QSqlDatabase: QSQLITE driver not loaded

This is really my personal note. May not a sustainable solution even.

Anyway. To access a database engine through QT, copy the sqldrivers folder with the contents where the executable resides.

Kerberos authentication

I finally had a chance to look into this subject rather thoroughly, till having arrived to a certain result. Though in the end, I decided to not to use it, and pursued a different solution to implement the requirement in hand.

First of all, why Kerberos?

In the previous post, I wrote about SharePoint .NET client object model. I looked at it, in order to implement an ASP.NET web app, which allows the users to perform operations such as creation of a document library, on a remote SharePoint. The SharePoint is of “on-premises”. We are not yet on Office 365. Everybody cannot create the document libraries, of course. The users logon to the web app. And only those who are authorized (granted the permission at the SharePoint site) can. Yes, it is the famous “authentication double hop”, or whatever else you may call it, scenario.

To date, in our environment, “Windows authentication” = NTLM. Nowhere Kerberos is used, as far as my knowledge goes. But, it is known that the web server cannot pass to another server, the user credential that it acquires with NTLM authentication. In a scenario such as the above, you need to implement the “Kerberos delegation”.

I was new to Kerberos, leant it only on the university textbook many years ago, so started with some reading of blog posts such as this one: https://blogs.technet.microsoft.com/askds/2008/03/06/kerberos-for-the-busy-admin/. I read it now once again. Still not so easy to read. But in short, this is how I understand it works.

When you choose the “Windows Authentication” for the web app on the IIS Manager, since it comes first in the list, when the client such as Internet Explorer accesses the app and receives the 401 challenge response, it goes to the domain controller and see if the corresponding SPN (Service Principal Name), HTTP/the_web_server in this case, exists.

In case the SPN does exists, under the account (machine or domain) that indeed runs the service, the IIS worker process in this case, your authentication against the web app with Kerberos should succeed.

In short, the key to the success is as simple as registering the correct SPN with the correct account.

1. Service Principal Name

It looks something like HTTP/the_web_server. The first part is called “service class”, and HTTP for web access which uses the default port 80. The same “HTTP” for https (433) as well.

Then the second portion is the name of the web server. This is a bit tricky. This documentation by Microsoft support reads that in case a hostname based virtual web site is in use, the hostname should be registered with the SPN. What I found is different though. It is always the server’s BIOS name, or the machine name that the IE always looks for to the domain controller. And actually, due to this fact, I decided to not to go for this solution. I would like to talk about it later in more detail.

2. The account running the service

When you register or add a SPN, you issue the command like follows on the domain controller.

CMD> setspn –a SPN account_running_the_service

The Kerberos ticket the client gets from the domain controller and then submits to the web server is encrypted using the account specified, its password hash. The web server, the IIS worker process to be more precise, decrypts the ticket submitted with the password hash of the account who runs the process. Therefore, this is imperative that you register the SPN with the account that runs your web app.

However, in the case of IIS, things are a little more complicated.

This is the advanced settings of the windows authentication. It reads that by default the so-called kernel-mode authentication is used. What is kernel-mode authentication? How it changes the behavior?

When the kernel-mode authentication is used, it is always the machine account, something like the machine BIOS name followed by a $ sign, is used to decrypt the tickets, not the custom identity specified for the application pool, that is the worker process. So, if you, without knowing it, register the SPN with the custom identity of the application pool, the authentication fails, with the KRB_AP_ERR_MODIFIED error. By the way, this error you find in the client Event Viewer is super cryptic. I “decrypted” it, thanks to this blog post.

Abandoned nevertheless. Why?

Our organization aggregates many web services under one single hostname, or a domain name; ourorganization.org. You access one such web service at its URL ourorganization.org/webservice1, another at ourorganization.org/webservice2 and so on.

In such an environment, image that I register the SPN for my web app, which is accessed as ourorganization.org/mywebapp just like all the others, as HTTP/ourorganization.org with the custom identity of the application pool that runs the app.

What happened was that for all other web services to which the Windows authentication is chosen, the authentication had started failing!! For none of them, Kerberos is intended to use, but it is there as the first choice by default!! And the kernel-mode authentication is chosen, again not by intention, but by default!! And the authentication fails because they cannot decrypt the Kerberos tickets encrypted using my custom identity. So I retreated. Too heavy side-effects...

Other references:

• How to enable Kerberos event logging
• Using Fiddler To Check For Kerberos Auth
• Setting up Kerberos Authentication for a Website in IIS
• Enable support for Kerberos authentication
• Detect KERBEROS failure with error message
• Kerberos errors in network captures

SharePoint .NET client object model against load balanced servers

This, I found nowhere on the net the solution, and so nearly given up.

For the SharePoint client object model, the sample code are available everywhere on the net e.g. https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/complete-basic-operations-using-sharepoint-client-library-code. None worked for me. The error was “(401) Unauthorized”. The problem was that as you know, even though the servers, a SharePoint farm in this case, are loaded balanced with whatever actual software and/or hardware in use to do so, to perform operations only the authorized users can perform, you need to interact with a single server. There seem, however, no documentation available (I was not able to find at least) explaining how to achieve this.

And so this is how I made it work. Bear in mind that I am not from Microsoft or anything, not an authority, so cannot guarantee you that this is the way to go.

and then

What I expect with this was to accept the load balancer issuing sticky cookie and send it back with the subsequent requests. And it seems do the trick.

Hope this helps you.

Creating Git repository on MS Team Fondation Server

Another note to self.

I was new to Git, so looked for an easy-to-follow instruction such as this one: http://rogerdudler.github.io/git-guide/.

Though the above does not talk about it, first you need to create the repository itself, in case you do not have one. I did not have one, so created one on TFS, and uploaded (“pushed”) the set of files that I want to version-control.

This tells you how to create a team project: https://blogs.msdn.microsoft.com/visualstudioalm/2013/01/30/getting-started-with-git-in-visual-studio-and-team-foundation-service/. You do so on Visual Studio. Though it does not say (I did not find it saying), I believe a team project configured to use Git is a remote master repository of Git.

First, I have cloned the empty repository onto my PC, and added the files that I want to version-control from now on.

Then issued these commands.

- git add *

- git commit -m "Commit message"

They resister and commit my files to the cloned local repository. Now my files are ready to be copied (“pushed”) to TFS, with the following command.

- git push origin master

This pushes the contents of my master branch to the remote repo, the origin (I think this is because the local repo has been cloned from it).

Now, my files are under Git version control. I can checkout, that is, clone them and start modifying in other IDEs which support Git, suh as AndroidStudio and Xcode.

Another my own memo about MVC Scaffolding

First of all, I was not familiar with the word “scaffold”. An online dictionary defines it as “a temporary structure for holding workers and materials during the erection, repair, or decoration of a building.” My understanding of it at this moment is a tool to generate other constructs of a MVC project, such as views and controller, from a model class.

So let us start some tries and errors.

First I create my model class.

Then, give a try to the built-in menu to create the controller.

NOTE: I choose to create the new data context class.

Give it a try to see if the site works for the model. It fucntions nicely to me. Then what is this New Scaffolded Item?

Let us give it a try.

This appears does exactly the same as the Add > Controller...

The next and finally, there is a NuGet package called MvcScaffolding.

It can be used in the Package Manager Console as follows.

PM> Scaffold Controller Team -DbContext TeamContext

NOTE: If omitted, and none exists, a DbContext class is created with the project name.

The result effectively is the same. It creates the controller and views. Though, the code generated are different (taste of the author perhaps)

TIP: This tool does not like my model class as it is shown above, and produces an error: Get-PrimaryKey : Cannot find primary key property for type 'WebApplication9.Models.Event'. Multiple properties appear to be primary keys: Id, EventId

It appears that it does not recognize the [Key] annotation, and takes as the primary key either the column ID or {classname}ID. Read more: https://social.msdn.microsoft.com/Forums/en-US/2cef7375-e832-4f98-9084-4bf0558e57f1/getprimarykey-cannot-find-primary-key-property-for-type?forum=adodotnetentityframework

In the actual project that I work in, for this Event model, I need ths EventID, which uniquely identifies an Event, and is defined and assigned outside of my peoject. Apart from it, there need to be another ID which would be populated automatically when it is created into the corresponding database table. I named the first ID as EventID because It has been calld as such in the existing system, but then stepped on the land mine.

There seems no workaround. I renamed it as _EventID.

Anyway, one advantage of this package over the built-in tool is that it could creates the Repository class.

What is a Repository class?

http://blog.stevensanderson.com/2011/01/13/scaffold-your-aspnet-mvc-3-project-with-the-mvcscaffolding-package/ reads: TeamController reads and writes the data in SoccerSiteContext directly. That’s fine in many simple scenarios, but if you want to decouple your controller logic from persistence logic a little (e.g., so that you can write clean unit tests for the controller), you may prefer to reach your data through an interface.

And this seems is the standard architecture for the next version of the Framework; ASP.NET Core MVC. I understand that the framework that is developped as ASP.NET 5 is now renamed as ASP.NET Core 1.0.

The MvcScaffolding creates the repository class, and then the contoller as follow.

PM> Scaffold Controller Team -DbContext TeamContext -Repository

Hit highlighted summary

Haven’t you ever wondered why for some results, the summary does not contain any highlighted word?

Although the found document file does contain the searched word.

After having spent sometime, I think I found the explanation.

Basically, it is explained at http://goo.gl/RiSFBx.

In short, SharePoint keeps only 10,000 characters for each indexed file for the summary, and highlights the searched word only if it appears in the saved text.

14 and 15 hives, and upgrade solution/features

 

This must not be new and I seem have done this at least once back February, because for the master page in question, I have the same file dated back in February both in the 14 and 15 hives.

But I have forgot completely what I did back then, and spent the entire morning just to update the same master page file. So this time, I write here what I learnt (again) today, so it would be clearer what to do for the next time.

The conclusion first. I need to run this cmdlet:
Install-SPSolution -Identity (the solution file name) –WebApplication (web application name) -FullTrustBinDeployment -CompatibilityLevel All –Force

We are operating a site that we have upgraded from 2010 (we started with 2007 actually). Therefore (I do not know now if it was THE way to go but), FEATUREs that we have been using from the time of 2010 including this master page that I wanted to update today, reside in the two hives.

For FEATUREs that I need to update since the upgrade to SP2013, I have specified SharePointProductVersion="15.0" in their solution manifest, and run simply stsadm –o upgradesolution (I prefer STSADM to PowerShell). They are correctly updated. We have got what we want in the effect.

Today, however, I found one shortcoming (I must have in February too), which is that the ghosted image of the master page that you see in SharePoint Designer stays as it was before i.e. not updated.

First I thought it is probably due to the cache, but at the end concluded that SPD looks into the 14 hives rather than 15. When I update the file in the 14 hive as well as 15, with the above cmdlet, you see properly the updated image in SPD.

I think this is absurd. I do not see any logic. But it appears to be the way it works...