Subbu's Tech blog

ServiceKnownType on WCF

noreply@blogger.com (Subramanya P) — Mon, 7 Feb 2011 04:50:00 -0800

Back after a long time! Work keeps me off from all other work that I “want” to do J

Ok, on this post I would be explaining on a wcf data contract which is not used on any of the methods. Wondering what is special? When you have a data contract and not used for any messages, the client proxy will not create that class at all. That means, either you create that class on your client to use it or find a way to get that method on your proxy class.

I had a situation where I had a method which would accept parameter as Object. And based on another parameter I decide on object which is passed by the client.

Account GetAccount(GetAccountBy by, object value);

So if by parameter is Name, I was expecting name of Account and the Type of account to search. So my Datacontract

[DataContract]

[Serializable]

public class AccountName

{

public AccountName()

{

}

public AccountName (string name, AccountType type)

{

this.Name = name;

this.Type = type;

}

[DataMember]

public string Name { get; set; }

[DataMember]

public AccountType Type { get; set; }

}

When I add GetAccount method on my service and expose to client, the AccountName was never getting reflected on the client proxy. This was because it’s not referred directly on any of the methods and client doesn’t know how to pick that.

To get this class on client, I had to add an attribute

[ServiceKnownType(typeof(AccountName))]

On the service and regenerate the proxy.

You can read about ServiceKnownTypes at http://msdn.microsoft.com/en-us/library/system.servicemodel.serviceknowntypeattribute.aspx

Branching strategy for Team Foundation Server 2010

noreply@blogger.com (Subramanya P) — Mon, 8 Nov 2010 22:55:00 -0800

If you are planning to start with TFS 2010, here are few decks and videos help you on branching

http://intovsts.files.wordpress.com/2010/06/techdays2010_branchingandmergingwithtfs2010.pdf
http://channel9.msdn.com/blogs/liese/techdays-2010--branching--merging-strategies-with-team-foundation-server-2010

How do you monitor your service?

noreply@blogger.com (Subramanya P) — Wed, 3 Nov 2010 03:46:00 -0700

Many times we may not even know how many hits we get on the service or which methods are getting the highest hits. We may have some information on logs that tells us what kind of request came in and what happened to the request but how much time did the request take to process etc. may not be available on log. For an enterprise application it is very critical that we have a monitoring in place.

We can create our own performance categories and create counters that would tell us what’s going on our service and how much time is it taking etc. We will look at how we can adopt performance counters on our wcf service.

if you haven’t used perf monitor, take a look here http://technet.microsoft.com/en-us/library/cc749249.aspx

Lets do a sample wcf service and see how we can include perf counters on it

Create a console app which will create counters that we need to use on our service.

Make sure you have included using System.Diagnostics;

//define perf category

string categoryName = "My Demo Service";

//counter that we going to use

string CounterName = "Get Data calls per sec";

// if exists delete the category Note that you will need to have admin rights to create or delete categories/counters

if (PerformanceCounterCategory.Exists(categoryName))

PerformanceCounterCategory.Delete(categoryName);

//create counters base that we will be using on this category

var counterDataCollection = new CounterCreationDataCollection();

var callspersecCounter = new CounterCreationData()

{

CounterName = CounterName,

CounterHelp = "Get Data calls per sec",

CounterType = PerformanceCounterType.RateOfCountsPerSecond32

};

// you can refer help for detailed explanation on different types

counterDataCollection.Add(callspersecCounter);

//create the Category

PerformanceCounterCategory.Create(categoryName, "My Demo Service", PerformanceCounterCategoryType.SingleInstance, counterDataCollection);

Once you run above code, open perfmon from Administrative tools

When you click on App, below pop up will be opened and now you can identify the new category we just added

Select the counter and click on “OK”

The perf mon will show something like below

Since there is no activity the graph looks blank.

Lets use this counter on our service

Create a service method as below

public string GetData(int value)

{

var counter = new System.Diagnostics.PerformanceCounter("My Demo Service", "Get Data calls per sec", false);

counter.Increment();

return "data " + value.ToString();

}

This method would just increment the counter and return the same text which is passed. Now lets refer this method and call this for couple of time.

for (int i = 0; i < 100; i++)

{

ServiceReference2.Service1Client obj = new ServiceReference2.Service1Client();

string retString = obj.GetData(i);

if (i % 3 == 0)

System.Threading.Thread.Sleep(400);

}

MessageBox.Show("Completed");

I am going to call the same method many times with some delays so that we can identify the patterns on the monitor.

The monitor would show something like this now

This shows how many calls we got on each second. This also helps us to identify if we need to optimize the service or where we need to concentrate on performance related issues.

Intro on Claims Based Authentication

noreply@blogger.com (Subramanya P) — Tue, 19 Oct 2010 03:36:00 -0700

I had a great opportunity to present a future state of authentication that can be adopted on many enterprise applications. Will try to explain some of the authentication related concepts and how that can help on enterprise applications.

If you have read/worked on Windows Identity Foundation or Single Sign on products like PING, you might have heard about claims based authentication. What does that mean? Why is it called claims based? How applications can get anything from this? These are some of common questions that I would try to explain here.

First of all let’s clear on what are some of the key concepts or words that you come across:

Identity - Set of attributes that describe a principal (e.g. an user) such as name,gender, age, email address, driving license number, group membership

If you look at above image, it shows different attributes describes a user/person.

Identity Provider – If you look at real life example and above image, who could be the Identity provider? It will be either any of Government office or any trusted agencies. E.g Passport office

Claims - An attribute about an identity issued by an authority. Will explain in detail why it is called claim.

Relying party - Application that makes authorization decisions based on claims

Token - A token consists of a set of claims about the principal, and signed by an authority

So why are we calling attributes as claims not as attributes itself? Let’s look at a scenario below.

If you look at above image, I can have identities on multiple identity providers. And the attributes could be completely different between them. As you can see on the image, age on govt records is 32 while on facebook is 18. As a relying party, if I have to decide based on these attributes, it’s just the Trust depends on scenario not on technical capability

So when I say, user has associated attributes from the identity provider, he is claiming that those are the attributes associated to him and valid. Its upto relying party to decide whether to trust the claims or not.

When the relying party requests the Identity provider to authenticate the user, it authenticates and provides all the user attributes as claims. The token will consist of all the claims that belong to the user. The Security Token Service would be responsible to authenticate the user and provide all the claims as a token.

Most of the authentication concepts on federated authentication, SAML, openID, Oauth are all based on claims. I will try to explain each of them in coming days and how they are different from each other.

Are you storing “strong” passwords real strong?

noreply@blogger.com (Subramanya P) — Tue, 28 Sep 2010 05:42:00 -0700

Confused with the above line? Well, have seen many applications which ask users to enter strong password which includes special character and numeric or combination etc. But while storing the password most of the time we convert the password text to hash which is known to be a secure way to store. This approach may be secure in last centuries not any more. Check out http://en.wikipedia.org/wiki/Rainbow_table the mapping function from hash strings to any possible combinations of keyboard characters (alphanumeric, punctuations, etc.) have rendered this password storage / validation method insecure

Check this post http://www.codinghorror.com/blog/2007/09/rainbow-hash-cracking.html it says “The multi-platform password cracker Ophcrack is incredibly fast. How fast? It can crack the password "Fgpyyih804423" in 160 seconds”

How do we strengthen storing password?

Simply provide a random salt while hashing password. Also iterate through many loops which requires extra computing burden to match the password. Normally keep the iteration count to 1000.

Here is how we can achieve that in C#

using (Rfc2898DeriveBytes derivedBytes = new Rfc2898DeriveBytes(input, salt, hashIterations))

{

byte[] hash = derivedBytes.GetBytes(desiredHashBitSize / 8);

return hash;

}

Check http://msdn.microsoft.com/en-us/library/system.security.cryptography.rfc2898derivebytes.aspx for details on Rfc2898DeriveBytes

Bitwise computation with C#

noreply@blogger.com (Subramanya P) — Fri, 24 Sep 2010 01:54:00 -0700

If you have written programs in C or C++ , I'm sure you might have used bitwise operators very often. We can use the same thing even in C#. I'm not going to explain the bitwise operators but would take an example of “&” operator and see how it can be used in our programs effectively.

For details on & operator you can check http://msdn.microsoft.com/en-us/library/sbf85k1c.aspx

Let us take an example of logging class where we would need to log based on the configuration. The easiest method to keep the configuration is to specify the highest level of logging required. i.e if we are planning to log exceptions, warnings, Info, Detailed messages then if we specify Detailed messages on the config that indicates all the categories below this level should be considered for logging. If we decide not to log detailed messages and we are okay with info level, then it should log except Detailed messages. How do we do this? We can approach different solutions but easiest one in terms of program maintenance and configuration is to keep the highest level of logging required on configuration and write the program accordingly. Let us see how we can do this with our C# code.

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

namespace Diagnostics

{

public enum LogCategory { None = 0,Exception = 1,Error = 3,Warning = 7,Info = 15 }

class Log

{

static Log()

{

Log.LogLevel = 7; // read from configuration

}

public static LogCategory LogLevel { get; set; }

public static void Info(string message)

{

if ((Log.LogLevel & LogCategory.Info) == LogCategory.Info)

Write(LogCategory.Info, message, null);

}

public static void Info(string message, params object[] parameters)

{

if((Log.LogLevel & LogCategory.Info) == LogCategory.Info)

Write(LogCategory.Info, message, parameters);

}

public static void Warning(string message)

{

if ((Log.LogLevel & LogCategory.Warning) == LogCategory.Warning)

Write(LogCategory.Warning, message, null);

}

public static void Warning(string message, params object[] parameters)

{

if ((Log.LogLevel & LogCategory.Warning) == LogCategory.Warning)

Write(LogCategory.Warning, message, parameters);

}

public static void Error(string message)

{

if ((Log.LogLevel & LogCategory.Error) == LogCategory.Error)

Write(LogCategory.Error, message, null);

}

public static void Error(string message, params object[] parameters)

{

if((Log.LogLevel & LogCategory.Error) == LogCategory.Error)

Write(LogCategory.Error, message, parameters);

}

public static void Exception(Exception err)

{

if ((Log.LogLevel & LogCategory.Exception) == LogCategory.Exception)

{

string errMessage = err.Message;

Write(LogCategory.Exception, errMessage, null);

}

public static void Exception(Exception err, params object[] parameters)

{

if ((Log.LogLevel & LogCategory.Exception) == LogCategory.Exception)

{

string errMessage = err.Message;

Write(LogCategory.Exception, errMessage, parameters);

}

private static void Write(LogCategory ctgy, string message, params object[] parameters)

{

// write to text or DB

}

If you look at above class, the log category is defined as 0, 1, 3, 7, 15 … this is actually the bit representation to identify if we need to consider category level. The bit representation of these numbers as below

0 – 0000 0000

1 – 0000 0001

3 – 0000 0011

7 – 0000 0111

15 – 0000 1111

So if we need to add another level it would be 31 which will represent as

31 – 0001 1111

Hope this will explain why we have these numbers on the enum. Now, let’s look at other methods which are written for logging the messages. All the methods use “&” to check if the message needs to be logged.

If the configuration specifies that we need to log only till warning, and when we try to log info this is what happens

Config = 7

Log.LogLevel & LogCategory.Info

0000 0111 - 7

0000 1111 - 15

0000 0111 – result – that means the Info is not configured here

What happens for Exception when the Log level is set as Warning

Log.LogLevel & LogCategory.Exception) == LogCategory.Exception

0000 0111 - 7

0000 0001 – 1

0000 0001 – result – the exception is matching and its allowed.

I had never used this before and very much interested when I was discussing with one of our developer. Really want to thank him for showing me this amazing piece.

Problem opening CHM file?

noreply@blogger.com (Subramanya P) — Thu, 9 Sep 2010 07:27:00 -0700

I had this problem many times whenever I download chm file from internet. Most of the time when I download the file and open it, it says "Navigation to the webpage was canceled" and for a moment I get annoyed thinking how to fix it. The fix is to go to property of the file and unblock the file.

Limit Sql data access from Applications using "EXECUTE AS"

noreply@blogger.com (Subramanya P) — Mon, 30 Aug 2010 12:58:00 -0700

When you have to retrieve SQl data from the applications, you would create login and connect using that to the sql server. Any user, who has the permissions to execute the stored procedure, runs the stored procedure under the Database's dbo user (which means it can do anything in the database, but nothing at the server-level nor on other databases). If you only allow your Logins to execute stored procedures (and not touch the tables directly), then you've effectively limited the Logins to code you've written. If you don't write any DELETE statements, then Logins can't delete anything.

With Sql 2005 and above, there is a new feature EXECUTE AS OWNER which is a great way to limit the permissions of a sql server login. Lets look at how this can be used effectively to limit the access.

This feature allows you to impersonate another user in order to validate the necessary permissions that are required to execute the code without having to grant all of the necessary rights to all the underlying objects and commands.

The EXECUTE AS clause can be added to stored procedures, functions, DML triggers, DDL triggers, queues as well as a standalone clause to change the user’s context.

Syntax:

CREATE PROCEDURE.[proc_GetAliasByID]

@ID bigint = 0

WITH EXECUTE AS 'AppDMLUser'

More details: http://technet.microsoft.com/en-us/library/ms188354.aspx

SQL Change Tracking Vs CDC

noreply@blogger.com (Subramanya P) — Thu, 26 Aug 2010 13:48:00 -0700

I had posted about SQL change tracking couple of weeks ago. There is one more option available on SQL for capturing the data and can be used for auditing. That is called as CDC – Change Data Capture

Here is the comparison on these two features

Change Tracking (CT)

Change Tracking is a synchronous mechanism which modifies change tracking tables as part of ongoing transactions to indicate when a row has been changed. It does not record past or intermediate versions of the data itself, only that a change has occurred

Change Data Capture (CDC)

Change Data Capture is asynchronous and uses the transaction log in a manner similar to replication. Past values of data are maintained and are made available in change tables by a capture process, managed by the SQL Agent, which regularly scans the T-Log. As with replication, this can prevent re-use of parts of the log. This Tracks when data has changed and includes the values as well. Entire table or subset of columns can be captured.

Universal Data Link (UDL) files

noreply@blogger.com (Subramanya P) — Tue, 17 Aug 2010 09:37:00 -0700

If you have worked with VB or ADODB objects, I am sure you will have used this earlier. Even though we have many ways to keep the connection strings in configuration I still use UDL many times even now. Keeping connectionstring on configuration is a common requirement but to get that string we can use UDL that keeps it simple to get the connectionstring right away from the notepad without worrying about format etc.

Here is how I normally do to get the connection string or to test the connection.
· Open a note pad
· Save it as “x.udl”
· Close the notepad
· Now open the UDL file
· Configure your connection and save it
· Open the UDL file in note pad again. Now you get the connectionstring

Simple way to check the connection to servers and helps to debug the connection issues

TFS 2010 for agile scrum development

noreply@blogger.com (Subramanya P) — Sun, 15 Aug 2010 22:27:00 -0700

We have started using TFS 2010 for our scrum :-) . I found TFS 2010 has lot of features to work with scrum agile methodology. It has capabilities to create user stories, product backlogs, and sprints etc. This can also be used for daily scrum updates.

The TFS team portal provides access to users to update the tasks and many reporting capabilities.

Here is one of the nice ppt I found Scrum with TFS 2010 which has detailed explanation how we can make use of TFS for scrum methodology. http://www.slideshare.net/aaronbjork/scrum-with-tfs-2010

Happy reading!! :-)

SQL - Change tracking

noreply@blogger.com (Subramanya P) — Wed, 28 Jul 2010 23:25:00 -0700

Most of the applications which I worked till now, had one or the other requirement to handle auditing feature to track the changes on data. There are different ways to achieve this. Very often we use triggers to update another table whenever there is a change on primary table. Or handle it on the stored proc which is used for inserting or updating data.

Now, with Sql 2008, this made very easy. The new feature introduced on SQL 2008 “Change tracking” which enables change tracking without any coding required.

First, to enable this change tracking, we need to update the setting on DB

After that we need to enable this on the table whichever needs to be tracked.

Once the table is enabled with tracking, you will be able to track the changes by version.

We can get all the changes by using function called CHANGETABLE. sample use of function will look like below.

SELECT * FROM CHANGETABLE

(CHANGES dbo.Employees,0) as CT

This query will provide details with SYS_CHANGE_VERSION, SYS_CHANGE_OPERATION, SYS_CHANGE_COLUMNS, SYS_CHANGE_CONTEXT, ID columns.

Take a look at this article http://www.sql-server-performance.com/articles/audit/change_tracking_2008_p1.aspx which talk about this article in detail.

TDE (Transparent Data Encryption) on Sql 2008

noreply@blogger.com (Subramanya P) — Thu, 22 Jul 2010 01:43:00 -0700

Most of the Db design, we consider about security on data level. What are the critical data, if need to save them encrypted or hashed etc. There are somethings which might need more attention than just storing the data. What if the backup taken been stolen by someone? If someone gets mdf file, they can easily restore the data on to any server and get access to the data.

One of the new feuture introduced with Sql 2008 deals with this security. This is called transparent data encryption. This stores the mdf and ldf files encrypted. Data is encrypted while writing to disk and decrypted while read form the disk. The "transparent" aspect of TDE is that the encryption is performed by the database engine and SQL Server clients are completely unaware of it

Here is more details on how we can use that on our DBs http://msdn.microsoft.com/en-us/library/bb934049.aspx

WCF Exceptions and faults

noreply@blogger.com (Subramanya P) — Mon, 19 Jul 2010 03:03:00 -0700

The exception handling is an integral part of any application. It depends on the situations and the severity of the exception that defines what we want to do with the exception. When working on webservices, especially while interacting with third party application, I always thought its better idea to catch any exception in method and return that as string. But this doesn’t really work if we have to return some other datatype and also we need to insist client apps to check for Error string to get the error message. There are chances that client apps don’t care about the Error string that was returned by service. So the exception thrown on service will still be treated as valid process on the client apps.

When I started working with WCF, I could find different ways to handle the exceptions.

• Catch the exception on service and return as string. (I have already explained what the part of using this way)

• Throw the exception directly. But how does this effect on client apps

• And convert the exceptions to Faults which client apps can understand.

Let’s see if throwing exceptions on service really help us

If there is any exception on wcf service, the client app will always receive a fault exception as “The server was unable to process the request due to an internal error. For more information about the error, either turn on IncludeExceptionDetailInFaults (either from ServiceBehaviorAttribute or from the <serviceDebug> configuration behavior) on the server in order to send the exception information back to the client, or turn on tracing as per the Microsoft .NET Framework 3.0 SDK documentation and inspect the server trace logs.” This does not provide any information about the exception. If we enable the detail on server , it will expose implementation details to the client.

As a summary exposing exceptions to client has many limitations, so it’s always a better idea to map the exceptions on the wcf service to faults and let the client apps to deal with it.

Method overloading in WCF service

noreply@blogger.com (Subramanya P) — Fri, 16 Jul 2010 03:42:00 -0700

Consider a scenario where we need to expose the service method GetAccount. The method can accept accountid in some cases or username or some other reference. One way to create this on wcf is to create different methods as GetAccountbyID, GetAccountByName etc. But creating overloading methods provides better way of handling it.

When we were using webservice, the only way to specify the alias name in webmethod attribute but the client app has to refer the service with alias name. So this doesn’t really qualify as overloaded method on client side but it’s an overloading method on the server side.

Sample overloaded method on webservice

[WebMethod(MessageName="GetAccountByID")]
public string GetAccount(int accountID)
{
//return account data
}

[WebMethod(MessageName="GetAccountByName")]
public string GetAccount (string userName)
{
//return account data
}

Now let’s see how we can do this with WCF service methods. Let’s consider the approach of webservice here. The WCF service would look like

My service interface would look like below

[OperationContract(Name = "GetAccountByID")]
string GetAccount(int value);

[OperationContract(Name = "GetAccountByName")]
string GetAccount(string userName);

and the service class will follow as

public string GetAccount(int value)
{
return string.Format("You entered: {0}", value);
}

public string GetAccount(string username)
{
return string.Format("You entered: {0}", username);
}

Lets refer this service on client side and see how we can consume it

As you can see, it is split as different methods on client side. So one thing clear here is that the method which is referred on the client side is referring to the name attribute defined on operationcontract.

GDI memory leak in Windows applications

noreply@blogger.com (Subramanya P) — Wed, 14 Jul 2010 23:37:00 -0700

I have had many bitter experiences with memrory leaks on winwos applications. Had spent many day and nights figuring out the actual issues. This can occur due to many reasons. Most of the time came to conclusion that it was either Bitmap objcts or any COM objects.

Found a very interesting article which explains one of the approaches to handle this error http://megakemp.wordpress.com/2009/02/25/gdi-memory-leak-in-windows-forms/

Uniqueidentifier (GUID) on SQL

noreply@blogger.com (Subramanya P) — Fri, 2 Jul 2010 07:41:00 -0700

Uniqueidentifiers are alternate way to have them as primary keys. Till recent past, I always used to recommend Identity column on our SQL designs . So I was curious to find out what are the advantages and limitations of using uniqueidentifiers than using identity.

Only advantage I could find by using uniqueidentifier is that the number which is generated is unique throughout the world. Another advantage is that you don’t have rely on SQL to create this uniqueidentifier, we could even generate using out C# code and insert to sql tables. The value which is generated by C# and SQL will be unique anyways.

Is uniqueidentifier suitable for primary key?

The uniqueidentifier can be used as primary key but we need to consider some of the conditions.

• The primary key will have clustered index by default which doesn’t work very well for uniqueidentifier. The uniqueueidentfier doesn’t create the ids in sequential order unless we use newsequentialid() (which is available from sql 2005 onwards). When we create clustered index, the records will be physically sorted. This means that, if you put a clustered index on a column that does not sequentially grow, SQL Server will have some work making sure that the records are correctly ordered physically when you insert new records.

• Some of the applications expect the identifier of last inserted record. E.g if we are using identity column, we can get the last inserted value using scope_identity or @@identity. We will not be able to get the uniqueidentifier value unless using a query to get the latest record.

Above considerations are also kinds of limitations for some of the DB designs. Another important note here is that the uniqueueidentifier column stores 16 byte so it bigger than int.

But if you consider replicating the database and having identity column in your tables, it would create lot of issues. So I would say uniqueidentifier really helpful on the DB’s which requires replications.

Hierarchyid data type on Sql 2008

noreply@blogger.com (Subramanya P) — Thu, 17 Jun 2010 01:55:00 -0700

The new data type introduced on SQL 2008 Hierarchy ID is very useful when working with tree based structures. Check out this link http://blogs.msdn.com/b/manisblog/archive/2007/08/17/sql-server-2008-hierarchyid.aspx

OpenID integration to website

noreply@blogger.com (Subramanya P) — Mon, 14 Jun 2010 23:44:00 -0700

I started using my openid for different websites a while ago. Recently, I was curious to check how that can be integrated with any of the websites. In this post I will just put some of the points which would give a basic understanding of what is openID is all about.

Introduction:

As a common internet user, many times we walk away form the website just because we have to register. Registering in all the sites and remembreing login info is major tasks especially who already have many accounts. Another problem is that we many not be able to use unique username and password in all the websites and it may not be a good idea as well. When we share our password with some website how do we trust the party that our password is secure and noone can misuse it? these are all the problems can be avoided when we use openId.

What is OpenID?

OpenID is an open, decentralized standard for authenticating users

Allows users to log on to different services with the same digital identity where these services trust the authentication body.

OpenID replaces the common log on process that uses a login-name and a password, by allowing a user to log in once and gain access to the resources of multiple software systems.

You may choose to associate information with your OpenID that can be shared with the websites you visit, such as a name or email address.

With OpenID, your password is only given to your identity provider, and that provider then confirms your identity to the websites you visit.

Other than your provider, no website ever sees your password, so you don’t need to worry about an unscrupulous or insecure website compromising your identity.

OpenID is rapidly gaining adoption on the web, with over one billion OpenID enabled user accounts and over 50,000 websites accepting OpenID for logins. Several large organizations either issue or accept OpenIDs, including Google, Yahoo!, Microsoft, AOL and many more

OpenID protocol overview:

The end user initiates authentication (Initiation) by presenting a User-Supplied Identifier to the Relying Party via their User-Agent.

After normalizing (Normalization) the User-Supplied Identifier, the Relying Party performs discovery (Discovery) on it and establishes the OP Endpoint URL that the end user uses for authentication

The Relying Party and the OP establish an association (Establishing Associations) -- a shared secret established using Diffie-Hellman Key .The OP uses an association to sign subsequent messages and the Relying Party to verify those messages; this removes the need for subsequent direct requests to verify the signature after each authentication request/response.

The Relying Party redirects the end user's User-Agent to the OP with an OpenID Authentication request (Requesting Authentication).

The OP establishes whether the end user is authorized to perform OpenID Authentication and wishes to do so.

The OP redirects the end user's User-Agent back to the Relying Party with either an assertion that authentication is approved (Positive Assertions) or a message that authentication failed (Negative Assertions).

The Relying Party verifies (Verifying Assertions) the information received from the OP including checking the Return URL, verifying the discovered information, checking the nonce, and verifying the signature by using either the shared key established during the association or by sending a direct request to the OP

Advantages:

Users can use single identity among different trusted sites

Provides a single sign on, in particularly for people who are having many accounts

The openId server provides basic info about the user, saving the need to write down the usual basic info every time (depends on user’s settings with their providers)

Moves trust of honesty from multiple parties to only one

Minimize in re-registration and forgot password situations

For the user who keep the same password among all the sites, they don’t need to share password with many people. They can choose their trusted provider and use their identity.

Disadvantages:

We still have to provide normal registration for those who are not willing to go with openID

If the people register in our site is more than the size of people who use openID, this idea would just go away

The OpenID provider can track user’s habits as they receive all auth requests.

I have created a sample application to try this and it works fine even when I run an application with localhost. I have tried with Google, Yahoo and myopenid accounts. Will post my sample application and also compare openID with SAML in coming posts.

System.Web.AspNetHostingPermission on IIS7 Win 7

noreply@blogger.com (Subramanya P) — Wed, 9 Jun 2010 05:13:00 -0700

I had downloaded one of the open source and trying out something. When I started application, it was throwing a security error. Request for the permission of type 'System.Web.AspNetHostingPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

I checked folder permission and allowed fulltrust permission etc. Even then I was keep getting the same error. After a while found that IIS application pool “Load User Profile” was set to false. After setting that value to true, the problem got fixed.

Details on "load user profile" can be found at http://msdn.microsoft.com/en-us/library/bb762281(VS.85).aspx

Modify your XML document using SQL

noreply@blogger.com (Subramanya P) — Wed, 2 Jun 2010 05:23:00 -0700

Many of the situations, we will have to modify the xml that is passed on to the sql server.

Some of the common operations you might need to handle in SQL are

adding an element
adding an attribute
updating an attribute
delete an element
delete an attribute

Let us try this with a sample document.

Declare @myXML xml

SELECT @myXML = '<CUSTOMERSDATA>
<CUSTOMER FName="Raja" LName="Rao" City="Bangalore" State="KA" />
</CUSTOMERSDATA>'

Add an Element

SET @myXML.modify('insert <CUSTOMER FName="Ravi" LName="Krishna" City="Chicago" State="IL" />
into (/CUSTOMERSDATA)[1]') ;

select @myXML

Output:

<CUSTOMERSDATA>
<CUSTOMER FName="Raja" LName="Rao" City="Bangalore" State="KA" />
<CUSTOMER FName="Ravi" LName="Krishna" City="Chicago" State="IL" />
</CUSTOMERSDATA>

Add an attribute

SET @myXML.modify('insert attribute Phone {"333-333-3333" }
into (/CUSTOMERSDATA/CUSTOMER[@FName="Ravi"])[1]') ;

select @myXML

Output:
<CUSTOMERSDATA>
<CUSTOMER FName="Raja" LName="Rao" City="Bangalore" State="KA" />
<CUSTOMER FName="Ravi" Phone="333-333-3333" LName="Krishna" City="Chicago" State="IL" />
</CUSTOMERSDATA>

Updating an attribue

SET @myXML.modify('replace value of (/CUSTOMERSDATA/CUSTOMER[@FName="Ravi"]/@Phone)[1] with "444-444-4444"') ;

select @myXML

Output:<CUSTOMERSDATA>
<CUSTOMER FName="Raja" LName="Rao" City="Bangalore" State="KA" />
<CUSTOMER FName="Ravi" Phone="444-444-4444" LName="Krishna" City="Chicago" State="IL" />
</CUSTOMERSDATA>

Delete attribue

SET @myXML.modify('delete (/CUSTOMERSDATA/CUSTOMER[@FName="Ravi"]/@Phone)[1]') ;

select @myXML

Output:
<CUSTOMERSDATA>
<CUSTOMER FName="Raja" LName="Rao" City="Bangalore" State="KA" />
<CUSTOMER FName="Ravi" LName="Krishna" City="Chicago" State="IL" />
</CUSTOMERSDATA>

Delete Element

SET @myXML.modify('delete (/CUSTOMERSDATA/CUSTOMER[@FName="Ravi"])[1]') ;

select @myXML

Output:

<CUSTOMERSDATA>
<CUSTOMER FName="Raja" LName="Rao" City="Bangalore" State="KA" />
</CUSTOMERSDATA>

Insert into a table from dynamic sql

noreply@blogger.com (Subramanya P) — Wed, 12 May 2010 03:44:00 -0700

I have had many situations to put the dynamic sql data to a temp table but first thought was to pass the temp table as parameter or create temp table on dynamic sql itself. But none of these methods would work on SQL. When we create a temp table on dynamic sql, it will not be available outside of dynamic sql scope.

Try this out

DECLARE @tablename VARCHAR(10)
SET @tablename = 'tk'
DECLARE @strQuery NVARCHAR(1000)

SET @strQuery = 'select name from sys.tables where name like ''' + @tablename + '%'''
DECLARE @tablenames TABLE (tblname VARCHAR(100))

INSERT INTO @tablenames
EXEC
sp_executesql @strQuery

SELECT * FROM @tablenames

Easy method to dump all your data from dynamic sql!

What is wrong with WCF HTTP Activation?

noreply@blogger.com (Subramanya P) — Tue, 11 May 2010 07:41:00 -0700

Could not load type ‘System.ServiceModel.Activation.HttpModule’ from assembly ‘System.ServiceModel, Version 3.0.0.0, Culture=neutral….

This error started occurring all of a sudden. I was using IIS 7 and .net 4.0. The page was working fine and it broke when I checked it next day. What is wrong with my asp.net pages? Well, it’s not problem with asp.net pages or IIS. It looks like a problem when you install WCF HTTP activation module after you install .net 4.0. I installed WCF HTTP activation module to try something else which caused this problem. Take a look at http://msdn.microsoft.com/en-us/library/aa751852.aspx

Fix: Run aspnet_regiis.exe -i –enable on VS 2010 command prompt.

Forms authentication integrated with IIS7

noreply@blogger.com (Subramanya P) — Fri, 7 May 2010 09:30:00 -0700

If you have worked on ASP.net application, you would have definitely used forms authentication in your applications. The new IIS7 brings a new feature which integrates forms authentication with IIS. On IIS 6 you could see authentication options of anonymous, Basic, Digest and Windows. On IIS7 you could also find Forms authentication when you have ASP.Net components installed. Let us look at how to make use of this for our application.

Forms Authentication and Membership providers:

In a brief, forms authentication and membership providers are integrated from the .net 2.0 version. When you set up your application to use membership provider, it take care of all membership related functionalities also the member validations.

I will set up a sample app to use the forms authentication with IIS7 integrated pipeline and see how we can take advantage of this feature.

Lets create a Web Project.

Create 3 pages: About.aspx, Login.aspx, Default.aspx
Set up the application to use sql Membership provider. The detailed explanation on how to set up sql membership provider is available on http://msdn.microsoft.com/en-us/library/ff649314.aspx

On Our login page, lets add a login control

<div>
<asp:LoginView ID="LoginView" runat="server">
<AnonymousTemplate>
<asp:Login ID="Login" runat="server" DestinationPageURL="About.aspx"
onloggedin="Login_LoggedIn" />
</AnonymousTemplate>
<LoggedInTemplate>
<asp:LoginName ID="LoginName" runat="server" />
<asp:LoginStatus ID="Logout" runat="server" />
<asp:ChangePassword ID="ChangePwd" runat="server" />
</LoggedInTemplate>
</asp:LoginView>
</div>

When you login using login.aspx, the login control internally invoke sql membership provider ValidateUser method and set the authentication cookie. These are all done by ASP.NET and you don’t have to do anything from your code. If you need any custoim logic to be appended on login process, then you need to inherit MemberShip class and build your own custom Membership provider. For now let us just use the sql DB provider.

OK. We are all set with the application side to use the forms authentication. With IIS 6, we had to use Anonymous access, so that any user can hit the page and ASP.Net would validate the cookie and authenticate the users. With IIS7 this part is moved over to IIS itself. Here is how we can do it.

Go to IIS manager

Select Authentication

Here keep forms authentication as enabled and disable rest of the authentication methods. Now if you try to browse any of your pages, you will get below error

So even if you have configured login.aspx as your login page, the IIS doesn’t allow you to go to login.aspx since IIS cannot find authentication token for any request and anonymous access is restricted.

Let us allow login.aspx for anonymous access. Go to content view, select login.aspx . Right click and Select Switch to feature view and allow anonymous access

Now browse the site, you will be redirected to login.aspx if you have not logged in to the site. If you have logged in, the site will allow you to browse other pages.

Another factor you need to remember to get this working is that you need to select integrated mode on application pool for the web site which is configured.

There is couple of disadvantages when we plan to deploy it on different server and use the application on load balancer. The authentication ticket which is created by Asp.net and used by IIS to determine the authentication of user is actually encrypted using machine key. So if the request is sent to different server, the token will not be valid. The only way to get that working on different server is to keep the machinekey same.

Comparison XPathDocument, XmlReader, XLINQ, XmlDocument

noreply@blogger.com (Subramanya P) — Thu, 6 May 2010 07:23:00 -0700

From the days of .net 1.0 many of us use XmlDocument for parsing and writing xml in our .Net code. If you ask anyone who started with .Net 3.0 or above, they might say Xlinq is the best method to work with XML. Well, when we conclude on the method that we are going to use in our applications, we also need to see how it will impact on our application or if there is any better method to use.

Let us consider an XMl which I need to just parse and get the data out of it. If I am using .Net 3.5 or 4.0, first thought that comes to mind is that use Xlinq. I did a small test just to check which method would be better to read the xml and parse through the value and the result was really surprising.

Here is my Test program

class Program

{

static void Main(string[] args)

{

Stopwatch sw = new Stopwatch();

string xmlinput = "<Customer><Item desc=\"item1 desc\" id=\"1\" /><Item desc=\"item2 desc\" id=\"2\" /><Item desc=\"item3 desc\" id=\"3\" /><Item desc=\"item4 desc\" id=\"4\" /><Item desc=\"item5 desc\" id=\"5\" /><Item desc=\"item1 desc\" id=\"1\" /><Item desc=\"item2 desc\" id=\"2\" /><Item desc=\"item3 desc\" id=\"3\" /><Item desc=\"item4 desc\" id=\"4\" /><Item desc=\"item5 desc\" id=\"5\" /><Item desc=\"item1 desc\" id=\"1\" /><Item desc=\"item2 desc\" id=\"2\" /><Item desc=\"item3 desc\" id=\"3\" /><Item desc=\"item4 desc\" id=\"4\" /><Item desc=\"item5 desc\" id=\"5\" /><Item desc=\"item1 desc\" id=\"1\" /><Item desc=\"item2 desc\" id=\"2\" /><Item desc=\"item3 desc\" id=\"3\" /><Item desc=\"item4 desc\" id=\"4\" /><Item desc=\"item5 desc\" id=\"5\" /></Customer>";

XmlReader objReader = System.Xml.XmlReader.Create(new System.IO.StringReader(xmlinput));

sw.Start();
for (int i = 0; i < 1000; i++)
{
Program.NavigateXPathNavigate(objReader);
}
sw.Stop();
Console.WriteLine("XPATH ----- " + sw.ElapsedTicks.ToString());
Console.WriteLine(" ");
sw.Reset();
sw.Start();
for (int i = 0; i < 1000; i++)
{
Program.NavigateXmlDocument(xmlinput);
}
sw.Stop();
Console.WriteLine("XMLDOC ------ " + sw.ElapsedTicks.ToString());
Console.WriteLine(" ");
sw.Reset();
sw.Start();
for (int i = 0; i < 1000; i++)
{
Program.NavigateXmlReader(xmlinput);
}
sw.Stop();
Console.WriteLine("XML Reader ------ " + sw.ElapsedTicks.ToString());
Console.WriteLine(" ");
sw.Reset();
sw.Start();
for (int i = 0; i < 1000; i++)
{
Program.NavigateXlinq(xmlinput);
}
sw.Stop();
Console.WriteLine("XLINQ ------ " + sw.ElapsedTicks.ToString());
Console.WriteLine(" ");
Console.ReadKey();
}

private static void NavigateXPathNavigate(XmlReader xmlinput)
{
XPathDocument xpathDoc = new XPathDocument(xmlinput);
XPathNavigator xpathNavig = xpathDoc.CreateNavigator();
XPathNodeIterator pgItereator = xpathNavig.Select("/Customer/Item");
foreach (XPathNavigator n in pgItereator)
{
string val = n.GetAttribute("id", "");
}
}

private static void NavigateXmlReader(string xmlinput)
{
XmlReader objReader = System.Xml.XmlReader.Create(new System.IO.StringReader(xmlinput));
while (objReader.Read())
{
if (objReader.NodeType == XmlNodeType.Element)
{
if (objReader.Name == "Item")
{
objReader.MoveToAttribute("id");
string id = objReader.Value;
}
}
}
}

private static void NavigateXmlDocument(string xmlinput)
{
XmlDocument objdoc = new XmlDocument();
objdoc.LoadXml(xmlinput);
XmlNodeList objlist = objdoc.SelectNodes("/Customer/Item");
foreach (XmlNode n in objlist)
{
string val = n.Attributes["id"].Value.ToString();
}
}

private static void NavigateXlinq(string xmlinput)
{
XElement obj = XElement.Parse(xmlinput);
IEnumerable oldItem = (from c in obj.Elements("Item")
select c);
foreach (XElement ele in oldItem)
{
string val = ele.Attribute("id").Value;
}
}
}

I have kept the watcher for each method to get the time taken to process the method. Here is the output of my program

The XPathDocument was always much lower than any other methods. And the performance of the method always fall into below order

• XPATHDocument
• XMlReader
• XLinq
• XMLDocument

This is purely based on my sample test and it may differ based on the situation. For any enterprise applications, where the number hits and concurrent users are huge, we need to definitely consider on these methods as you can see a drastic difference on the process time.