How we can do SWAP VIP with multiple ACS configuration?

Question

Hi,
We are using Azure ACS in our application, Also we have used customized ACS page as login form. now whenever we are deploying it to staging, settings available in customized ACS page works fine. but when we switch it to production then web config and
login page settings are not changing. How we can change it or is there any other to implement ACS?
Thanks & Regards
Sachin Jain

Answer 1

After implementing approach defined in
http://www.cloudidentity.com/blog/2011/05/31/EDIT-AND-APPLY-NEW-WIF-S-CONFIG-SETTINGS-IN-YOUR-WINDOWS-AZURE-WEBROLE-WITHOUT-REDEPLOYING/, I was unable to modify the web config. May be I missed some part or Azure is not allowing it. So
I modified it little bit and it worked with following steps:
Step1) Here I am assuming that you have created staging environment in Azure portal and also you have configured it in Azure ACS. I have used Azure ACS customized Login page and asp.net MVC form authentication. First we will modify our code
to read the settings from service configuration file and we will add the Staging GUID url and actual production URL into web config, under Audience URI section. Finally it will be uploaded to Azure portal into staging environment. In the Azure management
portal, we will change the login url settings from configuration tab then save it. Finally we will SWAP both the environments. while browsing application during VIP swap you might get Cryptographic exception which you also need to handle.
Step2) Whenever you download the customized login page from ACS portal then you will find script tag as shown below:
<script src="https://xxxxxxx.accesscontrol.windows.net:443/v2/metadata/IdentityProviders.js?protocol=wsfederation&amp;realm=http%3a%2f%2f127.0.0.1%3a81%2f&amp;reply_to=http%3a%2f%2f127.0.0.1%3a81%2f&amp;context=&amp;request_id=&amp;version=1.0&amp;callback=ShowSigninPage"type="text/javascript"></script>
Step3) Now replace the above code with the following code snippet and here we are trying to pick the login url from service configuration file:
<script src="@ViewBag.LoginURL" type="text/javascript"></script>
Step4) Now go to your controller and try to read the login url settings from service configuration file as shown below:
ViewBag.LoginURL = RoleEnvironment.GetConfigurationSettingValue("LoginURL");
Step5) Now open the service definition file and add setting for LoginUrl under configurationSettings tag as shown below:
<ConfigurationSettings>
<Setting name="LoginUrl" />
</ConfigurationSettings>
Step6) Open the Service configuration file and add the value for login url as shown below:
<ConfigurationSettings>
<Setting name="LoginUrl" value="https://xxxxxx.accesscontrol.windows.net:443/v2/metadata/IdentityProviders.js?protocol=wsfederation&amp;realm=http%3a%2f%2fStaginGUID.cloudapp.net%3a81%2f&amp;reply_to=http%3a%2f%2fStaginGUID.cloudapp.net%3a81%2f&amp;context=&amp;request_id=&amp;version=1.0&amp;callback=ShowSigninPage" />
</ConfigurationSettings>
Step7) you can get Login Url value from Azure ACS Integration tab which provides the above url. While copying the URL replace & with "&amp;" otherwise you will get build error.
Step8) Now add the staging Guid Url and actual production url in web config file under <AudienceURI> section as shown below:
<audienceUris>
<add value="http://Production.cloudapp.net/" />
<add value="http://StagingGUID.cloudapp.net/" />
</audienceUris>
Step9) Publish the application to staging environment and test it. After testing go to configuration tab in azure portal and change the login url with the production URL. (Do not modify the URL or do not change & with &amp;)
<script src="https://xxxxxxx.accesscontrol.windows.net:443/v2/metadata/IdentityProviders.js?protocol=wsfederation&amp;realm=http%3a%2f%2fProduction.cloudapp.net%2f&amp;reply_to=http%3a%2f%2fProduction.cloudapp.net%2f&amp;context=&amp;request_id=&amp;version=1.0&amp;callback=ShowSigninPage"type="text/javascript"></script>
Step10) Save the changes and Swap the environment. Now if you get cryptographic exception then you should handle it.
• Either change the machine key and explicitly define it into web config.
• Catch the exception and logout the user from application and not from windows live id, so that user can be forced to work on new version of application by using following code in Global.asax file:
protected void Application_Error(object sender, EventArgs e)
var error = Server.GetLastError();
var cryptoEx = error as CryptographicException;
if (cryptoEx != null)
FederatedAuthentication.WSFederationAuthenticationModule.SignOut();
Server.ClearError();