This kind of thing was seen for each store in the GeoServer logs:

2020-06-01 13:26:43,677 WARN [org.geoserver] - Failed to load data store 'MyStoreName'
com.thoughtworks.xstream.converters.ConversionException:
---- Debugging information ----
cause-exception     : org.jasypt.exceptions.EncryptionOperationNotPossibleException
cause-message       : null
class               : org.geoserver.catalog.impl.DataStoreInfoImpl
required-type       : org.geoserver.catalog.impl.DataStoreInfoImpl
converter-type      : org.geoserver.config.util.XStreamPersister$StoreInfoConverter
line number         : 31
version             : 2.15.1
-------------------------------

First we verified that we could create a new SQL Server store using the GeoServer administrative interfaces – this proved that the plugin for SQL Server and the various driver files were installed and working correctly.

So why were the old stores not working? The store database connection for each store is defined in a file like this:

"D:\Geoserver_data_dir\workspaces\MyStoreName\MyStoreName\datastore.xml"

and in this file we find a line like this:

<entry key="passwd">crypt1:ywSBY9D+HjlxxL/SuRwBPVmT8P98f47M</entry>

The solution is to delete that line in the definition file for each store, then restart GeoServer. The stores then appear in the GeoServer admin pages, and you can edit each one to re-enter the password, after which any layers should be operational.

At first I thought "simple:- do a search in Windows Explorer for .png and delete". Ah no, that selects all the .png8 files as well, plus my number of folders and files were far too large.

Then I thought... del /S *.png

But no, this deletes the .png8 files as well, grrr.

So I wrote a simple python script, that I will lodge here for future reference. It's Python 2.7, but I imagine would work in 3.* with little or no change. The final print statement probably slows things down, but I wanted to be able to see what was going on.

import os
indir = 'M:\\MyVeryLargeCachePath'
for root, dirs, filenames in os.walk(indir):
    for f in filenames:
        if os.path.splitext(f)[1] == '.png':
            os.remove(os.path.join(root, f))
            print('deleted ' + os.path.join(root, f))

Assuming you have Python installed, simply save this as a file with a .py extension, modify the path and the file extensions to suit, then run it.

This same technique would work for other combinations of file extensions, e.g. to remove *.doc but not *.docx, or to remove *.xls while retaining *.xslx

We use MapServer as a lightweight GIS engine in many of our products, giving us WMS/WFS API endpoints for a wide range of purposes. When upgrading the Colchester Heritage Explorer website, an ASP.NET Core MVC site made with cloudscribe and HBSMR WEB/API components, I dived in to configure and test the MapServer instance. I followed our usual processes, enabled the CGI extension to execute, setting folder permissions to allow MapServer to write out log files, configured our secure MapServer Proxy component, etc.

But it wasn’t working.

One of our first tests of a MapServer instance is to browse to the location of the main MapServer executable, in this case the address was:

https://colchesterheritage.co.uk/wwwroot/MapServer/Scripts/mapserv.exe

but instead of a nice diagnostic response, I got “401 – Unauthorized: Access is denied due to invalid credentials”:

This was very puzzling, as I already had this working perfectly in a parallel test site, on the same server with identical configuration in every respect – or so I thought. Both sites were using an application pool with Identity set to ApplicationPoolIdentity, folder permissions were all good for this identity, there were no ip restrictions, and no reason I could see for it not to work.

Except that I’d forgotten about the Anonymous Authentication Credentials… in IIS select the site > Authentication > select Anonymous Authentication and click “Edit…” > I found the default setting:

And of course I had not set up permissions for this user to access the location of the MapServer files. So there are two solutions: a) less preferred: add the IUSR account at the root of site with default permissions:

(if I were using this solution I would also tick “Deny” for the “Write” setting off bottom of that image);

or b) preferred: change the Anonymous Authentication Credentials for the site to the Application pool identity:

After making this change, on browsing to our MapServer executable I saw the expected response “Noquery information to decode. QUERY_STRING is set, but empty. ” which means the CGI application is working.

Phew – problem solved!

My next step in hardening this site is to block this direct access, and route all requests through a secured proxy, so the above URL to the exe won’t work by the time you read this if we’ve done our security right.

To see the working result, check out the maps within the Colchester Heritage Explorer, for example this map of the historic buildings and sites that are included on the Colchester “Local List”.

And here’s a rather nice map of WW2 pillboxes and related defensive sites around Colchester, generated by a MapServer WFS request in response to a a free text search on “pillboxes”:

I hope this helps someone, and please feel free to add comments below.

Historic Environment Records evolved from the County "Sites and Monuments Records" that developed in the 1970s and 1980s, often pioneering the use of the emerging database technologies of the day. These "SMRs" in turn owe their origins to the records collected by the Ordnance Survey ("OS"), driven by O.G.S. Crawford in the 1920s and 1930s, which used a systematic method of cataloguing sites on index cards and 1:10,000 (or earlier 1 mile=6") map sheets. 

This fascinating guide to the Ordnance Survey records was recently found in the records of the Somerset Archaeological Society. It was presumably distributed by Ordnance Survey whenever they sent out copies of the cards.

The guide

THE ORDNANCE SURVEY'S ARCHAEOLOGICAL RECORDS

A. INTRODUCTION

The records consist of 8" x 5" index cards ('Record Cards') which give information about antiquities, and 1:10,000/1:10,560 maps ('Record Sheets') on which the sites of the antiquities are marked. The Record Card is described under B, the Record Sheet under C, and under D is a Glossary of the common abbreviations used on both cards and sheets.

B. THE RECORD CARD

The component parts of the current record card are as in Fig 1 below. There were some differences on older cards though the same purposes were served. The main differences are noted in the explanation.

 

1. ANTIQUITY NUMBER

This consists of the National grid number of the 1:10,000/10,560 sheet within which the antiquity falls (eg TQ 37 SW) plus a serial number within that sheet (eg TQ 37 SW 4), and used in its full form identifies the antiquity uniquely. The serial numbers are simply allotted consecutively as each record is compiled, and consequently have no bearing on where the site falls within the sheet, nor any typological significance.

There can also be subsidiary number (eg TQ 37 SW 4.1), used when a component part of an antiquity is allotted a card to itself.

There can in addition be a 'Miscellaneous Information card' for any sheet. This gives very brief information on items of marginal interest which fall on the sheet, and there is only one such card (or card series) for each sheet. It is identified by the sheet number plus a bracketed 'M' (e.g. TQ 37 SW (M)).

2. COUNTY

The name of the county at the date of the last entry. Abbreviations are those adopted by the Ordnance Survey.

3. PARISH

The name of the civil parish at the date of the last entry.

4. CLASSIFICATION

Abbreviations of the archaeological period(s) within which the subject(s) of a card falls, and also abbreviations to show that the period is unestablished, or that the subject of the record not an antiquity (within OS specification). The abbreviations and their meanings are given in the glossary under D below.

5. SPARE

Reserved for future extension of the classification.

6. PAGE NUMBER

The card side number whenever the record extends over than one card side.

7. SCHEDULING

The letter 'S' is entered when the antiquity is scheduled as an Ancient Monument by the Department Of the Environment. On old cards, scheduling was mentioned as text information and authorized. 'S's have not been comprehensively entered, and the lack of an 'S' is no guarantee that the antiquity is unscheduled.

8. SITING SUMARY

A Map-reference of the latest established site or find-spot of the antiquity, whenever this is known to at least a six-figure accuracy (i.e. to within about 100 metres). When siting is less precisely known, the name of the town, village or other place associated with it is entered with a four-figure reference. On old cards the siting summary was in the space serving for both purposes.

9. TYPOLOGY SUMMARY

A brief summary of the (latest established) nature of the antiquity in modern terms, taken from the information recorded, and accounting for each item in the record which has a different period classification.

10. PUBLICATION DIRECTION

Direction (for internal use) as to whether the antiquity is to be published on standard basic scale map, and if so the form the name should take and the type character to be used.

11. TEXT

The information necessary to demonstrate the siting, nature and condition of the antiquity (or to give as much as possible towards those ends), taken from whatever sources provide it, these sources being shown in the adjoining 'Authorities' part - see 12 below. The information can be entered either 'objectively' (i.e. by separate precis from each source) or 'subjectively' (i.e. by a single entry compiled from as many sources as are necessary), or by a mixture of these methods.

Normally the record will start with the objective entry of an Ordnance Survey publication. In subjective entries references are given to the various sources by use of the author's name or bracketed numbers. In objective entries the whole of the text is attributed to a single authority. The recorder can himself make interpolated comments, or even a separate entry of his own opinions. Field reports are always attributable to the Field Investigator himself unless otherwise stated.

12. AUTHORITIES

Each authority (source) consulted and used is given a number. With objective recording this number, with the title of the authority concerned, is positioned opposite the top line of the relevant text entry. With subjective recording, the numbers and authority titles are listed in sequence without interval, the first being opposite the first line of the text entry.

Secondary authorities (or sub-references) are lettered in lower case, and this lettering is in sequence throughout any one record (i.e. letters are not repeated even though under a different primary authority). Secondary authorities are only noted when they make necessary contributions but do not need to be used as primary authorities; it should therefore be appreciated that the primary authorities contain references which are not noted on the record cards. Secondary authorities may in fact have been consulted by the recorder, but the implication of the identification by lower case letters is that they have not. The recorder responsible for entries is identified by R1, R2 etc, with his initials and date, entered opposite the line of the last entry. The Field Investigator is similarly identified by F1, F2 etc, entered opposite the top line of his field report (and covering any recording between that entry and the last recorder's ascription). In the field reports informants are usually treated as secondary authorities, but they can be given separate entries as primary authorities. On old cards Recorders were designated 'OR' and Field Investigators FI and full names were given.

References dealing with relevant typology, but not with the specific antiquity which is the subject of a record, are mentioned in the text, not the Authorities compartment.

13. ILLUSTRATIONS

Illustrations are mounted on separate 'Illustration Cards' numbered in the same way as the record cards. The illustrations may be air photographs, ground photographs, diagrams, plans, or surveys, and they are folded to size if necessary. The photographs do not reproduce.

All Archaeology Division field surveys are ultimately included as illustrations, but there is delay in annexing them, as they have to pass through drawing stage (for the production of new OS maps) before becoming available.

C. THE RECORD SHEET

An example of the current record sheet marking is given in Fig 2 below. The essential ingredients are:

a. a convention marking the site

b. the antiquity number

c. a typological summary.

There were some differences on older record sheets though the same purposes were served. The main differences are noted in the explanations.

 

1. SITE MARKING

Various markings are used, and on the master copy record sheets different colours are also employed for further refinement. But the main purposes of the record sheets are to serve as indices to the record cards and to record the sites of antiquities topographically, and these purposes are just as well served by monochrome copies. All that is lost are certain nuances of siting and typology useful for quick reference but fully covered on the record cards.

The markings are: Crosses, Published detail, Sketched outline, Bands, Linear markings and Broken linear markings.

The following explanations deal with their monochrome fom only, so more than one meaning sometimes attaches to a single convention. The separate implications however can be readily clarified by reference to the record cards.

Crosses

a. Accurate find-spot or site, whether or not extant (Ex 5).

b. Inaccurate site or find spot (Ex 1).

c. Centre of an extensive antiquity when the outline cannot be properly recovered (Ex 11). 

Published detail

This is normally left to stand by itself (Exs 9, 2.1) but it can be shaded or blocked in when it is necessary to distinguish it from adjacent features (Ex 12). 

Sketched outline

This is used in preference to a cross for large antiquities which are not published on the record sheet (Ex 10).

Bands

a. Defining a group of antiquities treated on a single record card (Ex 4).

b. Defining the known outline of a feature or site with no perimeter feature (eg a DMV) (Ex 2).

c. Defining the area within which an antiquity occurs, when that area is already defined by published detail, such as hedges (Ex 7).

Linear Markings

The course of a linear antiquity; including extensive enclosure banks etc such as park pales (Exs RR46, Lin 21).

Broken linear markings

The course of a linear antiquity when uncertain (Ex RR46).

2. ANTIQUITY NUMBERS

A plain number in a circle is the number allotted to the record card. It should be noted that to identify the antiquity uniquely the sheet number must be added to this (Exs 1-12).

A decimalised number in a circle refers to a subsidiary record (cf B 1 above) (Ex 2.1).

A smaller number in brackets applies to miscellaneous information (cf B 1 above) (Ex (1)).

The entry of a number in the east margin of the sheet conveys that the antiquity concerned probably falls on that sheet but cannot be sited with any accuracy (Exs 6, 8).

A full number in brackets entered in the margin adjacent to the marking of an antiquity which extends over the edge shows that the card is allotted to the adjacent sheet (Ex (TQ 37 NW6), in north margin).

Linear antiquities are numbered according to a separate Linear system, which is not controlled by sheets. Roman Roads are given the Margary numbers ('Roman Roads in Britain'), otherwise the numbering system is the Ordnance Survey's. Linear numbering is entered on the sheets in brackets, normally along the axis of the Linear (Exs RR46, Lin 21).

3. TYPOLOGICAL SUMMARIES

These are similar to the typological summaries on the record cards (cf B9 above), though they need not be exactly the same.  They are entered on the sheets for convenience and as a safeguarding connection with the record card, additional to the number.

D. GLOSSARY OF ABBREVIATIONS USED ON THE ORDNANCE SURVEY'S ARCHAEOLOGICAL RECORD CARDS AND SHEETS

This is not comprehensive, but should account for the majority of the abbreviations which might be puzzling. It does not account for the book title abbreviations used in the 'Authorities' part of the record card, which should be easily understood, nor for the initials of the compiling staff (see B 12 above) Which are irrelevant to the understanding of the records.

ABBREVIATION	MEANING	AREA OF OCCURRENCE (Number of component part of record card, as in Fig 1, or 'S')
AAO	Assistant Archaeology Officer	12
Acc No	Museum Accession number	11
Accn No	"              "                "	11
AO	Archaeology Officer	12
"	Archaeology Division	12
AP	Air photograph	11, 12
AS	Anglo-Saxon	9, 11, S
AT	Antiquity Tpe character	10, 11
Authy	Authority	11
BA	Bronze Age	4, 9, 11, S
BM	British Museum	11
C or c	Century	9, 11
c	Circa	11
Corr	Ordnance Survey arch. correspondent	12
Corr 6"	Correspondent's annotated 6" sheet	12
Crem	Cremation	9, 11
DA	Dark Ages	9, 11, S
DOE	Department of the Environment	12
DMV	Deserted medieval village	9, 11, S
diss	Dissolved (monasteries)	11
EBA	Early Bronze Age	9, 11, S
EI	Early Industrial	4, S
EIA	Early Iron Age	9, 11, S
Ewk	Earthwork	9, 11, S
Ed	Editor	11, 12
Ed	Edition	11, 12
F1, F2 etc	First, second, etc OS Arch fd investigator	12
fd	Found	11, S
"	Founded	11, S
GP	Ground photograph	11, 12
GS	Gil Sans type character	10, 11
GT	German Text type character	10, 11
HHR	DOE Historic Houses record	12
IA	Iron Age	4, 9, 11, S
IAM	DOE Inspectorate of Ancient Monuments	11, 12
Inf	Informant, or Information from	12
Inhum	Inhumation	9, 11
LB	Lutheran Black type character (Obs)	11
LB	Long Barrow	11
LBA	Late Bronze Age	9, 11, S
Lin	Class name for linear feature other than a Roman road	11, S
(M)	Miscellaneous Information card	1
MBA	Middle Bronze Age	9, 11, S
Md	Medieval	9, 11, S
Me	Mesolithic	4, 9, 11, S
MHLG	Ministry of Housing & Local Govt (Obs)	12
MOW	Ministry of Works (Obs)	12
MPBW	Ministry of Pub Works & Buildings (Obs)	12
Mus 6"	Annotated Museum 6" sheet	12
NAT	Non-antiquity type character	10, 11
Ne	Neolithic	4, 9, 11, S
NMR	National Monument Record	11, 12
NR	Non-Roman Type character	10, 11
Occ	Occupation	9, 11, S
ONB	Ordnance Survey 'Object Name Book'	11, 12
OR	Office Recorder (OS staff) (Obs)	12
OS	Ordnance Survey	11, 12
P	Continue to publish in same form	10
Pa	Palaeolithic	4, 9, 11, S
Poss	Possible	9, 11, S
PN	Post-Norman	4
PR	Post-Roman	4
Prob	Probably	9, 11, S
Pte 6"	Private 6" sheet, annotated	12
R1, R2 etc	First, second, etc OS Arch recorder	12
Rec 6"	Records 6" (obsolete annotated sheet)	12
Rems	Remains of	9, 11, S
RB	Romano-British	9, 11, S
R & F	Ridge and furrow	9, 11
Ro	Roman	4, 9, 11, S
RR	Roman Road with Margary number	1, 9, 11, S
RRX	Roman Road without Margary number	1, 9, 11, S
S	Scheduled by IAM (qv)	7
SS Rev	OS Small Scales reviser	12
S/Svyr	Senior Surveyor (Archaeology Division)	12
TI	Times Italic type character	11
TU	Times Upright type character	11
U	Period unestablished	4, 9
X	Not an antiquity	4
X	Do not publish on standard maps	10

 

In this post we are assuming we are looking at WMS – so image caching.

There are a couple of pre-requisites to get caching to work:

• Your WMS requests must be using a recognised tiling system in the same coordinate system as you build your cache.
• You must be requesting your WMS as tiles

Consider your data

Before launching into building tile caches its a good idea to stop and think about your data. 

Is the resolution of my data appropriate

If its vector data for example can you simplify it at all (e.g. run .Reduce in SQL server or ST_Simplify in Postgres).  We have seen numerous datasets where there are many nodes per metre and this is just extra load if the data is simply going to be displayed against a tiled map so its worth considering if its worth creating   simplified version of your data.

What is the maximum zoom I want users to see my data

Its pointless to allow users to zoom in past the appropriate resolution for your data, and as you will see when we build the cache each extra step requires 4 times the storage of the previous level. http://bboxfinder.com provides an easy way to check which tile step you are viewing the map at – and decide what is appropriate for your data.   Tile steps run from 0 to 19 normally.

What is the update frequency / churn of my data

Caching is relatively easy if the data is unchanging.  If it changes frequently you need to think about how to manage cache refreshing and what is the maximum time that users can wait to see refreshed data.  As always there is a trade off with performance here.

Do users filter my data

If users filter your data to display you have to decide if you will cache every possible permutation (which may well not be practical unless the filters are very limited) or just cache the base layer and accept users will hit the source for filtered views.

Deciding what to cache

Once you have decided you want to cache your layer you then need to decide if you are going to cache every zoom level you are displaying the data at – or perhaps just the lower zoom levels and let users hit the source for detailed views (which will reduce your cache storage significantly in some cases)

Enabling caching in geoserver

The easiest way to enable caching (in that you can just request your WMS as normal) is to enable direct integration with Geoserver WMS  on the Tile Caching, Caching defaults menu.  This is not set on a default install.

Setting up disk quota

This is an important setting.  A pre-seeded cache will take up a lot of disk space and you want to make sure you have enough space set aside.  By default the cache will go in your \geoserver\gwc folder

If you do not have limitless disk space its probably worth setting a quota appropriate to your infrastructure.

Setting up caching on individual layers

You must then enable caching on the layer that you want to cache using the Tile caching, Tile Layers menu.

Pick the layers that you want to cache and then click Configure selected layers with caching defaults

There are a few settings we need to consider in here:

Data tab

Bounding boxes

If these are computed from the SRS bounds make sure they cover no more than the area you want cached. http://bboxfinder.com provides an easy way do get coordinates for a custom bounding box.

Publishing tab

HTTP Settings

This allows you to set the headers in the response to the client browser and control how long the browser itself should cache the tile – so not needing to request even the server cached tile again.

Tile caching tab

Tile image formats

Correct setting here can make massive difference to your cache size.  If you are in control of the client you might want to restrict caching to just one file format.  We tend to use png8 which is normally 25% of the size of png and allows transparency.

Metatiling factors

By default this is 4 x 4 which means when building the cache it will request a tile 4 times the size you actually want – this helps with avoiding chopped labels on the edge etc

Cache expiry

0 means use the server default (which is normally off I think).

-1 means switch off (i.e. never), any other value is the number of seconds till the cache expires

The server cache setting determines how old a cached tile can be before it needs to be regenerated from source.  If your data is static you can leave this setting off.  If it changes you will need to put some thought into how old its acceptable for data to appear to clients.

The client cache is a little less clear it seems to overlap with the HTTP settings (above) though has been reported to not always work.  It may not be needed if you have set the HTTP header response.

Zoom levels

You need to decide what zoom levels are appropriate for your data and whether you want them all cached.  Sometimes we don’t cache the most detailed layer as that significantly reduces the cache size.

Seeding the cache

By default having made all the settings above your cache will start to be built.  Every time a WMS request is received by GWC the cache will be checked first, it it doesn’t exist in there the tile will be generated and saved in the cache for subsequent requests.  As you can imagine the performance of your service will be variable as the cache is randomly built up over time.

Alternatively you can go to https://mygeoserverurl/geoserver/gwc/demo and seed the cache.

Select your layer and decide how many tasks you want to run, the zoom levels you want to seed and the bounding box you want to seed within.  Then set it running.

Note:  For detailed zoom levels this will take many hours / days and use potentially TB of disk space

Testing your cache

Hopefully you will see a noticeable performance gain when the cache is being hit, but there are a couple of checks you can do in a client browser.

First of all though – remember you cache will only be used if:

• Your application is requesting WMS tiles
• The call includes &TILES=True as part of the call

If you open the dev tools in your browser (we are using chrome here – but firefox and IE have similar) and inspect a call you are making to geoserver

There are several things you can see from the headers:

• Status code 200 – this means that the call was made (as opposed to locally cached)
• geowebcache-cache-result: HIT – this tells you that your tile was found in the cache.

If you refresh the page you case see:

• Status code 304 – this shows that the tile was retrieved from your local browser cache.
• Because it came from your local cache there is no geowebcache value.

All went well and we modified the mapserver geojson output format to specify the field we wanted to use (originally named id in our case) but adding in the line: FORMATOPTION "LCO:ID_FIELD=id"

OUTPUTFORMAT
   NAME "geojson"
   DRIVER "OGR/GEOJSON"
   MIMETYPE "application/json; subtype=geojson"
   FORMATOPTION "STORAGE=stream"
   FORMATOPTION "FORM=SIMPLE"
   FORMATOPTION "LCO:COORDINATE_PRECISION=0"
   FORMATOPTION "LCO:ID_FIELD=id"
END

The field “id” needed to be included in the relevant map layer in the gml_include_items e.g.:

"gml_include_items"     "name,recsubtype,recsubtypecode,rectype,ref,uid,id"

After those changes – all seemed to be going well and the id was appearing in our WFS return

However when we looked at some of the other attributes we noticed scrambled characters (these had been fine with the previous version of mapserver). e.g. rectype in screenshot below

Our data was coming from SQL server using the msplugin_mssql2008 plugin– and if we set debug in the mapserver layer and looked at the log we saw:

msConvertWideStringToUTF8(): General error message. Unable to convert string in encoding 'UCS-2LE' to UTF8 An invalid multibyte sequence has been encountered in the input

So it looked as it something was going wrong in the unicode translation.  The workaround was refreshingly simple – we just had to alter the view that the data was being pulled from to force the conversion e.g. change:

‘Site’

to:

CONVERT(nvarchar(1),N’Site’)

then all was well again.

Aim

I wanted a cloudscribe site running allowing users to be able to logon as usual using cookies, but I also wanted to have an API that could be secured for clients external to the site without having to use the cookie login and I wanted to use Identity Server 4 with a SQL data store.

Starting setup

Server

I used Joe Audette's excellent cloudscribe Visual Studio template https://www.cloudscribe.com/blog/2017/09/11/announcing-cloudscribe-project-templates and selected use MSSQL Server and the Include Identity Server integration option. Also selecting the 2 options in the “Expert Zone” gave me an example API to test with.

This gave me the basic website and was the one I wanted to add the secured API into. The VS project has a weather forecast API as an example.

Client

I then setup a separate MVC project using a basic template to act as the client application. This was all done using Visual Studio 2017 and .Net Core 2.

Server application

By default, the weather forecast API is accessible to all users. Try: http://localhost:35668/api/SampleData/WeatherForecasts

You can secure this by adding the [Authorize] statement to the API on the SampleDataController.cs page e.g.

[Authorize]
[HttpGet("[action]")]
public IEnumerable<WeatherForecast> WeatherForecasts()
{
    var rng = new Random();

but you will find this presents the standard cloudscribe logon screen to access it – not exactly what’s wanted for an API.

In order to solve this we need to use JWT authorisation alongside the standard cookie authentication, but tell the API to only secure using the JWT authorisation . This is done by filtering the authentication scheme used by the Authorize statement as below (you will probably have to add the following assemblies to your code)

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Authentication.JwtBearer;

and then add the filter to the authorize statement.

[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
[HttpGet("[action]")]
public IEnumerable<WeatherForecast> WeatherForecasts()
{
    var rng = new Random();

We have now told the API to authenticate using JWTBearer but we haven’t yet added JWT authentication to our applications pipeline. So in the startup.cs page we need to add in some assemblies:

using Microsoft.AspNetCore.Authentication.JwtBearer;

and then add the JWT service into the ConfigureServices method. (I added the statement below just above services.AddCors(options =>)

services.AddAuthentication(options =>
{
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})

.AddJwtBearer(options =>
{
    options.Authority = "http://localhost:35668"; //No trailing /
    options.Audience = "api2"; //Name of api
    options.RequireHttpsMetadata = false;

});

Where:

.Authority is the address of the website with the api (note no trailing slash)

.Audience is the name you have given to the api in the Identity server 4 security setup (see more details below)

And then we need to tell our pipeline to use Authentication. So add the app.UseAuthentication() into the end of the ConfigureServices method just above the UseMVC call

app.UseAuthentication();
UseMvc(app, multiTenantOptions.Mode == cloudscribe.Core.Models.MultiTenantMode.FolderName);

Now if you try and access the api - http://localhost:35668/api/SampleData/WeatherForecasts - you should get an unauthorised message - even if you are logged onto the cloudscribe site using cookie authentication.

Identity Server 4 configuration (through cloudscribe)

Identity server has many options – which can be bewildering to start with. Full documentation is here: https://identityserver4.readthedocs.io/

For our purposes here – I’m outlining the bare minimum that we need to setup security for our API, either using:

· A client credential using a secret

· A username and password

API resources

Under the admin menu in cloudscribe select security settings / API resources and create a new API record giving it a name (e.g. api2) making sure it matches the name you entered as the .Audience in the startup.cs .

Then we need to add a single scope record – called “allowapi2” in this example.

Client resources

Under the admin menu in cloudscribe select security settings / API Clients and create a new client (I’ve called it client2 – remember this name for when we make the call from the client application). Edit the new client record and add:

· Allowed Scope record – e.g. allowapi2 – this must match the scope we entered for the api and is used to specify which apis this client can access

· Client Secrets – the value is the SHA56 value of the secret we wish to use (in this example secret2) – at the moment the cloudscribe interface doesn’t do this conversion for us so we have to do it manually somewhere (e.g. I used string s = "secret2".ToSha256();)   

I added the secret using the web page and then pasted the converted secret direct into the relevant field in the record in the csids_ClientSecrets table in the database - but I think it would work equally well just pasting the converted value into the web page.

.ToSha256() is a string extension method in the IdentityModel assembly - this seems to do more than simply convert to sha256 - see https://github.com/IdentityModel/IdentityModel/blob/master/source/IdentityModel.Net45/Extensions/HashStringExtensions.cs.

It’s important that we set the secret type as well – in our example here it must be “SharedSecret”

Joe Audette has updated his nuget packages so saving a client secret now gives you a range of options for the secret type - in our example we need to pick "SharedSecret" and select to encrypt using Sha256 (see Joe's post in comments below for other options) which should make things easier.

· Allowed Grant types – we are entering “password” and “client_credentials”. These determine how we can authenticate from the client app as we see below in the next section. Password means that authentication can use a username / pwd combination (i.e. a cloudscribe login). Client_credentials means we can login using a client secret and don’t have to be a known user on the site.

Client application

To connect securely to the API using a client connection with a secret use:

var tokenClient = new TokenClient(disco.TokenEndpoint, "client2", "secret2");

To connect using a username and password use:

var tokenResponsePassword = await tokenClient.RequestResourceOwnerPasswordAsync("admin", "admin", "allowapi2");

Note that the user name is the user name not the email which can be used to login interactively.

The whole method in the controller looked something like this – the rest of the code is deserializing the JSON return from the API and putting it into an object that can be displayed on a view page

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using ESDM.Models;
using System.Net.Http;
using Newtonsoft.Json;
using IdentityModel.Client;
using IdentityServerClient.Models;
using IdentityModel;

and then

//Hosted web API REST Service base url  
string Baseurl = "http://localhost:35668";

public async Task<ActionResult> Index()
{
    List<WeatherForecast> ans = new List<WeatherForecast>();
     using (var client = new HttpClient())
    {
        // discover endpoints from metadata
        var disco = await DiscoveryClient.GetAsync(Baseurl);
        var tokenClient = new TokenClient(disco.TokenEndpoint, "client2", "secret2");
        var tokenResponse = await tokenClient.RequestClientCredentialsAsync("allowapi2");

//Example getting alternative token if you want to use username / pwd 
        var tokenResponsePassword = await tokenClient.RequestResourceOwnerPasswordAsync("admin", "admin", "allowapi2");

        // call api - change for tokenResponsePassword if you want to use username / pwd
        client.SetBearerToken(tokenResponse.AccessToken);

        var response = await client.GetAsync(Baseurl + "/api/SampleData/WeatherForecasts");
        if (response.IsSuccessStatusCode)
        {
            var content =  response.Content.ReadAsStringAsync().Result;
            ans = JsonConvert.DeserializeObject<List<WeatherForecast>>(content);
        }
        return View(ans);
    }

The model for the forecast data was:

namespace ESDM.Models
{
    public partial class WeatherForecast
    {
        public string DateFormatted { get; set; }
        public int TemperatureC { get; set; }
        public string Summary { get; set; }

        public int TemperatureF
        {
            get
            {
                return 32 + (int)(TemperatureC / 0.5556);
            }
        }
    }
}

And my view contained

@model IEnumerable<ESDM.Models.WeatherForecast>
<div>
    <ul>
        @foreach (var forecast in Model)
        {
            <li>@forecast.Summary</li>
        }
    </ul>
</div>

docmd.TransferDatabase acLink, "ODBC","ODBC;DRIVER=SQL Server;SERVER=myServer\myInstanceIfNeeded;DATABASE=myDatabaseName;Trusted_connection=yes;", acTable,"myTableName","myTableName",False,True

The final parameter ensures that login credentials are stored.

Of course our production applications like HBSMR and PACS manage database connections in a more sophisticated manner, with the ability to switch databases and define which tables/views are attached in one operation, but the above technique can be useful where MS Access is being used for quick querying/editing/reporting operations.

1. Download the 64-bit version on the MS Access ODBC driver (AccessDatabaseEngine_x64.exe): http://www.microsoft.com/en-gb/download/details.aspx?id=13255
2. If you don’t have 32-bit MS Office installed you can just run the exe, however if you do have 32-bit office installed then you need to start an admin command prompt and run the installer in passive mode as follows:

AccessDatabaseEngine_x64.exe /passive

3. For QGIS 2: Then you need to edit the qgis-ltr.bat (normally in C:\Program Files\QGIS x.xx\bin, in previous versions used to be qgis.bat) and add the following lines (before the ‘start’ command)

set OGR_SKIP=ODBC
set PGEO_DRIVER_TEMPLATE=DRIVER=Microsoft Access Driver (*.mdb, *.accdb);DBQ=%%s

4. For QGIS 3: In QGIS Settings panel -> Options | System | Environment add the following two variables:

   variable name: PGEO_DRIVER_TEMPLATE 
   value: DRIVER=Microsoft Access Driver (*.mdb, *.accdb);DBQ=%s
   Or if being used on a shared server add a system environment variable 
   PGEO_DRIVER_TEMPLATE=DRIVER=Microsoft Access Driver (*.mdb, *.accdb);DBQ=%s

5. Now you should be able to start QGIS and simply drag the geodatabase mdb file onto the QGIS workspace and it will open.

The problem...

If you publish a SQL Server (in this case 2014) table or view with a GUID field using GeoServer (version 2.10), it will fail to make  a valid WFS because the &request=DescribeFeatureType response will not include these layers.

This manifests itself in various ways depending on the client, but in QGIS on trying to load the layer into the map we get this in the "Log Messages Panel":

Analysis of DescribeFeatureType response failed for url  srsname='EPSG:27700' typename=xxx:yyyurl='https://mysite.com/myworkspace/wfs' version='1.0.0' table="" sql=: it is probably a schema for Complex Features

which had me puzzled for quite some time!

The solution...

Changing the data source view to include this field with

CAST(myGUID AS varchar(36)) AS myGUID

then hitting "Reload feature type" in the GeoServer layer configuration screen fixes it. This changes the field data type from "UUID" to "string" in that screen. Or just omit the field entirely.

My guess is this will not help transactional WFS, but I have not tested this. Overall, GUIDs are still best avoided in GIS-land as they are so poorly supported by the database drivers.

This expression seems to do the job without loopholes: ^([0-9]|[1-9][0-9]|100)$

If we want to permit decimals, then it gets more interesting. I'm no regexpert, but something like this should ensure we get either an integer from 0 to 100 or any decimal in between, with up to 2d.p. (also permitting 100.0 and 100.00!):

^100(\.[0]{1,2})?|([0-9]|[1-9][0-9])(\.[0-9]{1,2})?$

Spot any problems with these regular expressions...? Please comment and help me improve!

The next step was to switch off the old version of GeoServer and present the new version on its address, minimising transition time. This required changing the port of the new version from 8081 to 8080, so I scoured the internet on how to do this. I found a few threads out there, but none gave me the right answer. They specifically mentioned \etc\jetty.xml and GeoServer’s startup.bat, neither of which configured the port for my installation. In fact the configuration is to be found against the Windows service:

Opening this service reveals the port specified in the command line (here showing after I had changed it):

Changing this command required editing the registry, with these settings found under HKEY_LOCAL_MACHINE\SYSTEM\ ControlSet001\services\GeoServer 2.7.0:

Edit the command-line as follows:

I also edited the previous version to start on port 8081 (in case I needed to run both), then stopped the older version’s service and restarted the new version’s service. Everything worked fine, with an imperceptible transition. And as predicted, the disk quota thing started working too.

So that’s how to change the port for GeoServer running on Windows with Jetty!

BackupChain fails almost as soon as it starts when backing up SQL Server VM

SQL server VM Application log is riddled with errors

Diagnostics:

Use VSSDiag

You can start by using the VssDiag http://backupchain.com/VssDiag.html and enter the exact time when the error was reported by backup chain(within 5 minutes) on the SQL Server VM

This will list any VSS issues from the log

I saw an error like:

A VSS writer has rejected an event with error 0x800423f4, The writer experienced a non-transient error.  If the backup process is retried,
the error is likely to reoccur.
. Changes that the writer made to the writer components while handling the event will not be available to the requester.
Check the event log for related events from the application hosting the VSS writer.

Operation:
   PrepareForSnapshot Event

Context:
   Execution Context: Writer
   Writer Class Id: {a65faa63-5ea8-4ebc-9dbd-a0c4db26912a}
   Writer Name: SqlServerWriter
   Writer Instance Name: SQL Server 2008 R2:SQLWriter
   Writer Instance ID: {d78d914d-4a11-4350-8334-af08bff3ce07}
   Command Line: "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
   Process ID: 2408

Look in VM Application Event Log

I saw several entries for databases:

The log for database 'CMSi-TNC-demo' is not available. Check the event log for related error messages. Resolve any errors and restart the database.

If in Enterprise manager you run DBCC CHECKDB  for the database mentioned you may see a host of errors

Fix:

I found the fix was to take the database in question  offline and then put it back online again.

Running DBCC CHECKDB again then reported no errors

After I had worked through all the databases that had this error – BackupChain could then run a VM backup

Of course MS Access has featured combo boxes (drop-down lists) with “auto expand” capabilities since time began; here’s an example where I’ve typed “pen” into the control and it has automatically selected the first matching value:

(The list can be opened by clicking on the down arrow, or by hitting F4 - one of the many keyboard shortcuts that nobody knows - or in code with the dropdown method).

This is fine for most situations, but there are cases where the auto-expanding combo box falls down:

• Very long lists (like many hundreds or thousands of rows in the drop-down): firstly this can be a performance problem, putting significant load on network and database whenever a user uses the control, secondly very long lists are not user-friendly, and worst of all the auto expand can just stop working or give strange results; in a system I was working on with SQL Server data storage, one combo with >4000 rows would frequently fail to find values in the list when the user started typing.
• Lists where the user may not know the starting text (e.g. trying to find Southampton in a list that includes it as City of Southampton).
• Situations where we want to give the user an easy way of selecting multiple items. Not the main focus of this post, but it does provide much of a solution if you need it.

This post describes a way of providing a nice user experience in these situations.

In the first simple example implementation the user is looking for the record for one of our clients based on knowing the unusual first name of a member of staff there. In this case the dropdown opens when the user has typed “bri”, showing lots of rows of people called “Bridges” etc, then when the user adds a “t” the list looks like this:

On selecting a row, the form updates to show the full record for the selected client.

An implementation like this starts with an unbound combo box, making sure its Auto Expand property is set to No. You will ultimately need to clear the Row Source, but it makes design easier to start with a row source for the dropdown that closely resembles the final version. Typically this might be a table with a primary key value that will be hidden (e.g. an ID), and a visible descriptive field (e.g. a Name). Other properties can be set to suit requirements, so perhaps (following this simple example) Column Count = 2, Column Widths “0cm;10 cm” and List Width “10cm”. Keep Limit To List set to “Yes”. When you have a combo box that is behaving nicely with a Row Source, switch back to design view and remove the Row Source. Leave the Row Source Type set to “Table/Query”.

Now we need to add some code to make it work. First we add a handler for the On Key Down event, like this:

Private Sub Combo0_KeyDown(KeyCode As Integer, Shift As Integer)
  If KeyCode = 8 Or KeyCode = 17 Or KeyCode = 32 Or KeyCode = 46 Or KeyCode > 47 Then
    Me.TimerInterval = 300
  End If
End Sub

This will make the form do something 300 milliseconds later if the pressed key is one we like, i.e. one that changes the contents of the control in a way that should affect the search. 8 is Backspace, 32 is Spacebar, 46 is Del so we need them. 17 is CTRL and can arrive if the user pastes with CTRL+V or cuts with CTRL+X. Most keycodes over 47 are characters.

See the bottom of this post for an extension to make this handle mouse and ribbon-based paste operations.

Why 300 milliseconds? Make it whatever you like, but I found that is a reasonable amount of time to wait before executing the search if a user has clicked into the control and started typing. Any longer and the user feels like they are having to hang around, any faster and it searches before they’ve had time to enter the characters they are confident about. Note that if the user presses more than one key, for example by typing “Rob”, each will set the form’s timer interval, which re-starts the timer and so defers the resulting action until 300 milliseconds after the last key press. So the 300 really defines the length of pause after hitting any one key.

At this point the observant will be wondering why we are using the Key Down event and not the Key Up event. Well I started off by using Key Up event, but I found that it simply does not fire if the user selects some of the entered text and removes it with the Del key; however using the Key Down event does need extra care, because when it fires the contents of the control have not yet changed to reflect the key press.

Now we need some code on the form’s Timer event.

Private Sub Form_Timer()
    TimerInterval = 0
    SearchByName Combo0.Text
End Sub

In this case we first switch off the timer, then pass the text that is now in the control into a method that will execute the search. Because we are harvesting the search value now, and not in the Key Down event, we get the value after all key presses have completed. Note that we do have to use the .Text property, and not the .Value property (which is the default if we just pass me!Combo0 as a string).

Now we need to process the search. In this simple example we have a private method in the form’s code-behind:

Private Sub SearchByName(SearchString As String)
Dim qryDef As QueryDef
  If Len(SearchString) >= 2 Then
    Set qryDef = CurrentDb.QueryDefs("qryNameSearch")
    qryDef.Parameters("NameSearch") = SearchString
    Set Combo0.Recordset = qryDef.OpenRecordset
    Set qryDef = Nothing
    If Combo0.Recordset.RecordCount > 0 Then Combo0.Dropdown
  Else
    Set Combo0.Recordset = Nothing
  End If
End Sub

This relies on a saved parameter query, which in the example above might be something like:

PARAMETERS NameSearch Text ( 255 );
SELECT Staff.ID, Staff.LastName
FROM Staff
WHERE Staff.LastName Like [NameSearch] & '*';

or if you want to find matches when the user enters characters from the middle of the name as well:

WHERE Staff.LastName Like '*' & [NameSearch] & '*';

And of course the query can be adapted to return more advanced expressions, as in the screenshot above, and executing the search however best suits the data. And the SQL could be inline if you don’t want a saved query. Or it could be a SQL Server stored procedure, or even a called to a web service that is converted to a recordset on return, etc etc.

If we are in a data entry form where the value always exists in the list, that’s it, job done. If the value may not exist (see the example below) we need to give the user a way of entering data. If the control is being used to navigate to a record, then we need to do something when the user selects a value using a handler on the control’s After Update event, such as:

Private Sub Combo0_AfterUpdate()

    If Combo0 > "" Then
      … do something …
    End If

End Sub

Moving on from this simple example, it’s also possible to show the list of values in a separate control that is made visible when a search finds rows. In the example below (from home!) I’ve used a list box, setting it’s record source in similar fashion to the above combo box. I prefer the look and feel of this approach, and it would also allow the user to select more than one row which could be useful in some situations. The example below is a form used for taking entries to fell races. A large proportion of runners have entered before, so it saves a lot of time to fetch and confirm their previous details rather than starting from scratch. On the other hand, lots of people share the same names, particularly in South Wales(!), so we need to see quite a lot of information to confirm a match.
When the user enters two or more characters of the surname, a list appears. On selecting a row, the remaining details are automatically filled in (in the parts of the form hidden by the list in this image). If a match is not found, the user has a simple data entry form to enter a new competitor.

In this case our search method looks like this, to show or hide the list:

If Len(RunnerSearch.Text) >= 2 Then
  Set qryDef = CurrentDb.QueryDefs("RegistrationFormNameSearchQry")
  qryDef.Parameters("NameSearch") = RunnerSearch.Text
  Set lstRunnerPicker.Recordset = qryDef.OpenRecordset
  Set qryDef = Nothing
  lstRunnerPicker.Height = 567 * 4.9 ' 567 twips per cm
  lstRunnerPicker_Label.Height 567 * 4.9
  lstRunnerPicker.Visible = True
Else
  lstRunnerPicker.Visible = False
End If

I hope someone finds this helpful. I’m sure these approaches can be refined and improved in all kinds of ways, so feedback welcome.

UPDATE @ 4th December 2016

When checking out comments from Rick Wiker below, I noticed my code above doesn't detect right-click > Paste, or Paste using the ribbon tool. I find this is easily solved using the On Change event, eg:

Private Sub RunnerSearch_Change()
  If Me.TimerInterval = 0 Then
    Me.TimerInterval = 300
  End If
End Sub

The condition is probably not needed - I just used it to be specific about when this was happening (i.e. when the KeyDown event has not already set the timer). This seems to work for a text box search control for both mouse and ribbon-based pasting. I've not yet tested this approach with a combo, and haven't spotted any negative side effects. Feel free to comment!

Behind the scenes, SQL Server stores information about the views in its system tables;  the key one for our purposes here is Information_Schema.Views, which includes, among other things, the view's name and its SQL definition, something like the example below:

Now, suppose I rename vieContacts in the interface to OldVieContacts. This will update the name in the system table, but does not update the definition, so I end up with the following:

When I come to recompile the view, it will fail, giving me the error "Msg 208, Level 16, State 6, Procedure sp_refreshsqlmodule_internal, Line 75
Invalid object name 'vieContacts'." This is because the name doesn't match what is stored in the definition.

Unfortunately, the problem doesn't stop there. If I use the copy/paste funtion in SQL Managent Studio, I can copy a view, rename it so that it's a backup and then edit my original. This sounds like a good idea, but because of the problems that renaming causes, it can lead to major headaches later on. To illustrate why this can be so confusing, let's imagine I copy my vieContacts, rename the copy to OldVieContacts and modify my vieContacts to include another couple of fields. After this, I would have the following in Information_Schema.Views:

What makes this such a potential problem is that if I recompile OldVieContacts (and this might be done as part of a script that refreshes all the views) the inbuilt function reads the definition out of Information_Schema.Views, which tells it to rebuild vieContacts, so the result is that vieContacts gets overwritten and I would see my two new columns disappear from it. Worse, the refresh process also updates the definition in Information_Schema.Views, so now vieContacts would be stuck with the incorrect structure and no easy way to fix it.

So what can you do about these problems? Well, here are some suggestions:

1. Prevention is better than cure. Don't rename views thorugh the SQL Management Studio interface.
2. If you need to change the name of the view, drop the view and recreate it with the new name - you can use the "Script View As" option to create a SQL script that will do the drop and create for you, and you can just change the name in the script for the creation before running it.
3. If you're lucky, you may be able to rename the view in the interface back to its old name. This isn't recommended though as it's not as sure as other methods.
4. Rather than copying a view, just copy the SQL definition from the designer into a new blank view. This may seem more complex than just copying & pasting the view, but it will be better in the long term
5. If you suspect that some of your views may suffer from this issue, you can check to see how severe the problem is by running this SQL command from a query window: Select TABLE_NAME, VIEW_DEFINITION from INFORMATION_SCHEMA.VIEWS where VIEW_DEFINITION not like '%' + TABLE_NAME + '%' - this will identify the views that need attention.
6. You can repair a view that has suffered in this way by running an Alter View script to alter the view to the correct definition.

The best thing, though, is to avoid renaming views through the SQL Server Management Studio interface.

Ticking the box and saving the Store fixed the problem.

Our hypothesis is that if the GeoServer service is re-started when the database server is not yet available, GeoServer automatically disables the affected Stores. [I later found this discussion in which one of the GroServer developers confirms that "the startup code checks if the stores are available, and if not, it
disables them".

We will try to prevent this happening again by ensuring that the GIS server is restarted well after the database servers, but we’d welcome any other ideas.

Although the served version of MapInfo is installed, when MapInfo is run the dialog for activation asks for the serial number and access code as for a node-locked licence, instead of the licence server name and port number.

This issue is caused by registry keys in HKEY_USERS pointing to the node-locked licence that are conflicting with registry keys in HKEY_LOCAL_MACHINE pointing to the concurrent licence.

To fix this issue:

1. Ensure that if a node-locked licence was activated it has been transferred back to Pitney Bowes, then close MapInfo.
2. Open Registry Editor and go to Edit > Find and search for MINWES.
3. Back up the registry using File > Export.
4. Remove the folder in HKEY_USERS that contains this key for the affected version e.g. HKEY_USERS\{UserID}\Software\MapInfo\MapInfo\Professional\1250.
5. Run MapInfo to check it is now using the concurrent licence.

CREATE TABLE #RowCountsAndSizes (TableName NVARCHAR(128),rows CHAR(11),      
       reserved VARCHAR(18),data VARCHAR(18),index_size VARCHAR(18), 
       unused VARCHAR(18))

EXEC       sp_MSForEachTable 'INSERT INTO #RowCountsAndSizes EXEC sp_spaceused ''?'' '

SELECT     TableName,CONVERT(bigint,rows) AS NumberOfRows,
           CONVERT(bigint,left(reserved,len(reserved)-3)) AS SizeinKB
FROM       #RowCountsAndSizes 
ORDER BY   NumberOfRows DESC,SizeinKB DESC,TableName

DROP TABLE #RowCountsAndSizes

The original details including some other useful scripts can be found using the following link:

 http://www.sqlmatters.com/Articles/Listing%20all%20tables%20in%20a%20database%20and%20their%20row%20counts%20and%20sizes.aspx

i.e. Remote Desktop can't connect to the remote computer for one of these reasons:

1) Remote access to the server if not enabled

2) The remote computer is turned off

3) The remote computer is not available on the network

Make sure the remote computer is turned on and connected to the network, and that remote access is enabled.

After a lot of time trying to work out why this single user could not connect we found an error in the Security Event Log looking similar to that shown below.
NOTE: The Server Manager\Remote Desktop Services\Servers screen in Windows Server 2012 shows Event Log information but it appears that it doesn't show everything relevant, because this error didn’t appear there so we chased our tails for a long time before actually finding this error in the Security Event Log.

------------------------------------------------

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          29/07/2014 15:27:57
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      myserver.mydomain.local

Description:
An account failed to log on.

Subject:
    Security ID:        NULL SID
    Account Name:        -
    Account Domain:        -
    Logon ID:        0x0

Logon Type:            3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:        myusername
    Account Domain:        mydomain

Failure Information:
    Failure Reason:        An Error occured during Logon.
    Status:            0xC000035B
    Sub Status:        0x0

Process Information:
    Caller Process ID:    0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:    remotepcname
    Source Network Address:    -
    Source Port:        -

Detailed Authentication Information:
    Logon Process:       
    Authentication Package:    NTLM
    Transited Services:    -
    Package Name (NTLM only):    -
    Key Length:        0

This event is generated when a logon request fails. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

------------------------------------------------------------------

After researching this error it turned out that the problem was caused by a local policy setting on the remote PC (not the server). The policy that needed changes was:

Computer Configuration->Windows Settings->Security Settings – Network security:LAN Manager authentication level.

The default on Windows 7 & 8 is to not have any value set for this setting, though this particular user's PC it was set to "Send LM and NTLM - use NTLMv2 session security if negotiated "; it needs to be set to “Send NTLMV2 response only”. Once this was done the Windows 8.1 PC was able to open RemoteApp applications without problems.

This setting can be changed using the local group policy editor on the PC (run gpedit.msc) and changing the values as shown below: