Active Directory Rights Management Services (AD RMS) Developer's Corner

Cross-post: RMS PowerShell cmdlets - preview release

Dan Plastina, MSFT IP Team — Fri, 03 May 2013 05:47:00 GMT

Hello Folks,

The RMS team has been hard at work and now have our first preview release of a set of PowerShell cmdlets using AD RMS SDK.

The cmdlets in the Microsoft.Protection PowerShell module are designed for developers and IT pros who want to automate administration of AD l RMS without directly integrating with the AD RMS SDK 2.1 package. The Microsoft.Protection cmdlets support all the rich functionalities in the AD RMS SDK 2.1.

In this CTP1 release package, we provide:

Microsoft.Protection cmdlet binaries
Install and Uninstall ps1
Readme.docx for the install instructions and the list of cmdlets in CTP1 release
Extensive cmdlet help by running Get-Help on each cmdlet.

Microsoft.Protection cmdlets are work in progress. We will regularly produce updates considering your feedback on feature requests and bugs.

To give our cmdlets a try, go to - https://connect.microsoft.com/site1170/Downloads/DownloadDetails.aspx?DownloadID=49294 and download the package.

NOTE: If you haven’t registered on Microsoft Connect, then: go to www.connect.microsoft.com, sign in with your Microsoft Account > Directory> Search for Rights Management Services > Join.

Enjoy them and let us know about your experience.

Dan

Announcing - AD RMS SDK 2.1 RTM is available

Dan Plastina, MSFT IP Team — Wed, 10 Apr 2013 16:39:00 GMT

Hi folks,

We've hit the AD RMS SDK 2.1 RTM milestone now!. I'll let our expert, Gagan Gulati, explain about these new releases!

Thanks,
Dan

…

Hello again folks,

I'm Gagan and I'm a program manager in the AD RMS team. We are pleased to announce the official release of AD RMS SDK 2.1 and AD RMS Client 2.1!

The new Active Directory Rights Management SDK provides a simple mechanism for developers to create applications and solutions that protect and consume critical content. As part of a major effort to reduce complexity and streamline the development process, the entire API surface has been redesigned from the ground up. We have followed the “write once, run anywhere” philosophy which means that rights-enabled applications using AD RMS SDK 2.1 are guaranteed to work on all supported AD RMS topologies and are compatible with all supported AD RMS servers (V1 SP2, Server 2008, Server 2008 R2).

AD RMS SDK 2.1 eliminates the need for developers to write thousands of lines of specialized code in order to discover AD RMS servers, download and use AD RMS certificates, and manage AD RMS identities, greatly simplifying the integration process.

Also, AD RMS SDK and Client 2.1 provides a number of stellar updates over AD RMS SDK 2.0 including:

AD RMS SDK 2.1 and Client 2.1 fully support Windows Azure Active Directory Rights Management (AADRM)
A complete new set of APIs called File API to make it easy for solutions to build RMS support. See more details here
Critical feedbacks and bug fixes reported by RMS partners and customers
Support for the new Generic Protection infrastructure to support protection for all file types

Download locations

AD RMS SDK 2.1 is available for download here

AD RMS Client 2.1 is available for download here

If you already have AD RMS Client 2.0 installed on your machine, then you will receive a Microsoft Recommended update for AD RMS Client 2.1

Documentation

AD RMS SDK 2.1 RTM documentation can be found here. The documentation will receive continuous updates over the next month.

Feedback

You can continue to provide feedback at https://connect.microsoft.com/site1170/Feedback (If you haven’t registered on Microsoft Connect, then: Go to http://connect.microsoft.com, sign in with your Microsoft Account > Directory> Search for Rights Management Services > Join)

Please remember that you can provide Private feedback as well from this website.

Sample code

IPCNotepad sample is now available here
IpcDLP application sample (using File API) is available here
Managed interop layer for AD RMS SDK 2.1 exists here

Webinar collateral - continues to exist here.

AD RMS SDK FAQ - being continuously updated here

AD RMS developer's corner - our blog is here

Updated interop sample supports File API for C#

Dan Plastina, MSFT IP Team — Thu, 28 Mar 2013 19:04:00 GMT

Hi folks,

Here’s more great work to support AD RMS in the developer tools space. This developer's corner blog post will take you further with our new interoperability sample, allowing you to rights-enable your managed code (ex. C#) applications including support for our new File API.

Murali has done a great job updating the existing managed interop sample and will introduce the new one below.

Thanks,
Dan

…

Hello,

I’m Murali Medisetty, a developer on the RMS team. I have updated the managed interoperability layer in this new sample. The old version, answered the question, “So, how do I use your SDK from C#?” for AD RMS SDK 2.0. The new managed interop sample supports AD RMS SDK 2.1 RC including the support for our new File API. See the MSDN Samples library at AD RMS SDK 2.1 RC Interop Library for the new version

Thanks,
Murali

RMS Performance: File API throughput

Dan Plastina, MSFT IP Team — Wed, 20 Mar 2013 16:57:00 GMT

Hello,

We've got some important performance information to share with you regarding time related to file size graph for File API for Office, PFile and PDF . Here's Akshay with the information.

Thanks,
Dan

...

Hi folks,

I'm Akshay Dhavle, an SDET on the RMS team. Since the initial preview release of the AD RMS File API, we've gotten lots of questions regarding the File API’s performance and throughput. In this blog post, we’ll share our official performance measurements for the File API SDK which is part of AD RMS SDK 2.1 Release Candidate (RC).

We’ll deal with four file formats here:

PDF
Office 2003 formats (e.g., .doc)
Office 2007 (and above) formats (e.g., docx)
Microsoft’s Protected File format (e.g., pfile)

Any file types you need to protect should fall under one of these categories.

How the data was gathered:

We used hardware with 8 GB memory, an Intel Q6600 CPU, and 2x500GB drives in a RAID 0
To make the measurements repeatable we used just one thread, so only 1 CPU core was in use (and was maxed out)
The first calls to IpcfEncryptFile and IpcfDecryptFile were excluded. The first calls generate and acquire certificates from the RMS server, and take longer than each subsequent call.
For IpcfDecryptFile, cached licenses were used to simulate common client DLP application scenarios. Depending on the goals of your application, IpcfDecryptFile may generate additional network traffic beyond what was measured here

We hope this data is useful for you!

As always, if you have any questions or feedback, contact us on our connect site.

File API Sample Application using AD RMS SDK 2.1 RC

Dan Plastina, MSFT IP Team — Tue, 12 Mar 2013 19:58:00 GMT

Hello,

We wanted to share with you our latest sample application built on AD RMS 2.1 RC using File API functionality. Kunal will introduce you to the new sample.

Thanks,
Dan

...

Hi,

I'm Kunal Chawla and am a Test Lead in the IP team. We've got a new sample app we think you'll appreciate.

IpcDlp is a sample rights-enabled Data Leak Prevention (DLP) application utilizing File API. This sample takes you through the basic steps that a DLP rights-enabled application should perform using the File API component of AD RMS SDK 2.1 RC for protecting and consuming restricted content. It is a rich rights-enabled sample application that runs on Windows desktop and demonstrates how you can associate IPC templates with certain file types using the File APIs to encrypt and decrypt using selected templates.

Give the IpcDlp sample a try and let us know what you think. You can download AD RMS SDK 2.1 RC and IP Viewer from here.

Kunal Chawla - Senior Test Lead

Announcing AD RMS SDK 2.1 RC

Dan Plastina, MSFT IP Team — Wed, 06 Mar 2013 18:27:00 GMT

Hi folks,

We've introduced the Release Candidate (RC) of our AD RMS SDK 2.1 which now includes File API. I'll let our expert, Gagan Gulati, explain about these new releases!

Thanks,
Dan

…

Hello,

I'm Gagan and I'm a program manager in the AD RMS team. We are pleased to announce the Release Candidate (RC) for AD RMS SDK 2.1. This package also includes the File API SDK, which allows solutions, handling documents of different file types (Office documents, PDF, text, image and others), to quickly protect and unprotect documents.

AD RMS SDK 2.1 RC
contains the following important updates:

File API and AD RMS SDK 2.1 are now merged as a single AD RMS SDK for Windows
Single Installer containing File API and AD RMS client binaries. You no longer have to install File API protectors separately or make any customizations
Improved administrative configuration support for Generic Protection and other file types
Feedback incorporated from partners who have been prototyping with File API
Improved Generic Protection support with IP Viewer

This release is very important for us. It marks our continued commitment to the ADRMS v2x SDK. AD RMS SDK v2.1 RC is an important milestone to provide complete RMS support for Windows applications and solutions. If you are already using AD RMS 2.0 SDK, you’ll be pleased to know that there is full backwards compatibility.

As the name suggests, the Release Candidate build is one step away from RTM release. We urge you to download these bits and give them a try. You can download this RC version from Microsoft
Connect. In the download package, you will find 32-bit and 64 bit installers, detailed documentation, sample code to interact with File API and the new IP Viewer for Windows desktop which utilizes AD RMS SDK 2.1.

Gagan Gulati, Lead Program Manager
Information Protection, Microsoft Corporation
Developer’s corner: http://blogs.msdn.com/b/rms

Announcing AD RMS SDK 3.0 Beta: rights-enablement support on Android, iOS and Windows RT platforms

Dan Plastina, MSFT IP Team — Fri, 01 Mar 2013 22:25:00 GMT

Hi folks,

It's been a busy time this past couple months in the IP team here at Microsoft. We've introduced a new cross-platform developer tool set for enabling Android, iOS and Windows RT devices. Future blog posts will elaborate on more on these new SDKs enabling clean and simple rights-enablement for device solution developers.

I'll let our expert, Gagan Gulati, explain about these new releases!

Thanks,
Dan

...

Hello,

I'm Gagan and I'm a program manager on the AD RMS team. These are very exciting times for us in the AD RMS group and for our application and solution partner friends. AD RMS SDK 3.0 is a set of simpler, ubiquitous SDKs that are now available on multiple platforms, starting with Windows RT, iOS and Android. These SDKs work exclusively with our new AAD RM cloud service. In the near future, we expect to have SDKs supporting other major device platforms.

The new AD RMS 3.0 SDK is offered in conjunction with the AD RMS 2.x SDK. AD RMS 2.x SDK will remain in active development and is well suited for Windows desktop applications and solutions.

The new AD RMS 3.0 SDK is designed to make it even simpler to integrate with RMS. With the new SDK:

You can right-enable your application with just a few dozen lines of code on these new platforms
Utilize the publishing and consumption UX that we have built within the SDK
Utilize the new Generic Protection framework (PFile) which is now a first class offer of all new RMS SDKs

To get you started, we have placed getting started guides in the Help documentation. We have also done a video on how easy it is to build an RMS-enabled iOS application using AD RMS v3 SDK. We expect similar videos for Android and Windows RT application soon on our Channel 9 site.

We have also built sample applications using the SDKs to get you started. The SDKs work with Azure AD RM so you will also need test organizational accounts to test the SDKs and Sample applications. To request credentials for Azure AD RM test organizations, please email rmcstbeta@microsoft.com.

You can download the AD RMS SDK v3 Beta versions from our Connect site.

If the website shows 'Page not found' it may be that you haven’t registered on Microsoft Connect. So: Go to http://connect.microsoft.com, sign in with your Microsoft Account > Directory> Search for Rights Management Services > Join).

Thanks,

Gagan Gulati, Lead Program Manager
Information Protection, Microsoft Corporation
Developer’s corner: http://blogs.msdn.com/b/rms

Interop layer for AD RMS SDK 2.0 - OR - How do I rights-enable my managed code project?

Dan Plastina, MSFT IP Team — Tue, 04 Dec 2012 22:03:00 GMT

Hi folks,

There is a lot of great work that is happening to support and enable AD RMS in the developer tools space.

This developer's corner blog post will get you started with our new interop sample that allows you to rights-enable your managed code (ex. C#) applications.

Check it out and feel free to pass the word on to any of your friends and associates who might be interested in developing AD RMS applications.

Thanks,
Dan

...

Hi Developers,

I was recently giving a talk about the AD RMS SDK 2.0, when one of the attendees asked me:

“So, how do I use your SDK from C#?”

When I told him that our SDK was native-only, he vowed:

“Managed or death!!”

Hyperbole aside, the point was taken and I’m happy to announce that we’ve now released an AD RMS SDK 2.0 Interop Library in the form of sample code. You can drag/drop this layer into your C# application and use it to directly invoke methods on MSIPC.dll.

The library is structured to map as closely to the native API as possible to make it easy to use the existing RMS SDK 2.0 API reference. Every function exposed in the native API now maps to a static methods in the SafeNativeMethods class.

For example:

Before (C++)

HRESULT hr = IpcInitialize();

if (FAILED(hr)) {

// error --failed to initialize MSIPC.dll

}

After (C#)

// throws exception on error

SafeNativeMethods.IpcInitialize();

Other functions convert similarly. Of course, if you have any questions, you can always get answers quickly at our connect site.

Happy RMS’ing, managed coders!

Thanks,
Duncan

Announcing the Rights Management Services File API

Dan Plastina, MSFT IP Team — Wed, 31 Oct 2012 18:47:00 GMT

As you know, we have made developing RMS-enabled applications much easier with the release of the AD RMS SDK 2.0. What used to take months and thousands of lines of code, now takes days and just a few dozen API calls.

That means that if you develop an application that creates documents that need to be protected, you can now do so with minimal investment and in a very consistent and robust way.

But what if your application has to deal with files in a format that is not its own? What if your application has to protect or consume files that can be in ANY of a myriad of file formats, many of which you don’t even understand? For example, your application is a document management system to which documents in different formats can be uploaded, or it might be a Data Leakage Prevention solution that has to scan and protect files in different formats as they are found on disk. In those cases, handling protected files involved a significant effort as you had to make decisions on the fly based on the format the files were in, and perform lots of low-level functions to get files protected and unprotected as needed.

We are pleased to announce the new File API for Rights Management Services. The File API is a new API that allows applications to easily protect and unprotect files in a single operation. With the file API, you pass the file to an API like EncryptFile along with the policy you want applied and the API does the rest. It will identify the file’s format, and then protect the file appropriately. If it can’t find a suitable protector it will use the brand new Protected File format to encrypt the file and embed access controls so the file is protected in a generic format. All in a single operation.

For example:

if (IpcfIsFileProtected(wszFilePath))

{

// Unprotected file so protect it with full rights to the provided email name

hr = IpcfEncryptFile(wszFilePath, UsageRights, Owner);

}

And if your application has to consume protected files, it is equally simple. You call the API, pass a pointer to the file and, assuming your software runs under an account with the required rights, you get an unprotected file as a result.

This can be extremely useful in integrating solutions with AD RMS, for example:

A document management system can use the File API to encrypt and decrypt files as they are uploaded and downloaded from the document libraries.
A Data Leakage Prevention solution can pass encrypted files to the File API in order to scan their content for sensitive data, as well as using the API to apply different policies to documents found to contain data that needs to be protected.
A document scanning solution such as an antivirus software can use it to decrypt files before passing them to the antimalware engine.
A search indexer can use the file API to decrypt files in order to index them.
A mobile device management system can use the File API to decrypt protected files in order to protect them with a device-specific solution.

And there are many, many other scenarios where the File API can be used to integrate your software with AD RMS.

So how does the File API relate to the AD RMS SDK 2.0 (a.k.a. MSIPC)? The File API is built on top of the SDK, so in essence there’s no overlap in functionality. If your application creates files in its own file format and you are responsible for controlling that file format, then the SDK 2.0 will enable you to create files in the right file format. If, on the other hand, you have to deal with files created by other applications in format you don’t control and you want to be able to protect or decrypt such files from your own software in order to provide protection while you are able to do things with the files content, then the File API is for you.

So I can imagine you are anxious to begin working with the File API. File API Beta is now available at Microsoft Connect (https://connect.microsoft.com/site1170/program6586). You need to sign-up to Microsoft Connect with your Microsoft Account (a.k.a. Live ID), join the Rights Management Services TAP (you can use the Search function to find this in the Directory) and then download the API package by going to http://connect.microsoft.com/site1170/downloads. Once you begin testing it, you can post your feedback at http://connect.microsoft.com/site1170/feedback.

We will be looking forward to see the new solutions you build by using the File API!

AD RMS SDK 2.0 available on MSDN Library site

Dan Plastina, MSFT IP Team — Thu, 20 Sep 2012 17:59:26 GMT

Hi folks,

There is a lot of great work that is happening to support and enable AD RMS in the developer tools space.

In case you missed it, here is a link to where I announced the official release of the AD RMS SDK and AD RMS Client 2.0.

The AD RMS SDK 2.0 enables developers to build applications that can work with AD RMS Client 2.0 to handle complex security practices such as key management, encryption and decryption processing and it offers a much more simplified API for easy application development. If you have tried in the past and found it difficult to build AD RMS-aware applications, we hope you will be pleased with the refinements and improvements that our 2.0 offering brings to the table.

I'm further pleased to see that all of our latest content in the AD RMS SDK 2.0 is now published and available online in the MSDN Library site here: http://msdn.microsoft.com/en-us/library/hh535290(VS.85).aspx.

Hop over there and check it out if you like and feel free to pass the word on to any of your friends and associates who might be interested in developing AD RMS applications.

Thanks,
Dan