Jon Simpson's Life Plugins

Azure, ACS & MVC3 Caution

2011-10-31T22:55:00.002Z

I was about to write a Rob Conery style rant about how this quirk of MVC3, Azure and ACS has been p1ssing me off for the last week, but I'll keep it brief and to the point.
I have, what I believe, is a relatively common situation.

I'm building a site using MVC3 and Razor to be hosted on Azure.
I'm using Azure ACS to give me Google, Live, Yahoo and other Idenitiy Provider options to access my site.

The problem I have is that when I bundle my MVC3/ACS solution to the cloud using the out of the box tooling, I hit a problem, in short when I attempt to access a restricted path on the site, the WIF/ACS logon redirect isn't fired and the user is sent directly to the target page, unauthenticated!

The steps I took were as follows:-

1. Create my MVC3 solution/project using the Internet Application template
2. Add an Azure project to my solution and then add a web role reference to the MVC3 project within the same solution.
3. Configure ACS to accept request from, and issue tokens to the instance running on my localhost
4. Use the Windows Identity Foundation Federation Utility to automatically update my web.config with entries required to use Azure ACS as my Identity Provider.
5. Add the following entry to web.config to force authentication when an attempt is made to access the account/signin page

So far so good.I fired it up locally and it worked a treat.

I then added the configuration on the Azure ACS for my Azure hosted version of the solution, using the public facing URL.
Before deploying to Azure, you need to consider what is installed in the GAC on the target machine - in short, not a lot. To overcome this you need to bundle the MVC3 DLL dependencies into your bin folder - known as "Bin Deploying". This is a little clumsy, so there is a handy feature in MVC3 which packages the dependent binaries required on the Azure host.

To use this feature, right click on your MVC3 project and choose: "Add Deployable Dependencies". In the dialog select "ASP.NET MVC". This puts all of these tenuous dependencies in place. *Do NOT select "ASP.NET Web Pages with Razor syntax" - this is NOT what it seems.

This will create/update a folder named _bin_DeployableAssemblies containing all of the non-GAC'd DLL's that you need. At compile time these assemblies are automatically copied across to you bin folder.

With the bin folder ready and the project deployed to the cloud, the ACS authentication simply doesn't kick in, so why?

I retraced my steps and through trial and error and some educated guesses found that the problem was with the _bin_DeployableAssemblies entries, specifically the WebMatrix.WebData dll: a security plugin that clashes with the Microsoft.Identity namespace

Once I knew what the problem was, it was then easy to find someone else who had blogged about this
http://brockallen.wordpress.com/2011/06/01/beware-bin-deployment-of-mvc-and-razor-with-formsauthentication/

Copied from this post...

What’s happening is that when you ~/bin deploy MVC and Razor, the Razor DLLs are auto-registering some pre-App_Start code to run (which I thought was a neat idea, until now). For the curious it’s WebMatrix.WebData.PreApplicationStartCode.SetupFormsAuthentication from WebMatrix.WebData.dll. If this assembly is not ~/bin deployed then this pre-App_Start code doesn’t run. This pre-App_Start code will force Forms authentication to be enabled (with the login URL at the aforementioned path) unless it finds config data telling it otherwise. Here’s the kicker: the absence of any config data is sufficient to enable this feature. You have to explicitly disable it (as described above). This is quite annoying.

I concur, annoying! Phil Haack has a good post on bin deploying assemblies.

http://haacked.com/archive/2011/05/25/bin-deploying-asp-net-mvc-3.aspx

*this is the key problem, to quote Phil Haack "When building an ASP.NET MVC application, you only need to check the first option. Ignore the fact that the second one says "Razor". ASP.NET Web Pages with Razor syntax was the official full name of the product we simply call ASP.NET Web Pages now. Yeah, it’s confusing.

Building secure, authenticated WCF services for Windows Phone 7 using the ASPNET membership framework

2011-01-16T22:35:00.001Z

I have done a bit of digging around in order to work out how to "go public" with many of the internal facing services that are offered to our enterprise and applications.

With the exception of 1 or 2 web services that we expose to our partners on a private circuit, we do not have any public web services so our security considerations to-date have been very different.

We use ASPNET membership as the basis for our authorisation and authentication so it makes sense to re-use this for our phone applications. In later posts I will look at how federation can be used to achieve a more seamless login approach.

This particular approach uses the "stateless" model where credentials are passed for every service call. There are other options which I will cover in later posts.

Pre-requisites

1. Admin/sa access to SQL Server 2005 or 2008

2. A VeriSign SSL certificate or a certificate where the root CA is VeriSign (such as a GoDaddy issued cert for use with SSL)

3. Visual Studio 2010 with the Windows Phone 7 emulator and tools

Anyway, I have broken this into stages on the basis that you may already have some of the below in place or ready - that was my situation, if so jump to Step 3.

Step 1: Creating the ASPNET membership database

Goal: Create the database, roles and associated stored procedures to support the ASPNET membership framework

I'm using a local instance of SQL Server 2008 R2 but this will work equally well on 2005 or SQLExpress. Launch SQL Server management studio and create a new database, let's call it ASPNET

Run the following command from the Framework libraries. This needn't be in the V4 library as I have been using this since .NET V2.0
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
Running this without any command line parameters will launch the wizard which keeps things simple

Confirm your settings in the wizard and all of the default tables for the ASPNET membership, roles, personalisation, applications etc. with associated stored procedures have been created for you.

Step 2: Tools to manage the ASPNET membership data

Goal: Demonstrate how to configure users and roles within the ASPNET tables

In my case at least, we have developed a custom tool for managing our authentication and authorisation data, but Microsoft (as part of the ASP.NET experience in Visual Studio) have created a nice tool to get you going.

In Visual Studio 2010 (this is also available in 2008) create a new ASP.NET web application. The standard template will create all of the membership tables and stored procedures for you in a local .mdf as well as a simple project with a login control that makes use of the membership framework. We will make use of this standard template later for testing our configuration.

To see the admin UI, simply select "Project--> ASP.NET Configuration" from within VS and this will launch the following admin site - for free!

This points to a local SQLExpress .mdf so we need to change the configuration slightly to point at our SQL 2008 database.

In the web.config for the site, change the following entries in line with the database that contains your membership schema, for this example it is my local machine "." with a database of ASPNET

Before

< add name ="ApplicationServices "

connectionString=" data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|\aspnetdb.mdf;User Instance=true"

providerName=" System.Data.SqlClient" />

</connectionStrings>

After

< add name ="ApplicationServices "

connectionString=" data source=.;Integrated Security=SSPI;Initial Catalog=ASPNET"

providerName=" System.Data.SqlClient" />

</connectionStrings>

It is worth reviewing the other entries in the web.config to familiarise yourself with the membership and role provider entries.

If you re-launch the admin tool you can now set up your users and roles.

Step 3 - Create the Users and Roles used in this example

Goal: Create some standard users and roles for this sample

For the purpose of this example, I am going to create the following users

jon who is an administrator role

sarah who has a user role

In the Web Site Administration Tool click on the Security tab

Enable Roles and then create the following roles

admin, user

Go back to the security home and create two users

jon (with an admin and user role)
sarah (with a user role)

the password used will be Complex!

To test this set up, add the following code to the page load event of the web project. I have kept this simple as we are not really too interested in authentication and authorisation for standard asp.net web sites, but it is a good place to start.

protected void Page_Load(object sender, EventArgs e)

{

if (User.Identity.IsAuthenticated)

{

if (User.IsInRole("admin" ))

Response.Write( "You have admin rights\n");

if (User.IsInRole("user" ))

Response.Write( "You have standard user rights\n" );

}

else

Response.Write( "You need to log in");

}

By logging in and out of the site using the different usernames you can now see how content can be controlled using authentication (identifying the user) and authorisation (identifying the roles associated with the user).

Step 4: Creating a Silverlight Enabled WCF Service

Goal: Demonstrate how Silverlight and WCF work together

Silverlight and moreover WinPhone7 has a restricted set of WCF capabilities. In order to authenticate the user for a WCF call we have to send the username/password in clear text in the SOAP header. DON'T PANIC. By using https and some simple config all of the heavy lifting is done for us.

1. Add a WCF Service Application project named SimpleService

2. Delete the default Service.svc and IService.cs

3. Add a new item from the Silverlight item templates: Silverlight-enabled WCF Service. Call this Simple.cs

4. Change the Simple.svc code to reflect the following code

namespace SimpleService

{

[ServiceContract(Namespace = "")]

[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode .Allowed)]

public class Simple

{

[ OperationContract]

public bool DoWork()

{

return true ;

}

It is worth reviewing and digesting the generated WCF config before it is modified...

< binding name ="SimpleService.Simple.customBinding0">

< binaryMessageEncoding />

< httpTransport />

</ binding>

A custom binding has been created in order to make Silverlight apps faster, essentially this is standard http with binaryMessageEncoding. The binary encoding will typically make the XML on the wire 30-40% smaller.

At this stage I like to create a unit test. The unit test will simple add a reference to this service to ensure that all is well.

Step 5: Re-configure the service to use https

Goal: Set up https on IIS and WCF

This is not complicated but requires a bit of care.

1. Create a new application on your local IIS instance call SimpleService

2. Open up the Server Certificates and use this to install/import your Verisign issued cert. Note: this must be the cert that contains the PRIVATE key

3. Click on the website instance where this app is created (Default Web Site in my case) and then click on the bindings link. Associated https: on port 443 with the certificate. You may need to add https if it doesn't already exist.

4. Now that we have https enabled, update our Simple service to make use of it. Fortunately this is very easy.

Modify the web.config binding entry on the service to read httpsTransport

Before

< httpTransport />

After

< httpsTransport />

If you have a unit test then update the app.config entry as above and update the address to point at the IIS server (instead of the local project instance).

You will need to publish the service to the IIS server.

Once published, now is a good time to try and browse to the service to make sure that it is still working.

The SSL certificate will be for a public URL, so when browsing to https://localhost/SimpleService/Simple.svc (for example) you will see

To overcome this, add an entry into your hosts file, found in C:\Windows\System32\drivers\etc

127.0.0.1 mywebsite.com

Where mywebsite.com is the URL that the certificate is registered to.

Browsing to https://mywebsite.com/SimpleService/Simple.svc should now take you to your service without complaining

As a checkpoint, use your unit test to call the updated service before continuing.

Step 6: Adding the membership provider to the service

Goal: Use configuration to integrate WCF with the ASPNET membership provider

Rather than walk you through this, the inline comments are probably clearer. Key points to note are the membership provider entry and the corresponding reference to it in service credentials section of the binding.

Update your web.config as follows (essentially replace all of the corresponding sections as below).

< add name ="ApplicationServices "

connectionString=" data source=.;User Id=membershipuser; Password=membershippwd;Initial Catalog=ASPNET"

providerName=" System.Data.SqlClient" />

</connectionStrings>

<system.web>

< compilation debug ="true " targetFramework ="4.0 " />

< membership defaultProvider ="AspNetSqlMembershipProvider " userIsOnlineTimeWindow=" 15">

< providers>

< clear />

< add name ="AspNetSqlMembershipProvider " type=" System.Web.Security.SqlMembershipProvider " connectionStringName=" ApplicationServices"

enablePasswordRetrieval=" false" enablePasswordReset=" true" requiresQuestionAndAnswer=" false" requiresUniqueEmail=" false"

maxInvalidPasswordAttempts=" 5" minRequiredPasswordLength=" 6" minRequiredNonalphanumericCharacters ="0 " passwordAttemptWindow ="10 "

applicationName=" /" />

</ providers>

</ membership>

</system.web>

<system.serviceModel>

< bindings>

< customBinding>

< binding name ="SimpleService.Simple.customBinding0 ">

< security authenticationMode ="UserNameOverTransport ">

< secureConversationBootstrap />

</ security>

< binaryMessageEncoding />

< httpsTransport />

</ binding>

</ customBinding>

</ bindings>

< services>

< service name ="SimpleService.Simple ">

< endpoint address ="" binding=" customBinding" bindingConfiguration=" SimpleService.Simple.customBinding0"

contract=" SimpleService.Simple" />

< endpoint address ="mex " binding ="mexHttpBinding " contract=" IMetadataExchange" />

</ service>

</ services>

< behaviors>

< serviceBehaviors>

< behavior>

< serviceMetadata httpGetEnabled ="true "/>

< serviceDebug includeExceptionDetailInFaults ="true "/>

< serviceCredentials>

< userNameAuthentication userNamePasswordValidationMode ="MembershipProvider " membershipProviderName=" AspNetSqlMembershipProvider"/>

</ serviceCredentials>

</ behavior>

</ serviceBehaviors>

</ behaviors>

< serviceHostingEnvironment aspNetCompatibilityEnabled ="true "

multipleSiteBindingsEnabled=" true" />

</system.serviceModel>

Step 7 - Calling the service.

Update your web reference from the unit test and call the service as follows. Note how credentials are passed in through the proxy. To get the required client config it is probably easier to delete and recreate the web reference. Note how credentials are passed in through the proxy in the calling code.

[ TestMethod]

public void TestMethod1()

{

ServiceReference1. SimpleClient proxy = new ServiceReference1.SimpleClient ();

proxy.ClientCredentials.UserName.UserName = "jon";

proxy.ClientCredentials.UserName.Password = "Complex!";

bool result = proxy.DoWork();

}

You can now add the same to your Windows Phone app, using the asynchronous WCF approach of course. I created a simple ThisMobile.Phone application and called the https/aspnet service as follows.

namespace ThisMobile.Phone

{

public partial class MainPage : PhoneApplicationPage

{

public MainPage()

{

InitializeComponent();

Loaded += new RoutedEventHandler (MainPage_Loaded);

}

void MainPage_Loaded(object sender, RoutedEventArgs e)

{

SimpleProxy. SimpleClient proxy = new SimpleProxy.SimpleClient();

proxy.ClientCredentials.UserName.UserName = "jon";

proxy.ClientCredentials.UserName.Password = "Complex!";

proxy.DoWorkCompleted += new EventHandler<SimpleProxy.DoWorkCompletedEventArgs >(client_DoWorkCompleted);

proxy.DoWorkAsync();

}

void client_DoWorkCompleted(object sender, SimpleProxy.DoWorkCompletedEventArgs e)

{

LoggedInStatus.Text = "Logged id, hurray";

}

Hope this was useful....

Cheers - Jon.

References:

patterns & practices: WCF Security Guidance

http://wcfsecurity.codeplex.com/

Configuring Secure Sockets Layer in IIS 7

http://technet.microsoft.com/en-us/library/cc771438(WS.10).aspx

WCF Services and ASP.NET (Hosting side by side)

http://msdn.microsoft.com/en-us/library/aa702682.aspx

WCF, ASP.NET Membership Provider and Authentication Service

http://stackoverflow.com/questions/56112/wcf-asp-net-membership-provider-and-authentication-service

Configuring an ASP.NET application to use Membership

http://msdn.microsoft.com/en-us/library/6e9y4s5t.aspx

How to: Use the ASP.NET membership provider

http://msdn.microsoft.com/en-us/library/ms731049.aspx

Manging shared cookies in WCF

http://megakemp.wordpress.com/2009/02/06/managing-shared-cookies-in-wcf/

Cannot import wsdl:portType

http://forums.silverlight.net/forums/p/117406/335336.aspx

WCF Binary Bindings in Silverlight 3

http://johnpapa.net/silverlight/wcf-binary-bindings-in-silverlight-3/

Whats new with web services in Silverlight 3 Beta

http://blogs.msdn.com/b/silverlightws/archive/2009/03/20/what-s-new-with-web-services-in-silverlight-3-beta.aspx

Consuming web services in Silverlight 3

http://videos.visitmix.com/MIX09/T42F

(Security piece from 30 mins in)

Fiddler and the Windows Phone 7 Emulator

http://blogs.msdn.com/b/fiddler/archive/2010/10/15/fiddler-and-the-windows-phone-emulator.aspx

Access control and Identity on WP7

http://blogs.msdn.com/b/card/archive/2010/11/06/access-control-for-windows-phone-7-apps.aspx

Lambda, delegate, anonymous & implicit goodness in C#

2010-07-21T16:25:00.001+01:00

Spent last night reading up on some of the finer points of C# in Jon Skeet’s excellent book C# in depth (http://manning.com/skeet/)

I have introduced some of the newly learned syntaxes into my DSL parser. I have included a step by step explanation of some of these syntaxes that may appear alien to a .NET 2.0 developer.

I created an inline delegate function to be used within my tokeniser function to determine if a string character was a double or single quote as follows:-

Func<string,bool> IsQuote = a=>(new [] {"\"","'"}).Contains(a);

...and called within the same function...

if (IsQuote(c)){//do something}

Breaking this down into it’s constituent parts we have

Part 1

Func<string,bool> IsQuote = a=>(new [] {"\"","'"}).Contains(a);

Declare (a pointer to) a function that accepts a string parameter and returns a bool. This uses the Func<T,U> type, the last generic always representing the return type.

Part 2

Func<string,bool> IsQuote = a=>(new [] {"\"","'"}).Contains(a);

Assign the function definition to this function pointer.

“a” is an implicit (string) type as it represents the first parameter in the function so the string declaration can be dropped

“a=>” is shorthand for delegate (string a){...}

A more verbose version might look like this…

Func<string, bool> IsQuoteAlso;

IsQuoteAlso = delegate(string a) { return a == "\"" || a == "'"; };

Part 3

Func<string,bool> IsQuote = a=>(new [] {"\"","'"}).Contains(a);

Create a new array of strings using an implicit declaration (the compiler figures out that this is a new array of strings) and then call the contains method.

The next question is, will these syntaxes become part of everyday development; will a “regular” developer be able to work with these new shortcuts. Time will tell.

Jon.

StringBuilder & Reflection performance myths?

2010-07-08T22:41:00.001+01:00

Following feedback from recent system testing I looked into a performance issue in my .NET based DSL interpreter. The interpreter coverts the travel industry DSL into .NET CLR calls through reflection.

I started by creating a unit test which performed a where clause on the result of a where clause where the target list was 1000 records.

The DSL looked something like this

@result=Itinerary.Notes.Where(Value Contains “Hello”).Where(Value EndsWith “World”)

This chained approach resulted 2000 iterations and took 5 seconds to execute.

I assumed that reflection was the problem so I reran my performance unit test after adding caching to my ExpressionTree. I was surprised to learn that the improvement was negligible (from 5.1 seconds to 5 seconds). The intention was to reduce the number of reflection calls based upon “common wisdom” that reflection is slow.

I then ran the VS2008 Performance Explorer/Wizard over the interpreter and spotted that a derived String.Concat method was using up the majority of working memory at runtime. I fixed this in the heaviest used method which tokenises the script before passing it to the expression parser (replacing a simple activeToken += currentChar style approach with a StringBuilder.Append(currentChar) approach).

There were some interesting results...the following unit test demonstrates how a pre-initialised string builder can introduce a MASSIVE improvement in runtime speed. String concatenation is extremely slow, the string builder extremely fast and the reflection calls (contrary to common wisdom) are in fact really fast.

Results:

00:00:16.2104000
00:00:00
00:00:00.0780000

XAML Editor Missing in VS2008 64bit with Windows 7

2010-01-18T18:33:00.004Z

I'm not sure if this a 64 bit problem, a Windows 7 problem or just a VS2008 SP1 problem but I have been pulling out the little hair that I have left trying to get the intellisense working for XAML files on my new install. At best, I could get the files to be opened up in the XML editor, but the WPF editor was missing.

Fortunately I found this post. There were plenty of partial solutions but strangely two solutions had to be combined

1. Run devenv /setup from the VS command prompt in admin mode
2. Follow this with devenv /resetskippkgs

Job done.

Re-use throughout the .NET stack - from discreet functions to ESB's

2009-08-29T00:33:00.002+01:00

I have had this conversation with myself and my peers hundreds of times. Should we re-use, should we version and branch the code base, should we create small discreet web services. are we following the single responsibility principle of SOLID, why do we have so many web service calls, how do we achieve loose coupling, when do we compromise principles for performance & speed-to-market.

Whenever I enter into a conversation about re-use the discussion often gets heated as a result of the following...

Re-use contradictions

Re-use should be encouraged: why maintain the same logic in multiple places?
Re-use should be discouraged: re-use introduces unnecessary dependencies in your code and discourages refactoring and progress.

Use versioning to ensure that changes to shared code do not introduce breaking changes
Do not version code, write enough unit tests to ensure that changes are not breaking and keep everyone on the latest version.

Re-use should be planned. Effort up front to make code re-usable will save time in the long run.
Re-use should be realised, not planned. Planning re-use wastes valuable resources for something that may never be realised.

Code should be written such that re-use is possible.
Code should be written to meet known requirements.

I don't think that there is one answer. There is no rule of thumb, no silver bullet, but hopefully this will be food for thought. From my recent years working on a major SOA development this is my viewpoint to date:-

Variables/Fields

Arguably the lowest level of granularity in modern times (ignoring the old school guys who enjoy passing bits and bytes through registers) the variable should never be re-used.
On the basis that a function should not be more that 15-20 lines, variables should be used for a single purpose only. No exceptions. Re-using an iteration variable, such as the infamous "for(i..." should not be necessary if the function is short. Re-using variables introduces bugs as a) variables need to be re-initialised which is often missed, and b) it normally means that functions are too long - a sign of fragile code.

Local Function Re-use

With modern refactoring tools such as Refactor from DevExpress, function re-use should be actively encouraged. Twinned with the idea that functions should be less that 20 lines, constant refactoring is necessary to keep the code clean, readable and testable. These small functions mean that re-use becomes possible because the functions perform a single task - a tasks that is often required by other functions within your code. Adding unit tests to your solution to tests both the re-used (or potential re-usable) functions as well as the consumers of these functions ensures that breaking changes are limited. Versioning should not be necessary in order to avoid breaking changes - unit tests replace the cautious versioning approach and re-factoring tools identify the dependencies.

Library function re-use and versioning

By definition, when a library functions is created or realised as a result of a re-factoring exercise, there is known or planned re-use.
There is an expectation that library functions should a) be versioned, and b) be backwardly compatible. The versioning approach allows clients to choose when they move to the latest version yet comes from a nervousness that changes will be breaking. The backwardly compatible expectation contradicts the versioning argument: either the library is backwardly compatible in every respect _or_ a new version is needed because breaking changes have been introduced with the latest changes. Again, unit tests can help here and can avoid the need for versioning and branching of the library code base.

Versioning should only be used to denote additions to the library that are not available in previous versions, NOT as a mechanism to avoid shift responsibility to the client to recognise bugs and breaking changes in the latest version of the library. In stark contradiction to this argument is the common practice of using major version to draw a line between the old and the new world. Major versions may decide to cut ties with the old world and no longer support many of the functions of previous versions, forcing a significant re-write or re-factor for existing clients. This decision is always subjective with a major factor being the size of the client base that is using the existing library.

Web Services

Web services are the building blocks of a SOA. Whilst many argue that web services are not necessary for SOA, I have seen very few SOA implementations that use something other than SOAP web services or REST as the mechanism for achieving a loosely coupled distributed architecture. If SOAP/REST is not used, then some bespoke HTTP/XML combination is typically used. I will focus on SOAP services.

One of the four well known tenets of SOA is "Services share schema and contract, not class". This by definition both encourages re-use yet imposes a restriction on what can and can't change. Clearly the underlying classes that implement the service logic can change independently of the schema and contract without breaking the client (assuming the changes do not upset the behaviour of the service), however, the contract itself becomes something that needs to be set in stone.

The challenge of introducing a re-use tenet to web services is simply that not all web services are created equal.

Data services can be uses to surface a data model as a web service. Re-use is expected and difficult to avoid as the underlying data model is surfaced with little or no abstraction other than a change in the transport mechanism (from ADO to SOAP for example). This makes for an extremely fragile service interface: a change to the data model breaks the web service; fixing the web service interface breaks the web service client(s). Not good. Re-use in unavoidable yet undesirable in this situation. You can easily infer that changes to the schema break the contract - something that should not happen, should it?

A repository pattern exposed as a web service improves the re-use story. The repository pattern uses business objects, or domain objects (or fragments of business/domain objects) as input/output parameters to methods. This approach maps the domain object (exposed by the web service schema) to the underlying database schema allowing the database schema to change independently of the web service schema. This is where an ORM tool can come in handy. This sounds like a good thing and in many ways it is, but there are some gotcha's

1) There is a tendency to fabricate business/domain objects ahead of known requirements by logically dividing the database up into "entity views" over the database schema that "make sense". These views typically contain either too much data or require modification to meet the requirement of the client. The resultant contract is a compromise and prone to change causing problems with existing clients.

2) Large object graphs exposed on the service boundary are a) desirable, as these discourage chatty web service interfaces by reducing the amount of calls necessary for persistence/retrieval operations, yet b) cause the interface to become brittle as changes to any area of the model/graph force a version change of the contract. These large object graphs also encourage re-use by clients that see the contract as containing "most" or "all" of what is needed. This compounds a bad situation - the service is re-used heavily, is transporting unwanted data and is fragile due to the large object graph and also encourages the client request ongoing changes to fulfil the missing 1% that is "just a minor tweak".

The repository pattern, used appropriately, allows for re-use to be realised within the same business domain. Domain objects that are suffixed with Summary/Detail are probably too generic or contain too much information. A fine balance between a non-chatty interface, appropriate re-use and light-weight domain objects is the end goal here.

Business Objects

Many of the arguments for re-using business objects are mirrored in the arguments for how and when to re-use web services - web services essentially replace the DCOM/COM+/Remoting options of old so I will not go into any detail on this.

Business processes and Service Composition

Business processes in contrast to data services perform a specific task. These are seen as one of the higher levels of abstraction, by orchestrating services or aggregating content and logic from other services, business objects and data repositories. It is near impossible to re-use these processes for anything other than a single purpose. Any attempt to re-use business processes should be reviewed - is there enough re-use here? Have I written something to satisfy a business requirement or am I looking to satisfy a habit of trying to make everything re-usable.

Inversion of Control

“Inversion of control” and “dependency injection” are terms used to describe classes that supports a pluggable provider model. The "provider" is a class that implements a specific behaviour as required by the hosting class to deliver "pluggable" logic via a pre-defined interface.

This means that re-use can be looked at in a slightly different way. Rather than introducing fragility via a dependency between the client and the implementing class, stability is achieved through a defined interface and dependent classes are "injected". This removes the requirement to version and re-test the client every time an "injected" class changes.

Business Events and ESBs

Seen as the answer to re-use, scalability, loose coupling and hub-spoke monoliths, business events are arguably the next layer of abstraction on top of the development stack. A business event, such as "customer address changed" is published as a light-weight business oriented event. Systems or services that care about the event will subscribe to this message (via the Enterprise Service Bus) and then re-act to the event accordingly. The order processing system may re-retrieve the updated data from the customer repository to update outstanding orders; the CRM system may update it's mailing list to send the next promotional mail to the updated address.

It will remain to be seen if this (relatively) new paradigm will introduce new considerations around re-use, but it is certainly an exciting development in the Enterprise development space.

Summary

It would be easy to draw conclusion from this that could result in over architecting something that should be a simple piece of code; that additional layers of abstraction reduce the number of touch points ; that abstraction is a requirement for stability; that loose coupling is required to prevent fragile dependency chains; that an event driven architecture is the ultimate in re-use and flexibility. The truth is that the scale of the system will dictate how few or how many of these arguments are applicable to your solution. The one thing that is consistent is that unit testing is necessary to offer and evolve re-usable components with confidence.

ASP.NET MVC: Mini CMS Project - adding the domain and sub domain to the route data

2009-08-08T00:13:00.002+01:00

This is step 1 of many in my plan to build a mini CMS in ASP.NET MVC to support an array of personalised sites hosted on http://cloud9sites.com. My requirement is for a really lightweight CMS that can be achieved by using a finite set of page templates (rather than having to support a page layout designer) and numerous combinations of stylesheets (largely derived from http://ui.jquery.com theme roller) and layouts offered up on the aspnet gallery http://www.asp.net/mvc/gallery

I adapted the following code from http://blogs.securancy.com/post/ASPNET-MVC-Subdomain-Routing.aspx

The implementation is identical (so I won't go into detail), but in short the following class needs to be added to global.asax and the custom DomainRoute needs to be added to the route table.This code is only slightly modified from the original to meet my needs. I simply want to pass the domain and sub domain to the controller so that I can decide at runtime which master page, CSS and scripts needs to be loaded for the request domain (and optionally sub domain).

public class DomainRoute : RouteBase

{

public override RouteData GetRouteData(HttpContextBase httpContext)

{

RouteData returnValue = null;

// Retrieve the url - and split by dots:

var url = httpContext.Request.Headers["HOST"];

// Determine if a subdomain is provided:

var index = url.IndexOf(".");

returnValue =

new RouteData(this, new MvcRouteHandler());

returnValue.Values.Add(

"controller", "Home");

returnValue.Values.Add(

"action", "Index");

string domain = url.Substring(index+1);

returnValue.Values.Add(

"domain", domain);

if (index < 0)

{

returnValue.Values.Add(

"subDomain", null);

}

else

{

string subDomain = url.Substring(0, index);

returnValue.Values.Add(

"subdomain", subDomain); }

return returnValue;

}

/// <summary>

/// Required override. Just return null ;)

/// </summary>

public override VirtualPathData GetVirtualPath(RequestContext requestContext, RouteValueDictionary values)

{

return null;

}

Linux influenced start menu folders

2009-08-05T22:10:00.001+01:00

I recently re-organised the programs folder on my laptop (Windows XP SP3 install) based upon my experience with a Linux distribution (PCLinuxOS). I had 58 seperate software installs (possibly more) so it was becoming painful to find the programs that I needed.

This is a relatively dull topic, but this is something that I wanted to share. 10 minutes worth of effort to make my start menu cleaner and more intuitive.

I won't list everything, but this is a flavour of how my start menu now looks.

Accessories - leave as default

Games - leave as default and move all games here

Communication Tools

Bluetooth
NIC
VPN
Browsers
Mobile devices
Skype
Office Live/Live meeting
MS Shared View
Messenger

Database Tools

ApexSQL
Cache
MySQL
SQL Server
Redgate SQL Bundle

Development Tools

Apache
HTML Help
.NET Framework/Tools
Subversion
Visual Studio
Eclipse
Ruby
Powershell

Media Tools

Picassa
Itunes
Channel 4 OD
Paint.net

Office Tools

Microsoft Office
Open Office

Hope you find this useful.

Cheers - Jon.

From DNN to MVC?

2009-07-23T22:27:00.002+01:00

The cloud9sites development is progressing steadily in my spare time. I have yet to push anything up to the web site as essentially these are the major pieces of the jigsaw that will change the site from an advert to a fully operational eCommerce application.

The 3 major components of this are the skin (or template) selection; the content capture and finally the domain name search. The idea is that a 3 stage wizard will be used to build the site - this is to counter all of the complex web site builders and Content Management Systems
that are targeted at web developers rather than end users.

1. The skin selection is using the ad-gallery Jquery plugin to spin through a selection of skin thumbnails showing the selected thumbnail in a larger window

2. The content entry is using the Jquery tabs as well as the FCKEditor plugin to give the WYSIWYG HTML editing.

3. I have written a web service wrapper for the domain tools API for the domain search feature

4. The last stage of the site wizard is to push the order into google checkout.

I now have a dilema. I have developed the wizard in ASP.NET 3.5 and JQuery with the style and plugins of JQuery UI.
Given that I am going to be offering a standard set of pages (Home, Contact, About) I
am now questioning whether or not a CMS is necessary (specifically Dot Net Nuke). Much of what I have been doing has being working "against the grain" of a CMS.

I will give this some thought, but my current idea is that an MVC/Jquery pairing could give me exactly what I need and more importantly allow me
to scale this by removing much of the overhead/noise that comes along with DNN. DNN is also proving to be slow. I also like the idea of the URL rewriting
in MVC and I plan to introduce some "Convention over Configuration" concepts so that the introduction of a new site can largely be driven by the
domain name (storing the site content in a folder specific to the domain name for example).

DNN Loosing links and building the store

2009-07-09T23:43:00.004+01:00

Another late evening working on http://www.cloud9sites.com

As ever, getting the graphics up is pretty simple. Powerpoint is, beleive it or not, a great tool for creating all of the curved boxes, gradients and 3d buttons that you might ever want.

I have started working on navigation and have had some challenges getting my embedded URL's to save in the DNN Text/HTML editors. I was saving anchors/tags without text between the brackets. The text isn't needed as I am using CSS to replace the anchors with button images. DNN just sees the missing text as invalid and deletes the tag when the Source HTML is saved. The resolution is just to put a non printable character between the tags.

The major part of the site is the wizard and store front used to guide the user through the site building process. The first goal is simply to catch the required data (site template, payment options, site content).

Step 1: Template and Payment Option
I have used the DNN store module and specifically the Category Products selection to filter the product categories shown as part of the wizard. I have created two categories: Themes and Packages to hold the DNN skins and the payment options respectively. The theme images in the store module are taken from the thumbnails that come with the free downloaded skins. Nice and simple. The payment options are text only, so again very simple. The idea is that the user adds a theme and a payment option to the cart. Not slick, but a simple way to get up and running until I find (or develop) something better.

Step 2: Content
This is work in progress. I have just installed the Form Creation DNN Module from http://www.code5systems.com/ and this looks like it will do the job of giving me a form that will capture all of the fields that I need for the site; including uploading images. The main challenge with all of these tools seems to be getting consistency around the look and feel of the lables, titles and action buttons in line with my skin/theme.

Future challenges...

Step 3: Domain Search
I need to find an easy way to plug in a module that will find a domain name and, even better, suggest one based upon the company name.

Step 4: Collecting Payment
Paypal seems to be the lowest friction option, but for the first few sites I won't automatically collect payment, I just want to guage interest.

Cloud 9 Sites

2009-07-08T23:03:00.002+01:00

I've not blogged for 6 months and perhaps it will be another 6 months before I blog again, but I intend to keep a record of my attempts to set up a hobby company on behalf of my wife to bring in some necessary background income.
I was recently introduced to the term "sitcom" by a friend - Single Income Two Children Onerous Mortgage: very appropriate.

The inspiration for this venture was the book the "4 hour work week" by Tim Ferris http://www.fourhourworkweek.com/.

In short I will be creating a web site targeted at the small/medium business. The product will be a tool for automating the creation of an entry level web site for the non technical user. I will use a collection of tools and technologies that I know (and some I don't) and a balance of licensed/open-source software. Cost is a factor, but following the mantra of Tim Ferris I will outsource (or buy in) where appropriate.

My efforts can be followed at http://www.cloud9sites.com

I am already well on my way to getting a site up and running based upon Dot Net Nuke, SQL Server and hosted on GoDaddy Windows Servers with .NET 3.5. The home/landing page is now in place and I am working on the store front aspects in the background.

There are many things that I have yet to solve, but that's what makes it interesting!

Cheers - Jon.

Am I virus free?

2008-12-14T13:42:00.001Z

A few days back, Windows Defender popped up a message to say that a process was attempting to modify my hosts file. I didn't think anything of it for a while as I was running a number of applications that were harmless contenders (such as Mojo CMS, Microsoft Mesh, IIS) and furthermore an anoying URLRedirect service was installed be default on my XP desktop as part of the Dell desktop package which changes your homepage dynamically when a URL is not found.

Initial Virus Scan
As a precaution, I looked up the "SettingsModifier:Win32/PossibleHostsFileHijack" error that was being displayed and followed the advice to perform a full virus scan. I ran a full scan using both Windows Defender AND Semantic (Norton) Antivirus (corporate edition). Both of these gave me a clean bill of health which was encouraging - or so I thought.

Sysinternals

After a reboot and after working in VS for a couple of minutes, I received the hosts file hijack error again. I was now rumbled and determined to find out what was causing this. I allowed the process to modify my hosts file to see what was happening. Microsoft.com was being redirected to 127.0.0.1 localhost. I then went onto sysinternals.com and downloaded both the autoruns application (a tool to determine which processes are launched at startup) and process explorer - an advanced task manager with process tree information and file dependencies.

The first thing that browse all autorun processes. In this list there were 4 libraries and exeutables that were NOT registered to any company. This was suspicious. I searched for the corresponsing entries in google and all of them pointed to a worm or trojan. I found the corresponding executables through the tool and deleted them from my system, some of which were locked hidden system files requiring me to kill the host processes using the sysinternals.

I then peformed the same search using the sysinternals process explorer and found another 5 processes that were not registered to any company. Some of these were desktop extensions that were more than likely harmless (such as Filezilla and Tortoise SVN) but I wasn't going to take any risks. I remove the files and killed the processes.

I then went on a mission to remove any software and files that I was no longer using, simply to allow the virus scanners to run more quickly.

4 hours later and after a subsequent reboot I was still not comfortable. I was receiving a Windows Defender warning from a proces called Kontiki (which is a peer-to-peer media sharing tool). This was likely to be harmless again as it is installed by the media streaming services such as 4OD, but by this stage I was not taking any chances. I have prided myself for having avoided viruses for years, since the disk sharing days of the Commodore Amiga, something had allowed by system to be compromised (perhaps the prevelence of USB keys in the workplace). My firewall is on, my wireless is encrypted and includeds MAC address filters!

I manually removed Kontiki from the startup registry entries (again using sysinternals) and from the program files folder.

Insufficient virus scanners?
I was really concerned that my two virus scanners, both of which were fully up-to-date, had not detected any problems after a full system scan. A collegue had recommened AVG. I downloaded, installed and performed yet another full system scan. AVG found 4 additional Trojans that I had not detected. Fortunately these were not running and were easily quarantined by AVG.

So what is the message? Firstly I am now nervous that I am not clear of viruses based upon the inconsistencies between the virus checking software. Secondly, how on earth is a typical home user supposed to deal with viruses. I am extremely careful, but I will be even more so now. I am still extremely tempted to upgrade my desktop to Vista now that we are moving across to BizTalk 2006 R2 (R1 is not supported on Vista). Hopefully UAC will further mimimise the risks.

Cheers - Jon.

ASP.NET and AJAX unit testing with Watin

2008-12-12T17:40:00.005Z

I stumbled across a great .NET library for unit testing our websites. This was listed alongside a question that I answered about "must-have" .NET libraries on stackoverflow.

The Watin tool (pronounced "What-In") is a .NET library which allows you to issue simple commands for navigting around your web site and more importantly supports the Microsoft AJAX control toolkit (as well as other Ajax implementations).
I used the following code to login to our travel product, navigate to the hotels page and search for a hotels with a town via an ASP.NET autocompleter control.

IE ie = new IE("http://localhost/mytavelproduct");
//login
ie.TextField(Find.ByName("txtUsername")).TypeText("username");
ie.TextField(Find.ByName("txtPassword")).TypeText("password");
ie.Button(Find.ByName("cmdLogin")).Click();

//goto the hotel search pageie.Link(Find.ByUrl("http://localhost/mytavelproduct/Hotel/HotelSearch.aspx")).Click();

//gradually populate the ajax autocompleter field in the town field

TextField field = ie.TextField(Find.ByName("ctl00$cphM$ucHotelLocationSection$txtTown"));
field.TypeText("lo");
Thread.Sleep(1000);

field.TypeText("nd");
Thread.Sleep(1000);

field.TypeText("on");
Thread.Sleep(1000);
//the autocomplete dropdown should have appeared at this stage...

However, in order for the above code to work with the Ajax autocomplete dropdown control, I had to jump through a few hoops.

The first issue is detailed as follows on blogspot http://lazyloading.blogspot.com/2008/06/testing-aspnet-ajax-autocomplete.html

Adding an attribute to the ajax control on page load, performed some "Runtime event reanimation" which allowed the TypeText methods of Watin to be captured by the ajax control.Without this the mocked key presses are ignored.

The second issue was related to javascript that we had on the page. The Watin code appears to loose focus, or blur the control between methods. Unfortunately the onblur event is used by us to clear the text value if nothing has been selected from the ajax autocompleter. By removing this javascript code from the control (with a view to moving it to the page Submit button?) the ajax dropdown is now displayed during the Thread.Sleep periods.

Having completed this and by browsing various blogs for the answer, I also found something that will generated the above code for you!!
http://watintestrecord.sourceforge.net/

This is not perfect (as the ajax stuff requires a bit of hand crafting) but this will take the leg work out of 90% of the coding.

Finally I have found a community out there building frameworks and further examples on how to use Watin.

Populating a masked edit control

Recognising completion of postback events

Working with Ajax and extension methods

The creator of Watin

This has been a long time coming. The Microsoft Web tests have simply not delivered, this is going to make life much easier

Cheers - Jon.

Challenges of installing SQL Server from an ISO image extract.

2008-09-08T10:46:00.016+01:00

I decided to build a portable, laptop version of my office development workstation, simply because I often struggle to get the bandwidth necessary to use remote desktop comfortable when connecting to my work PC.

The corporate policy dictates that all machines need to been Windows XP SP2 or SP3, this rule however is something that does not apply to the development team - as long as the company is not required to support the non standard OS installation.

Anyway, I had recently aquired a high end dual-core, 64-bit Dell XPS with 4 Gb RAM - simply because we have a company policy to have a minimum of 2 of any one model (to help with hardware/software troubleshooting in case of machine failure). I decided to go Vista Ultimate 32 bit after failed attempts to find the necessary NVIDIA display drivers for the 64 bit installation of both Vista and Windows Server 2008.

My role requires me to keep up to speed with the latest technology developments, largely with a Microsoft focus but with an eye on the non Microsoft world. The development machine installation is as follows:-

Microsoft Dev Tools
SQL Server Expresss, 2005, 2008
Visual Studio 2005, 2008 SP1
BizTalk Server 2006 R2
Office Ultimate
Powershell

Non Microsoft Tools
Apex SQL - DAL Generator
My SQL 5.0 + Client tools
Sybase Power Designer 12

I made a call to take an image of the other XPS that a collegue of mine had built, he had already gone down the path of Vista 32. This was the start of my problems.

The machine restore worked fine for all tools except SQL Server 2005/2008. The BizTalk install which I had assumed would cause me grief required a simple "Remove Current Configuration" to get back to a fresh installation.

The first problem was probably the catalyst for all subsequent issues. The local system accounts used for running SQL Server were shown as a GUID representation rather than an account name. From experience, this usually means that the user name that is being referenced does not exist. To this end, I thought it would be cleaner to re-install SQL Server (all versions) given that BizTalk was in an unconfigured state with no active database dependencies.

I ran through a lengthly process of uninstalling all SQL Server related features via the control panel, whilst simulatenously downloading the installation ISO images from MSDN. I removed SQLExpress as part of this process. Once downloaded, I extracted the ISO images to a sub folder on my laptop and launched the setup process, starting with SQL2005 Standard Edition.

With all pre-requisites in place, the installation ran through to near completion, but failed at the final hurdle installing the client tools portion. From this point onwards trial and error and a lot of forum surfing began.

Numerous forums directed me to the installation log files and I began to go through the following in sequence.

1. SQL Server has a problem when iterating through named/default instances. Ensure that that your machine name is in upper case.
This is easier said than done, when attempting to rename your machine in Vista, the uppercase version of the machine is recognised as being the same machine name - so the Apply button is disabled. To achieve this I had to switch from an AD domain to a workgroup domain to change to an upper case version. Even after this however, when returning to the machine settings a mixed case version of the machine name was displayed.

2. When installing from a local file system, the Tools and Servers folders must exist off of the root folder or exist in a folder directly below the root folder (e.g. c:\SQLServer2005\Servers and SQLServer2005\Tools)
http://support.microsoft.com/?kbid=916760
This is not too clear, the 2 ISO images (CD1/CD2) are not named as server and tools. An assumption was made that CD1 was Servers. I copied the files to the structure as described by the KB article and re-attempted the install. Having attempted the install numerous times before, I restricted the options to just to client tools for speed. BINGO! Having succeeded in the client install I continued on to install the server componenents successfully.

I have since read articles that indicate that the clients tools installation can be launched and installed independently from the CD2 image. This makes sense, the installation from CD1 would normally prompt for CD2 when installing from the physical media - the file version obviously isn't too clever.

Anyway, SQL 2005 is now installed - on to the service packs and SQL 2008!

Microsoft Apps vs Google Apps

2008-01-24T20:11:00.000Z

Battle of the applications

I am convinced that the battle of the Internet will continue for many years, and it is clear, to me at least, that at this stage Google are way ahead in the search engine arena. This is almost too obvious to state.

The next battle that is about to begin, is the battle of the online application. I consider myself to be a medium to heavy user of the Internet: banking, email, research, development, weather, maps, directions, holidays, VPN, ...the list goes on. I have learned that as much as I think that I am an individual, I am not alone. Thousands, if not millions are becoming more comfortable with shifting more of their life into the online cloud.

Can office applications be moved online?

Microsoft are now offering a free web site and URL with Office Live Workspace and Office Live Small Business initiatives. I pre-registered for the Beta of Live Workspace today, I will post my findings once I gain access. It is clear that Microsoft are considering Google Apps to be a serious threat to the Microsoft Office suite - the single largest earner for Microsoft.

Google Apps is well established, and I for one am amazed at what can be done with the recent addition of Ajax to the web developer's toolkit. Recent additions to the documents include charts, drag-and-drop, custom backgrounds. The question is, how long will it be before the online office applications are as good as their desktop counter-parts? Are these application really usable or am I just impressed by what has been achieved within the browser?

My brother, who is also in the software development arena, bought me a copy of the the Google story for Christmas. Having read the book, it is now very clear why Google are such a threat to Microsoft. Simply put, they are growing exponentially financed by their unique advertising model (read the book if you are interested). Google's financial security and their attitude towards research and development mean that they are now a massive influence on the direction of the software that we will be using in the future.

Until recently, Google was purely an Internet based offering. I am now using Google desktop for indexing the files and emails on my laptop and desktop PCs. I have Google mobile on my mobile phone and Blackberry to read my online documents. A blue dot tells me where I am in the world on my mobile when I access Google maps by referencing the location of the mobile phone mast that I am connecting to. How long will it be before Google office applications appear on my desktop?

Will Google take the next logical step and release an operating system? Will we need anything other than a browser and a mobile device?

Microsoft BPM and SOA Conference

2007-11-13T15:15:00.001Z

I will be presenting at the Microsoft SOA and Business Process Conference 2007 tomorrow at the Reading TVP Campus.
https://msevents.microsoft.com/cui/EventDetail.aspx?culture=en-GB&eventid=1032356017

18 months worth of development, prototyping and design of an SOA platform on which to build all of the company's travel related products leaves me with plenty of things to discuss. I hope that this will not overrun. I have a 25 minute slot in an hour long presentation to cover, at a high level, how Microsoft technologies have been used to deliver our products. Not easy ;-)

I understand that audio (and possibly video) recordings of this presentation will be published after the conference. I will post a link to these as soon as they are available.

Jon.

What if there was no Microsoft? Building an online company for free.

2007-11-13T12:38:00.000Z

Since my early days as a developer I have maintained that Microsoft have delivered the right balance of usability, availability and functionality as far as the developer toolsets and desktop Office applications are concerned.

Many of my friends and previous work colleagues are from the non-Microsoft camp. Java, Unix (in it's various flavours) and non Microsoft database technologies are all heralded as "better" technologies than Microsoft by these users. Performance, scalability and security tend to be the main areas of contention. Evidence supporting the claims that the Microsoft technology is not as good as the non-Microsoft alternative is often light on the ground - in my experience anyway. I am sure that there are metrics out in the public domain that will prove me wrong, but for every argument that I have heard there is always a counter argument supporting the Microsoft or alternative case.

Anyway, a few months ago I seriously damaged my knee in an off-road motocross Enduro event which left me on the sofa every night for hours balancing a bag peas on my elevated knee in order to reduce the swelling. Rather than watching TV during this time I decided to look into how I could create a virtual company http://www.lifeplugins.com/ in order to excercise everything that I have learned over the past 12 years or so. The reason for creating a company was to have an end deliverable - I beleive that this is the only way to truly understand the advantages and pitfalls of adopting a particular technology.

The pre-requisites for the company are are follows:-

Create a branded web site with a domain name. The web site should do more than just host static content - anyone can do this. The site should include server side processing and a database as a minimum.
Where possible, the only cost in setting up the company should be my time. All software used in creating lifeplugins.com should be freely available and preferably adopt the Open Source Initiative http://www.opensource.org/
Follow the path of least resistence. This is just a reminder to myself to not "sweat the small stuff". This is a hobby project and shouldn't take over my life. If something can't be done simply then perhaps an alternative should be investigated.
Have a purpose. The name lifeplugins isn't a mistake. This site and the associated "plugins" that are developed should assist me in my everyday life.
Use non-Microsoft technologies. This is the only way, I beleive, to get a balanced view of what is out there given that I have used nothing but Microsoft technologies in the past.

This blog will, for the coming months at least, track the progress of the site and I plan to record my thoughts, ideas and findings on this blog as I grow the virtual company.

Jon.