Marc Rufer

Marc Rufer

@rufer.be

Software Engineer 👨‍💻 | Microsoft MVP 🇨🇭 | Sonar Navigator 🧭 | Darts enthusiast 🎯 | Father of two 👦 https://blog.rufer.be/ #devops #devsecops #appsecurity #webdev #azure #dotnet

378 followers222 following68 posts

Marc Rufer
@rufer.be

Blogged: [HOWTO] Add Entra ID as an OIDC identity provider in Keycloak using client assertion #keycloak #entraid #msft #entra #oidc #idp #federation

blog.rufer.be[HOWTO] Add Entra ID as an OIDC identity provider in Keycloak using client assertionThis post describes the setup and configuration of an OpenID Connect (OIDC) Identity provider in Keycloak for federation with Microsoft Entra ID. Keycloak version: 26.7.3 Goals Allow users of a specific Entra ID tenant to sign in to Keycloak using their Entra ID account Restrict sign in / access to member users of the specified Entra ID tenant Concept Step-by-Step Instructions…
Marc Rufer
@rufer.be

Blogged: [HOWTO] Using Path.Combine correctly to ensure cross-platform compatibility

blog.rufer.be[HOWTO] Using Path.Combine correctly to ensure cross-platform compatibilityI guess every .NET developer is familiar with the Path.Combine method. But, is every .NET developer using it correctly to ensure its result is cross-platform compatible? I guess no as I was one of these developers who didn't use it correctly. Did you ever see something like this? var arbitraryPath = Path.GetFullPath( Path.Combine( AppContext.BaseDirectory, @"..\..\..\..\ArbitraryDirectory" ) ); This works flawlessly on Windows.
Marc Rufer
@rufer.be

Blogged: [HOWTO] Successfully migrate a .NET 10 test project from VSTest to Microsoft.Testing.Platform (MTP)

blog.rufer.be[HOWTO] Successfully migrate a .NET 10 test project from VSTest to Microsoft.Testing.Platform (MTP)The author migrated a .NET 10 test project from VSTest to Microsoft.Testing.Platform due to CI/CD pipeline failures after a NuGet package update. The post details the migration process, highlighting necessary changes in the Azure DevOps pipeline and .csproj file to resolve errors and achieve successful test runs in both Visual Studio and the Azure DevOps YAML pipeline.
Marc Rufer
@rufer.be

Blogged: [HOWTO] Delete Azure DevOps users with principalName starting with OIDCONFLICT_UpnReuse_ #azuredevops #ado #graph #powershell #posh

blog.rufer.be[HOWTO] Delete Azure DevOps users with principalName starting with OIDCONFLICT_UpnReuse_In Azure DevOps organizations that are connected to Microsoft Entra, you may spot (duplicated) users with email prefixed with OIDCONFLICT_UpnReuse_{OID_HERE} (i.e. when trying to give them access or when mentioning them): Such users are neither visible in the Azure DevOps Web UI under Organization settings > General > Users nor when querying all users via graph or via the Azure DevOps CLI.
Marc Rufer
@rufer.be

Blogged: [HOWTO] Delete users created by bots in Azure AD B2C #azureadb2c #powershell #posh #msftgraph

blog.rufer.be[HOWTO] Delete users created by bots in Azure AD B2CMultifactor authentication via SMS is vulnerable to bot attacks, potentially leading to high costs from automated account creations. To mitigate risks, it's recommended to disable SMS MFA, implement stronger bot protection, or disable sign-ups. If attacked, quickly identify and delete bot-created accounts using Azure portal and PowerShell scripts to manage user identities.
Marc Rufer
@rufer.be

Blogged: [HOWTO] Implement Audit Logging in a .NET Core application using Entity Framework Core and Audit.NET #dotnet #dotnetcore #efcore #auditdotnet #auditing #auditlog #audittrail #traceability

blog.rufer.be[HOWTO] Implement Audit Logging in a .NET Core application using Entity Framework Core and Audit.NETThis blog post outlines the implementation of audit logging using Audit.NET in .NET Core applications with Entity Framework Core. It discusses the purpose of audit logs, which enhance traceability and compliance, and details the setup process, including modifying the DbContext, creating tracking properties, and configuring audit data storage in a dedicated entity.
Marc Rufer
@rufer.be

Blogged: [Headache Prevention] Workaround for the error "Could not authenticate user with requested resource" when accessing the Aspire dashboard #azure #dotnet #aspire #dashboard

blog.rufer.be[Headache Prevention] Workaround for the error “Could not authenticate user with requested resource” when accessing the Aspire dashboardRecently, I deployed a .NET Aspire solution to Azure Container Apps (via Azure Container registry). The Azure Container Apps resource is running within my personal Azure tenant. In my personal tenant, my user is assigned as Owner of the corresponding resource group and therefore also Owner (by inheritance) of the Container Apps Environment which resides within the same resource group. Furthermore, my user has Azure built-in role…
Marc Rufer
@rufer.be

This week @damienbod.com and me attended the @owasp.org BeNeLux Days 2025 in Mechelen, Belgium 🇧🇪 There were some super interesting talks we were able to listen to and after the conference we enjoyed the Belgian beer culture 😉 Thanks to Sonar for the invitation! #owasp #security #conference

Marc Rufer reposted

Damien Bowden
@damienbod.com

Blogged: Implement forgot your password using swiyu, ASP.NET Core Identity and Aspire damienbod.com/2025/11/17/i... #swiyu #aspire #aspnetcore #duende #identity #iam #eid #swiss #identity #dotnet

damienbod.comImplement forgot your password using swiyu, ASP.NET Core Identity and AspireThis post show to implement a “Forgot your password” flow using the Swiss Digital identity and trust infrastructure, (swiyu) in an ASP.NET Core web application using ASP.NET Core Identi…

Marc Rufer reposted

Damien Bowden
@damienbod.com

Production ready web application with full automation and recommended application security @rufer.be @renegadexx.bsky.social github.com/secure-web-a... #aspnetcore #aspire #sonarqube #sonar #github #angular #terraform #sast #authentication #entra #identity #dotnet #sast

github.comGitHub - secure-web-apps/EndToEndSecurityWeb: Secure Web application using ASP.NET Core, Angular, SonarQube and terraform. This repository hosts the source code for our .NET User Group Switzerland tou...Secure Web application using ASP.NET Core, Angular, SonarQube and terraform. This repository hosts the source code for our .NET User Group Switzerland tour. - secure-web-apps/EndToEndSecurityWeb
Marc Rufer
@rufer.be

Worth reading!

Andrew Lock "Sock"@andrewlock.bsky.social

Blogged: Understanding the worst .NET vulnerability ever: request smuggling and CVE-2025-55315 andrewlock.net/understandin... In this post I discuss request smuggling, the recent vulnerability in ASP.NET Core with a severity score of 9.9, and how attackers could exploit it #dotnet #aspnetcore

andrewlock.netUnderstanding the worst .NET vulnerability ever: request smuggling and CVE-2025-55315In this post I discuss request smuggling, the recent vulnerability in ASP.NET Core with a severity score of 9.9, and how attackers could exploit it

Marc Rufer reposted

Damien Bowden
@damienbod.com

Join us tomorrow in Bern www.meetup.com/net-user-gro... End-to-End Secure Web Development with .NET Aspire, JavaScript, E-ID Really looking for to this. @rufer.be @renegadexx.bsky.social #swiyu #sonar #aspnetcore #aspire #dotnet #identity

meetup.comEnd-to-End Secure Web Development with .NET Aspire, JavaScript, E-ID, Wed, Oct 29, 2025, 6:00 PM | MeetupHello Berner .NET friends The e-ID was approved by a narrow majority in the referendum. Let's take this opportunity to look at security and the integration of e-ID into ou

Marc Rufer reposted

Damien Bowden
@damienbod.com

Blogged: Use swiyu, the Swiss E-ID to authenticate users with Duende and .NET Aspire damienbod.com/2025/10/27/u... #swiyu #eid #identity #duende #aspnetcore #dotnet #aspire #openid #openidconnect #oauth #vdc #iam

damienbod.comUse swiyu, the Swiss E-ID to authenticate users with Duende and .NET AspireThis post shows how to authenticate users using Duende IdentityServer and ASP.NET Core Identity which verifies identities (verifiable digital credentials) using the Swiss Digital identity and trust…
Marc Rufer
@rufer.be

Blogged: Software Composition Analysis in SonarQube Advanced Security for SonarQube Cloud #sca #sonarqube #sonarqubecloud #security #sbom #licensecompliance

blog.rufer.beSoftware Composition Analysis in SonarQube Advanced Security for SonarQube CloudOn the 15th of September, 2025, Sonar finally released the long-awaited Software Composition Analysis (SCA) to SonarQube Advanced Security for SonarQube Cloud! Software Composition Analysis (SCA) is an ideally automated process that analyzes software codebases to identify or detect embedded open-source software/components. The identified/detected dependencies form the basis for the following features that SCA tools typically offer. Detection of known security vulnerabilities based on data from…
Marc Rufer
@rufer.be

Blogged: [HOWTO] Configure a custom domain and App Service Managed Certificate with Terraform #azure #appservice #iac #terraform #customdomain #managedcertificate

blog.rufer.be[HOWTO] Configure a custom domain and App Service Managed Certificate with TerraformConfiguring a custom domain for an Azure App Service including a App Service Managed Certificate is the kind of task where I constantly have to look up the details. For this reason, and because a colleague asked me to blog about it, I decided to briefly document the process here.
Marc Rufer
@rufer.be

Blogged: [HOWTO] Enable and configure Defender for Storage at the storage account level by using Terraform #iac #terraform #azurestorage #defenderforstorage

blog.rufer.be[HOWTO] Enable and configure Defender for Storage at the storage account level by using TerraformThe author aimed to enable Defender for Storage on a dedicated storage account using Terraform, updating the existing configuration. Although the Terraform apply succeeded, the feature was not enabled. After research, the issue was resolved by adjusting user roles, allowing a subsequent Terraform apply to produce the desired outcome.

Marc Rufer reposted

Damien Bowden
@damienbod.com

Really looking forward to this event: End-to-End Secure Web Development with .NET Aspire, JavaScript Implementing Swiyu E-ID using Aspire @rufer.be @renegadexx.bsky.social www.meetup.com/net-user-gro... #dotnet #aspire #js #webdev #eID #devops #devsecops #security #swiyu #swiss #identity

meetup.comEnd-to-End Secure Web Development with .NET Aspire, JavaScript, E-ID, Wed, Oct 29, 2025, 6:00 PM | MeetupHello Berner .NET friends The e-ID was approved by a narrow majority in the referendum. Let's take this opportunity to look at security and the integration of e-ID into ou
Marc Rufer
@rufer.be

Really looking forward to talk about "End-to-End Secure Web Development with .NET Aspire, JavaScript, E-ID" together with my friend @damienbod.com www.meetup.com/net-user-gro... #dotnet #aspire #js #webdev #eID #devops #devsecops #security

meetup.comEnd-to-End Secure Web Development with .NET Aspire, JavaScript, E-ID, Wed, Oct 29, 2025, 6:00 PM | MeetupHello Berner .NET friends The e-ID was approved by a narrow majority in the referendum. Let's take this opportunity to look at security and the integration of e-ID into ou
Marc Rufer
@rufer.be

.NET Day Switzerland 2025 was a blast! In addition to inspiring sessions, there was the opportunity to meet old friends and make new ones! Looking forward to the 2026 edition 🤗 Thanks to Manu, Fabian and Thomas for organizing this great community event! #dotnetdayswitzerland #dotnet #community

Marc Rufer
@rufer.be

Blogged: Six interesting use cases for Azure DevOps MCP Server for the daily work of a developer #mcp #mcpserver #azuredevops #ado #githubcopilot

blog.rufer.beSix interesting use cases for Azure DevOps MCP Server for the daily work of a developerWhile preparing my session for DWX 2025, in which I demonstrated a simple use case for Azure DevOps MCP Server (creating a user story from within the IDE), I came up with some other interesting use cases for the daily work of a developer. Now that I have tested them, I will outline the use cases I have discovered in this blog post.
Marc Rufer
@rufer.be

On my way to Mannheim 🚄 #DWX25 is calling! See you there and for the German-speaking participants who are interested in GitHub Copilot, you may consider attending my session 😊 Looking forward to interesting sessions and chats #DWX25 #github #githubcopilot #conference #leavingmycomfortzone

Marc Rufer
@rufer.be

Blogged: [Best Practice] Make Application Configuration of ASP.NET Core applications obvious #dotnet #aspnetcore #configuration #bestpractice

blog.rufer.be[Best Practice] Make Application Configuration of ASP.NET Core applications obviousIn my work as a software developer, I have already been involved in numerous existing .NET software projects. Nearly all of these existing code bases had at least one thing in common: application configuration was not obvious. But why? Especially in the .NET ecosystem everything required to make it obvious is there. In this blog post I share my personal best practice to counteract this situation.
Marc Rufer
@rufer.be

Blogged: [HOWTO] Fix TF400813 error response when using Azure DevOps MCP Server #azuredevops #mcp #mcpserver #githubcopilot

blog.rufer.be[HOWTO] Fix TF400813 error response when using Azure DevOps MCP ServerWhile testing the local Azure DevOps MCP Server public preview, TF400813 error occurred due to wrongly selected default Azure subscription. Re-running az login to and selecting the correct subscription resolved the problem, allowing the server to function properly.

Marc Rufer reposted

Damien Bowden
@damienbod.com

Blogged: Using multiple external identity providers from ASP.NET Core Identity and Duende IdentityServer damienbod.com/2025/05/19/u... #aspnetcore #dotnet #identity #duende #oidc #oauth #profile #auth0

damienbod.comUsing multiple external identity providers from ASP.NET Core Identity and Duende IdentityServerThis blog post shows how an ASP.NET Core Identity application can integrate and implement multiple external identity providers. An OIDC client UI uses the solution and is implemented using Duende I…
Marc Rufer
@rufer.be

Blogged: [NoBrainer] Create git tag in a Azure DevOps YAML pipeline based on AssemblyVersion of a specific .csproj file #azuredevops #ado #git #dotnet #gittag

blog.rufer.be[NoBrainer] Create git tag in a Azure DevOps YAML pipeline based on AssemblyVersion of a specific .csproj fileThe content describes a process for creating a git tag in Azure DevOps after each production deployment, using the assembly version from a .NET project. It outlines a pipeline job that retrieves the version, formats it, then creates and pushes a git tag, requiring specific permissions for the build service user.

Marc Rufer reposted

Damien Bowden
@damienbod.com

Blogged: Implement Phone verification, 2FA using ASP.NET Core Identity damienbod.com/2025/03/03/i... #aspnetcore #dotnet #identity #2fa #mfa #sms #phone #iam #authentication

damienbod.comImplement Phone verification, 2FA using ASP.NET Core IdentityThis post shows how to implement phone (SMS) verification and two-factor authentication (2FA) using ASP.NET Core Identity. The solution integrates phone-based verification and 2FA mechanisms. The i…

Marc Rufer reposted

linusdata.bsky.social
@linusdata.bsky.social

🚀 New Blog Post: Shortcuts in Microsoft Fabric! Access external data without duplication! Learn what Shortcuts are, why they matter, and how to create one. #MicrosoftFabric #DataEngineering #DataAnalytics #Shortcuts

linusdata.blogBenefits of Shortcuts in Microsoft Fabric ExplainedIntroduction What Are Shortcuts in Microsoft Fabric? Authorization Why Use Shortcuts? Step-by-Step Guide: How to Create a Shortcut in Microsoft Fabric Prerequisites Conclusion Introduction Microsoft Fabric introduces a powerful feature called Shortcuts, enabling seamless access to data across different sources without duplication. Shortcuts make data more accessible, reduce storage costs, and streamline data engineering workflows. In this post, we will cover:
Marc Rufer
@rufer.be

Blogged: [HOWTO] Fix "Server identity does not have Azure Active Directory Readers permission" error when using terraform local-exec provisioner to create SQL database users from external provider in a Az DevOps YAML pipeline #azuresql #azure #azuredevops #msftentraauthentication #iac #terraform

blog.rufer.be[HOWTO] Fix “Server identity does not have Azure Active Directory Readers permission” error when using terraform local-exec provisioner to create SQL database users from external provider in a Az DevOps YAML pipelineThe author describes troubleshooting an Azure DevOps YAML pipeline error related to a local-exec provisioner in terraform, which failed to grant necessary permissions due to a missing Azure Active Directory Readers permission. They detail the root causes, error findings, and ultimately the adjustments made to resolve the issue, focusing on least privilege principles.
Marc Rufer
@rufer.be

Blogged: [HOWTO] Set Minimum TLS Cipher Suite of Azure App Service using Terraform #Azure #AzureAppService #IaC #terraform #security #tls #ciphersuite

blog.rufer.be[HOWTO] Set Minimum TLS Cipher Suite of Azure App Service using TerraformAn application’s pentest revealed weak SSL/TLS cipher suites in Azure App Services. To enhance security, non-forward-secrecy cipher suites must be disabled. Utilizing Terraform and the azapi provider, a workaround was implemented to configure the Minimum TLS Cipher Suite, enforcing modern cryptographic standards.

Marc Rufer reposted

Damien Bowden
@damienbod.com

.NET User Group Bern Really enjoyed the .NET User Group Bern event: Triple impact: knowledge, security, action Thanks to all the awesome speakers: Marc Rufer and Raffael Nussbaumer, Andres Bohren and Peter Schnidrig, Laurent Christen and Regina Traber Thanks René for organizing.

Marc Rufer reposted

Damien Bowden
@damienbod.com

Updated Microsoft Entra ID client examples in ASP.NET Core github.com/damienbod/Mi... #dotnet #aspnetcore #net9 #entra #identity #iam #openidconnect #oauth #security #microsoftidentity #bootstrap5

github.comGitHub - damienbod/MicrosoftEntraIDAuthMicrosoftIdentityWeb: Microsoft Entra ID (Azure AD) flows using ASP.NET Core and Microsoft.Identity.WebMicrosoft Entra ID (Azure AD) flows using ASP.NET Core and Microsoft.Identity.Web - damienbod/MicrosoftEntraIDAuthMicrosoftIdentityWeb
Marc Rufer
@rufer.be

Just got my hobby project up and running 🎉🤩 I never ever thought that I once will use a set square after school 😄 #autodarts #darts #hobby

Marc Rufer
@rufer.be

Woohoo! 🎉 Just got my #Microsoft MVP label provided by @bluesky.ms 😍 Absolutely amazing #community contribution by @merill.net - Big thank you! Subscribe to @bluesky.ms to see labels of verified Microsoft employees, Microsoft MVPs and Microsoft RDs #mvpbuzz #community #Microsoft

Marc Rufer
@rufer.be

Blogged: [HOWTO] Run ASP.NET Core integration tests in a Az DevOps YAML pipeline when subject under test uses DefaultAzureCredential #azdevops #devops #yaml #pipeline #integrationtesting #defaultazurecredential #azurecli #workloadidentityfederation

blog.rufer.be[HOWTO] Run ASP.NET Core integration tests in a Az DevOps YAML pipeline when subject under test uses DefaultAzureCredentialLast week I struggled (again) running ASP.NET Core integration tests for an ASP.NET Core Web API that uses DefaultAzureCredential in a Azure DevOps YAML pipeline. To avoid having to struggle again, I am writing down my findings here. The initial situation There was an existing ASP.NET Core (.NET 8) Web API project that uses DefaultAzureCredential to connect to an Azure Key Vault.
Marc Rufer
@rufer.be

Anyone else had troubles after updating VS2022? All the #dotnet SDKs installed before were gone, except .NET 9 SDK #visualstudio #dotnet

Marc Rufer
@rufer.be

Blogged: [HOWTO] Deploy an ASP.NET Core Web API to an Azure App Service using a GitHub Actions Workflow #github #githubactions #azure #oidc #azureappservice #devops

blog.rufer.be[HOWTO] Deploy an ASP.NET Core Web API to an Azure App Service using a GitHub Actions WorkflowThis week, I faced challenges deploying an ASP.NET Core Web API to an Azure App Service using GitHub Actions and OpenID Connect. Initial attempts with azure/webapps-deploy@v3 failed due to missing credentials. A later try with azure/cli@v2 failed because the deployment file wasn't a valid zip. Properly zipping the files led to successful deployment.