx/Oakdale - Allows for Entity creation and provides REST API's.

SharePoint lists provide HTTP API's for CRUD operations.

REST API's vs GraphQL

OpenAPI specification (previously known as the Swagger specification) is my default for an API, this allows for a known RESTful API that anyone with access can use.   Open API has set contracts that returned defined objects which is great, you can work with the API like a database with simple CRUD operations as defined by the specification.  The issue is that the returned objects are fixed in structure so you may need 2 or more queries to get the data you are looking for.  Alternatively, GrapghQL allows the developer to ask for the data exactly as the want it.

Open API example:

/api/user/{2} returns the user object  // Get the user object for user 2

/api/users/{2}/orders/10  // Returns the last 10 orders for the user

GraphQL example:

Post a single HTTP request.

query {

 User(id: "") {

    name

    email

    orders(last: 10 {

      orderid

      totalamount

      datemodified

    }

 }

}