Article: Type Systems Compared, XML, CLR 

I'm going to publish a series of my articles, which went out the door a couple of months ago.

All articles are in Slovene language.

Here goes the first one.


Naslov:

Tipski sistem XML <> Tipski sistem CLR

Tipski sistem XML <> Tipski sistem CLR

Categories:  Articles | CLR | XML
Thursday, 01 June 2006 14:38:54 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Windows Workflow Foundation: Calling WCF Services 

Having the ability to call services from inside your workflows is a good thing. Things get a little obfuscated when one wants to expose a WCF based service to Windows Workflow Foundation (WF).

What it comes down to is that currently (beta 2 build of WF) we do not have any built-in workflow activities which would allow you to communicate with the WCF advanced services (meaning WS-Security enabled, TCP based, WS-RM enabled, WS-Tx enabled, ...).

Assuming we have an OrderService exposed using the following config:

<configuration>
  <system.serviceModel>
    <bindings>
      <wsHttpBinding>
        <binding name="Default">
          <security mode="None"/>
        </binding>
        <binding name="Secure">
          <security mode="Message">
            <message clientCredentialType="Windows"/>
          </security>
        </binding>
        <binding name="Reliable">
          <reliableSession enabled="true" ordered="true"/>
        </binding>
      </wsHttpBinding>
    </bindings>
    <services>
      <service name="WCFCalledByWorkflow.OrderService" >
        <endpoint address=""
                  binding="wsHttpBinding"
                  behaviorConfiguration="Default"
                  contract="WCFCalledByWorkflow.IOrderService" />
        <endpoint address="/secure"
                  binding="wsHttpBinding"
                  behaviorConfiguration="Secure"
                  contract="WCFCalledByWorkflow.IOrderService" />
        <endpoint address="/reliable"
                  binding="wsHttpBinding"
                  behaviorConfiguration="Reliable"
                  contract="WCFCalledByWorkflow.IOrderService" />
      </service>
    </services>
  </system.serviceModel>
</configuration>

This, combined with the following hosting app:

using (ServiceHost sh = new ServiceHost(typeof(OrderService),
  
new Uri("http://localhost:666/OrderService")))
{
   sh.Open();
   Console.WriteLine("Order service running..\n");
   Console.WriteLine("Listening on:");
   foreach(ServiceEndpoint se in sh.Description.Endpoints)
   {
      Console.WriteLine(se.Address.ToString());
   }
   Console.WriteLine("\nPress [Enter] to stop the service.");
   Console.ReadLine();
   sh.Close();
}

Would produce the following output when run:

Order service running..

Listening on:
http://localhost:666/OrderService
http://localhost:666/OrderService/secure
http://localhost:666/OrderService/reliable

Press [Enter] to stop the service.

Now, this is not enough. Our service exposes three different endpoints, each one has different message requirements. And what is more important, all three are based on SOAP 1.2 + WS-Addressing.

There is a 'Default' endpoint which is plain vanilla SOAP 1.2 endpoint, without any security (have to mention it: WCF services are secure by default, one has to turn off security to achive this). Second endpoint uses Windows based message security and third turns on WS-RM. Security wise, second and third endpoints are the same (remember, defaults?).

As said, WF is currently not able to communicate with any of the above endpoints. What needs to be done is adding another endpoint to your service, which would expose it in ASMX compatible way.

The new config is this:

<configuration>
  <system.serviceModel>
    <bindings>
      <wsHttpBinding>
        <binding name="Default">
          <security mode="None"/>
        </binding>
        <binding name="Secure">
          <security mode="Message">
            <message clientCredentialType="Windows"/>
          </security>
        </binding>
        <binding name="Reliable">
          <reliableSession enabled="true" ordered="true"/>
        </binding>
      </wsHttpBinding>
    </bindings>
    <services>
      <service name="WCFCalledByWorkflow.OrderService" >
        <endpoint address=""
                  binding="wsHttpBinding"
                  behaviorConfiguration="Default"
                  contract="WCFCalledByWorkflow.IOrderService" />
        <endpoint address="/secure"
                  binding="wsHttpBinding"
                  behaviorConfiguration="Secure"
                  contract="WCFCalledByWorkflow.IOrderService" />
        <endpoint address="/reliable"
                  binding="wsHttpBinding"
                  behaviorConfiguration="Reliable"
                  contract="WCFCalledByWorkflow.IOrderService" />
        <endpoint address="/legacy"
                  binding="basicHttpBinding"
                  contract="WCFCalledByWorkflow.IOrderService"/>
      </service>
    </services>
  </system.serviceModel>
</configuration>

So our Windows Workflow Foundation compatible endpoint is <base address>/legacy.

What this means is that you can bind all your InvokeWebService activities inside workflows to published WCF services by just adding another ASMX compatible endpoint to the WCF service.

The difference in two WCF configs is here:

<endpoint address="/legacy"
   binding="basicHttpBinding"
   contract="WCFCalledByWorkflow.IOrderService"
/>

Code sample can be downloaded here. It includes two projects, a WF and a WCF project. ServiceHost is implemented.

Categories:  .NET 3.0 - WCF | .NET 3.0 - WF
Wednesday, 31 May 2006 11:54:58 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 On AJAX being dead 

A fellow MVP, Daniel Cazzulino, has a post titled AJAX may be the biggest waste of time for the web. While I agree with most of the points there, one should think about what Microsoft is doing to lower the AJAX development experience boundary.

Having to deal with JavaScript, raw (D)HTML and XML is definitely not going to scale from the developer penetration perspective. Nobody wants to do this is 2006. Therefore if Atlas guys make their magic happen, this would actually not be neccessary. It they achieve what they started, one would be abstracted from client side programming in most of the situations.

<atlas:UpdatePanel/> and <atlas:ScriptManager/> are your friends. And they could go a long way.

If this actually happens then we are actually discussing whether rich web based apps are more appropriate for the future web. There are scenarios that benefit from all these technologies, obviously. And if the industry concludes that DHTML with XmlHttpRequests is not powerful enough, who would stop the same model to produce rich WPF/E code from being emitted out of an Atlas enabled app.

We have, for the most part, been able to abstract the plumbing that is going on behind the scenes. If it's server side generated code, that should be running on a client, and if it is JavaScript, because all browsers run it, so be it.

We have swallowed the pill on the SOAP stacks already. We don't care if the communication starts with a SCT Request+Response messages, following by the key exchange. We do not care that a simple request-response model produces 15 messages while starting up. We do not care that there is raw XML being transfered. After all, it is all a fog, doing what it is supposed to do best - hiding the abstraction behind our beautiful SOAP/Services stack API.

Categories:  Other | Web Services | XML
Saturday, 27 May 2006 11:07:39 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 NT Conference 2006 (NTK) - Distraction Overflow 

This year's NT conference has closed its doors. And it's a big event, this year around 2.150 attendees came. NTK is the biggest IT conference in Slovenia, hell; it's the biggest conference in Slovenia.

This is not without cause. Gathering 1 in 1000 from the complete country population is not simple - there has to be at least some additional fun present to pull this off.

As Dejan writes, some Microsoft partners went overboard this year. Having said that, one has to acknowledge that there are at least four profiles present at every conference:

  1. Those who get there to have fun
  2. Those who get there to have fun and learn a lot
  3. The speakers
  4. Other

Now, satisfying the first class of people is simple. Since NTK is a technical conference, one's expectation of a non-stop, 24 hour party is diminished by the fact that that is not appropriate for the conference of this caliber. These guys have fun with Nr. 2 and Nr. 3 guys during the conference evening events and make up their own things of interest between session hours.

Satisfying number 2 is harder. Anyone who wants to learn a lot and still have fun has some issues with the current agenda. There are fun things to visit during session hours and if you're a guy who wants to learn a lot, but still have fun, you have to decide what is more important. Now, why would someone want to make you, the paying customer, decision-ambiguous?

Number 3 can be satisfied by a couple of things. Technical readiness should be top-notch, and this year it was even better. The second thing speakers like is that their attendees are present and in good shape to follow the sessions. There should be no, or at least a minimum amount of distraction present during the session hours.

I am not discussing the 'Other' category, since its heterogeneous enough to make any relevant observations.

It is easy to see that a couple of speakers have some issues with the way things worked out. I am one of them.

Overall, NTK is one of the best Microsoft IT events in Europe. This year, it was just stunning - no major issues with the event organization, smooth transitions, and great evening events. If there is a solution to the problems raised, one would get the right quotient between pleasure and work.


 

Categories:  Conferences | Personal
Friday, 26 May 2006 22:23:41 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Google goes AJAX: Positive addiction in the framework space 

Today, Google released Google Web Toolkit, which is an alternative to Microsoft's Atlas.

Indeed, Hell is freezing over.

Industry at large is competing for every piece of programming world. The idea of having ability to influence programmers into using your platform has become eligible for every vendor.

These situations are prevalent even on smaller markets. What we see is that companies are willing to offer their frameworks to big clients for a couple of reasons:

  • They can, because they own them (frameworks, that is)
  • They want to, because it is, remember, free to distribute (and hell to develop)
  • They want to, because addiction is goodtm

There is a special case of positive addiction present in the development world. I call it tool addiction, because it's actually not bound to a specific framework and/or platform version.

No one wants to use notepad.exe during development of a serious solution, right? We do need that Intellisense after all. Although it's just a bunch of programmatic schema definitions, one gets addicted to it. Platform vendors know this. This is the main reason tools are becoming free. The addiction flu is spreading out of the platform world, into the tool space, and as it seems to specific framework space.

Anyone who is offering anything for free has a background plan. They are not that stupid. Vendors know that once you get hooked it's not easy to be abstinent.

Categories:  Personal | Work
Wednesday, 17 May 2006 21:51:10 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Windows Communication Foundation: negotiateServiceCredential attribute 

In WCF there's a knob which you can turn to configure service credential propagation semantics.

It's called negotiateServiceCredential and is present in bindings/<bindingOfChoice>/binding/security/message/@negotiateServiceCredential in the WCF configuration schema.

This would be a possible use of it, considering only the bindings section of the WCF configuration file:

<bindings>
   <wsHttpBinding>
      <binding name="MySecureBinding">
         <security mode ="Message">
            <message clientCredentialType="Certificate" negotiateServiceCredential="false"/>
         </security>
      </binding>
   </wsHttpBinding>
</bindings>

Due to the value of false, the specified config would mandate that the WCF clients need to obtain the service credential (in this case, an X.509 certificate) out of band. Out of band in this situation means that the client needs to have a service side certificate in one of its certificate stores.

If one would put negotiateServiceCredential="true" in the upper configuration file this would not be necessary. Indigo would start with a SPNego protocol to exchange the service credentials using startup messages. For the client side, this is good in certain situations, where you would not want to (or were unable to) store service side credentials on the client. The major drawback is that this forces you to use SPNego during initialization phase and it forces you to do it every time you start up the client.

If the clientCredentialType attribute equals to Anonymous, Username, or Certificate, setting this attribute to false implies that the client needs to define the serviceCertificate attribute. The following would be a valid config value for having clientCrendentialType="Certificate" (again, limiting it to only the behavior element:

<behavior name="MyBehavior">
   <serviceCredentials>
      <serviceCertificate
         x509FindType="FindBySubjectName"
         findValue="<My Certificate Subject>"
         storeLocation="LocalMachine"
         storeName="My"/>
   </serviceCredentials>
</behavior>

As a reminder, the default value of negotiateServiceCredential attribute is true.

To put all this into perspective, this is a possible WCF config file:

<system.serviceModel>
   
<bindings>
      <wsHttpBinding>
         <binding name="MySecureBinding">
            <security mode ="Message">
               <message clientCredentialType="Certificate" negotiateServiceCredential="false"/>
            </security>
         </binding>
      </wsHttpBinding>
   </bindings>
   
<behavior name="MyBehavior">
      <serviceCredentials>
         <serviceCertificate
            x509FindType="FindBySubjectName"
            findValue="MyCertSubject"
            storeLocation="LocalMachine"
            storeName="My"/>
      </serviceCredentials>
   </behavior>
   
<services>
      <service name="MyService" behaviorConfiguration="MyBehavior">
         <endpoint address="" binding="wsHttpBinding"
            
bindingConfiguration="MySecureBinding" contract="MyNamespace.MyContract"/>
      </service>
   </services>
</system.serviceModel>

This config file mandates that the client has service credentials available out of band. Specifically it should be available in the local machine certificate store. The certificate should have a substring of MyCertSubject inside its subject. If this is not the case, one would not be able to call the service successfully.

Categories:  .NET 3.0 - WCF
Saturday, 13 May 2006 22:56:04 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Windows Workflow Foundation: Running Service Activated Workflows on Windows Vista and IIS7 

This post will focus on how to enable IIS7 in Windows Vista client and to use it to host a service activated Windows Workflow.

Procedure is based on the current build of Windows Vista (5381.1), which is a RC1 for Beta 2 milestone. Also, WinFX February CTP is used, which includes Windows Workflow Foundation Beta 2.

There are a couple of prerequisite steps necessary to enable hosting, first of all, installing IIS7. Go to Control Panel/Programs/Turn on or off Windows Features and enable 'Internet Information Services':

Add or remove Windows features

Installer in build 5381.1 (and 5365) is stable enough to be useful. If you're running a previous build of Vista (5308, 5342) consider installing IIS by running this monster in the command prompt:

start /w pkgmgr /l:log.etw /iu:IIS-WebServerRole;IIS-WebServer;IIS-CommonHttpFeatures;IIS-StaticContent;IIS-DefaultDocument;IIS-DirectoryBrowsing;IIS-HttpErrors;IIS-HttpRedirect;IIS-ApplicationDevelopment;IIS-ASPNET;IIS-NetFxExtensibility;IIS-ASP;IIS-CGI;IIS-ISAPIExtensions;IIS-ISAPIFilter;IIS-ServerSideIncludes;IIS-HealthAndDiagnostics;IIS-HttpLogging;IIS-LoggingLibraries;IIS-RequestMonitor;IIS-HttpTracing;IIS-CustomLogging;IIS-ODBCLogging;IIS-Security;IIS-BasicAuthentication;IIS-WindowsAuthentication;IIS-DigestAuthentication;IIS-ClientCertificateMappingAuthentication;IIS-IISCertificateMappingAuthentication;IIS-URLAuthorization;IIS-RequestFiltering;IIS-IPSecurity;IIS-Performance;IIS-HttpCompressionStatic;IIS-HttpCompressionDynamic;IIS-WebServerManagementTools;IIS-ManagementConsole;IIS-ManagementScriptingTools;IIS-ManagementService;IIS-IIS6ManagementCompatibility;IIS-Metabase;IIS-WMICompatibility;IIS-LegacyScripts;IIS-LegacySnapIn;IIS-FTPPublishingService;IIS-FTPServer;IIS-FTPManagement;WAS-WindowsActivationService;WAS-ProcessModel;WAS-NetFxEnvironment;WAS-ConfigurationAPI

Make sure you also check ASP.NET under World Wide Web Services/Application Development features, since this will install and enable ASP .NET 2.0 under all IIS7 sites. You can also do this later on using aspnet_regiis.exe, but Vista will notify you that the preferred way is using Turn on or off Windows features dialog.

Now, when you have IIS installed run the administrative console inside Administrative Tools and define a web application by right clicking on Default Web Site:

Creating application on IIS7

This will allow you to run your workflow as a service inside the default application pool. You can check and notice that default application pool uses a new integrated IIS7 mode and not ISAPI as in IIS5/6.

You're ready to deploy your workflow activated service now. use the steps described in my previous post, under Ad 1.

When you hit the service endpoint you get this:

Configuration error in IIS7

IIS7 is noticing you that your config files are not compatible with the new hosting model.

You have two options:

  • Change the configuration files
  • Change the hosting model

You can change the configuration files by running: c:\windows\system32\inetsrv\appcmd.exe migrate config "<Site name>/<VRoot name>". AppCmd.exe is a tool which automatically migrates your old config, to IIS7's new config format.

Another option is that you enable old style ISAPI hosting model inside your application pool that is running your default web site (or another site, if that's what the workflow is supposed to be running under). You can do this either by:

1. Running c:\windows\system32\inetsrv\appcmd.exe set app "<Site name>/<VRoot name>" /applicationPool: "Classic .NET AppPool". This changes the site to use another, preconfigured app pool, which uses ISAPI by default.

Here's a screenshot of the default pipeline modes for IIS7:

Application pool config in IIS7

2. Changing the hosting model on the current Default Web Site site. You can right click on Application Pools/DefaultAppPool and select Set Application Pool Defaults. Then you change the pipeline mode from Integrated to ISAPI. Here's how you do it:

Pipeline mode selection

I prefer going through route 1. Integrated mode is how you should be running your sites under IIS7, so changing the config to make IIS7 happy is the way to go. If you have specific ISAPI functionality (not limited to Workflows) you can, though run in classic mode by designing your app pool around it.

Now your service activated workflow will run and execute under IIS7. Again, beware of the caveats I described here.

Categories:  Web Services | Windows Vista | .NET 3.0 - WF
Thursday, 11 May 2006 11:15:46 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Windows Workflow Foundation: Exposing Workflows as Services 

There are currently a couple of options to expose a Windows Workflow as as service.

  1. There is a native option to publish a developed Workflow Library project as a ASP .NET Web Service (ASMX).
  2. You can host it yourself (ASMX, WCF)
  3. William Tay is doing excellent work towards hosting a workflow inside the WCF service pipeline (WCF)
  4. Roman Kiss created a static WorkflowInvoker class, which does all the heavy liting for you, if you want to host your workflow inside the WCF service method (WCF)

I'm going to focus on Ad 1 and Ad 2 in this post.

Ad 1:

There's an option to host your workflow library inside a web service by using a "Publish as a Web Service" option inside Visual Studio 2005. This creates a separate ASP .NET Web Service project inside your current solution, which you can later manually or automatically publish as a web site to your IIS of choice.

The are two major downsides to this story. The first is that this gives you practically no control over how the web service is created. Second downside, while documented, is that the current implementation of System.Workflow.Runtime.WorkflowWebHostingModule works in particular ways with the workflow persistence story.

Let's assume we have to following interface defined for this web service:

interface IServiceInterface
{
   void SendOrder(Order order);
   Order GetOrder(Guid guidOrder);
   int GetOrderStatus(Guid guidOrder);
}

What happens is (request number 1):

  1. You publish your workflow as a web service
  2. You hit the service endpoint with a browser
  3. Workflow instance gets created, is run and returns a result
  4. At this time the workflow runtime (System.Workflow.Runtime.WorkflowRuntime instance) creates a workflow instance and runs it. Since workflow completes succesfully it destroys the instance at the end of execution.
  5. Workflow runtime returns a cookie with the workflow instance back to the browser and since IE's default setting is to accept cookies, it is written to the client's disk

All good, right?

Actually, what happens during request number 2?

  1. You hit the endpoint again
  2. IE knows that the site has a persisted cookie, so it sends it bundled with the SOAP request
  3. Workflow runtime sees it and tries to load the specified workflow instance
  4. This instance is long gone, it does not exist in memory (it has been destroyed, remember?), so workflow runtime tries to rehydrate it from a persistence store. If there is a persistence store defined it goes there (most probably WorkflowPersistenceStore in SQL Server) and correctly identifies that the workflow instance is not present, so it fails with 'Workflow with id <GUID> not found in state persistence store.'. If the persistence store is not defined for this workflow it fails with 'The workflow hosting environment does not have a persistence service as required by an operation on the workflow instance <GUID>.'.

And all this is actually the expected behavior if you think hard enough. Workaround? Hit the endpoint with a newly loaded IE window. It works every time, since a cookie with an instance ID is not present.

Another thing to mention here is that this issue does not manifest itself if you hit the endpoint programatically using the web service proxy, unless you are using a CookieContainer class to cache the returning cookies.

Ad 2:

Hosting a Windows Workflow manually is another option, which gives you more flexibility towards the service detail tweeking.

You can host it using the following code:

[WebService(Namespace = "http://webservices.gama-system.com/")]
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
public class WorkflowService : System.Web.Services.WebService
{
    // workflow runtime
    private static WorkflowRuntime workflowRuntime = new WorkflowRuntime();
    
    [WebMethod]
    public void SendOrder(Order order)
    {
        AutoResetEvent waitHandle = new AutoResetEvent(false);
        workflowRuntime.WorkflowCompleted +=
           delegate(object sender, WorkflowCompletedEventArgs e)
        {
            waitHandle.Set();
        };
       
        workflowRuntime.WorkflowTerminated +=
           delegate(object sender, WorkflowTerminatedEventArgs e)
        {
            waitHandle.Set();
        };

        // create workflow instance with the specified parameters
        WorkflowInstance instance =
           workflowRuntime.CreateWorkflow(typeof(MyWorkflow));
        instance.Start();

        waitHandle.WaitOne();
    }   
}

An important thing in the specified sample is that the System.Workflow.Runtime.WorkflowRuntime instance is static to the service implementation class. This is a requirement, since the workflow runtime can only get loaded once per appdomain. If this is not the case you will get an exception during the second invocation of the workflow.

If you are using any additional workflow runtime services, like persistence, tracking or your own communication service to communicate with the workflow you will need to track that the services get loaded once only. Here's the example:

[WebService(Namespace = "http://webservices.gama-system.com/")]
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
public class WorkflowService : System.Web.Services.WebService
{
    // workflow runtime
    private static WorkflowRuntime workflowRuntime = new WorkflowRuntime();
   
   
// services added
    private static bool booServicesAdded = false;

    // communication service
    private static CommunicationService objComm = new CommunicationService();

    [WebMethod]
    public void SendOrder(Order order)
    {
        // add communication service
        if (!booServicesAdded)
        {
            ExternalDataExchangeService externalService =
               new ExternalDataExchangeService();
            workflowRuntime.AddService(externalService);
            externalService.AddService(objComm);
            booServiceAdded = true;
        }

        AutoResetEvent waitHandle = new AutoResetEvent(false);
        workflowRuntime.WorkflowCompleted +=
           delegate(object sender, WorkflowCompletedEventArgs e)
        {
            waitHandle.Set();
        };
       
        workflowRuntime.WorkflowTerminated +=
           delegate(object sender, WorkflowTerminatedEventArgs e)
        {
            waitHandle.Set();
        };

        // create workflow instance with the specified parameters
        WorkflowInstance instance =
           workflowRuntime.CreateWorkflow(typeof(MyWorkflow));
        instance.Start();

        waitHandle.WaitOne();
    }   
}

This adds the required services only during the first invocation of a web service. Since workflow runtime is a static class the services get persisted during all subsequent service calls. A boolean variable booServicesAdded is responsible for flag storage.

Categories:  Web Services | .NET 3.0 - WCF | .NET 3.0 - WF
Wednesday, 10 May 2006 09:55:37 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Compare this 

I've always wanted an Aibo. There are two reasons:

  • I wanted to play with it, and see what turns up
  • I wanted my dog to play with it, and see what turns up

Now, Genibo is around the corner. I thing I should buy at least one robot dog, considering we have this sleeping besides us.

Compare this:

With this hunger-stricken dog:

Picture:

What would happen?

I wonder what Lupus (with his ~150 pounds/70 kilos) would do with a plastic, whining and moving monster?

Categories:  Personal
Thursday, 27 April 2006 20:46:49 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 WCF: certificateValidationMode and revocationMode 

Having spent a lot of time reasoning about WCF and certificate based authentication, here's a scoop.

This forces WCF to expect a client side certificate for message based security:

<behavior name="DefaultBehavior" returnUnknownExceptionsAsFaults="false" >
  <serviceCredentials>
    <serviceCertificate
      x509FindType="FindBySubjectName"
      findValue="MyCertificate"
      storeLocation="LocalMachine"
      storeName="My"/>
    <clientCertificate>
      <authentication certificateValidationMode="ChainTrust" revocationMode="Online"/>
    </clientCertificate>
  </serviceCredentials>
  <metadataPublishing enableGetWsdl="true" enableMetadataExchange="true" enableHelpPage="true"/>
</behavior>

What it says is that the client certificate must validate according to the complete certificate chain. In broader terms it forces the caller to use the certificate that is 'validatable' on the service side. This means the following:

  1. The certificate must be present at the time of request generation (client side)
  2. The certificate must be valid according to expiration period and certificate generation (checking done on server side)
  3. The certificate chain (issuing CAs path) must be valid (certificateValidationMode="ChainTrust")
  4. The certificate must not be obsolete and/or revoked (revocationMode="Online")

Other authentication options of certificateValidationMode and revocationMode include:

  • certificateValidationMode can take a velue of ChainTrust, PeerTrust, ChainOrPeerTrust, None or Custom. None means that no certificate checking is done, Custom allows one to plug in a custom X509CertificateValidator (new, System.IdentityModel.Selectors namespace), PeerTrust forces a public key of the client certificate to be present in the 'Trusted People' certificate store on the service side and ChainTrust requests that the client cert can be validated against the root certificates on the server side. ChainOrPeerTrust just executes the OR operator on the last two.
    Remark: PeerTrust and ChainOrPeerTrust are also subjected to another attribute called trustedStoreLocation. If peer trust is demanded, one can specify where the public keys are present, meaning either in LocalMachine or CurrentUser store.
  • revocationMode takes the following value list: None, Online or Cached. None is saying that CRL (Certificate Revocation List) is not checked. Online demands that service checks (at every request) whether the certificate is still valid and thus not revoked. Offline says that the certificate should only be checked against the cached CRL.
    Remark: Online does not mean that CRL will be downloaded from the CA CRL endpoint at every request. It means it will check a local copy of it at every request. Every CRL has a validity period, when it expires, it is downloaded again.

The <metadataPublishing> element is there just to allow WSDL/MetadataExchange endpoints to exist. It also allows the familiar service HTML page to pop up if you hit the endpoint (courtesy of enableHelpPage="true").

Another remark: Current February 2006 WCF CTP bits do not reflect the naming used in this post. For example revocationMode="Cached" was renamed from revocationMode=Offline", but don't be afraid of using it, nevertheless.

Categories:  .NET 3.0 - WCF
Thursday, 27 April 2006 20:33:59 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 On Windows compared to 'other' OSs 

Having an option is always a good thing, right? But there comes a time when we all have to face the truth of the free (economic) world. There are things that just do not fit in common line-of-though agenda.

Like this one (Rob Enderle, link):

Windows is free to the OEMs. In fact, not only is it free, but Microsoft, in effect, pays them to take it. Regardless of the cost, Windows is a logical choice, and a straight pass. Dell (Nasdaq: DELL) pays about $80 for it and typically charges about $80 for it. There is rarely much of a mark up. If Microsoft were to lower its price that lowered price would be reflected in virtually all desktop hardware immediately.

Microsoft provides a number of services which include development support, service support, marketing support, technicians, classes, databases and support materials, and it picks up a lot of the service load as well. In addition, it provides marketing co-op dollars, incentives for early adoption of new products, and ensures a somewhat level playing field (which could be good or bad) for the vendors.

This is the world we all live in. Market share is made by a conglomerate of superiorities. Not necessarily just technical ones. We do need to acknowledge that sometimes market can be gained by offering better business environment for the complete food chain. One needs to respect the box movers too, they need those extra dollars. They need the extra revenue.

Now, here's the question. What if RedHat/Apple/Ubuntu had Microsoft's position? What would happen then?

Short term? Lower prices - better quality of life.

Long term? The same thing.

If Apple had an opportunity to excell at Microsoft's position, I bet they would exercise it! Actually, they are doing it already.

That's why I (mostly) agree with the quoted article.

Categories:  Other | Personal
Thursday, 27 April 2006 19:47:07 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Apple finally did it 

It happened today.

One of the best PC hardware makers is allowing one of the best software makers to run natively on its machines.

The world is uniting, which is a GoodThing(tm).

Soon there will be time, when we're gonna boot The Windows Beast on The Beautiful Machine.

Categories:  Apple
Wednesday, 05 April 2006 19:44:28 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Eagle View 

Now this is interesting.

Live bald eagle nest, streamed to your house.

Let's hope the parents are not disturbed too much.

Categories:  Other
Tuesday, 04 April 2006 16:22:27 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Stuck in Frankfurt 

Do you believe that it can take 12 hours to get from Ljubljana to Cambridge, UK?

I didn't.

It took me around 12 hours and a half. But considering that I only had  (2) flights, that combined do not take more that 3 hours, I was emotionaly destabilized.

Now I'm on my crusade back home.

I left Cambridge at noon. It's 10h22 PM and I'm in a small subfrankfurter town called Mainz sitting in Atrium Hotel Mainz. The place is nice, but it's also a EUR 2.98 / hour internet joint.

My flight back from London Heathrow got delayed. That's why I missed my Frankfurt-Ljubljana flight and had to stay the night in Frankfurt. So now, if I calculate, it took me almost 12 hours to get from Cambridge to Frankfurt, but the crusade back home will eventually be more than 24 hours long.

Leaving tomorrow at noon, again.

Categories:  Personal
Wednesday, 29 March 2006 21:26:09 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 New ATI Vista 5308 Drivers 

Running Windows Vista? Build 5308 (February 2006 CTP)? Got ATI?

Download this.

Categories:  Windows Vista
Tuesday, 14 March 2006 23:12:10 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 WWF on x64 Platform 

If you are running WWF (Windows Workflow Foundation, part of WinFX) on a x64 box, and have problems debugging workflows, stop.

It's currently not supported. It should, but does not work yet. This should be fixed already, but it's not. And it will probably get fixed in the next CTP drop.

There is a workaround though:

  1. Enter Configuration Manager (Build/Configuration Manager)
  2. Select the active solution platform drop down, select New...
  3. Select x86 platform
  4. Hit OK and try debugging again

This will make sure that you are running your solution debugging under x86 mode and thus allow you to set breakpoints and debug your code.

Categories:  .NET 3.0 - General | .NET 3.0 - WF
Tuesday, 14 March 2006 23:09:15 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Joel Spolsky Discussion on Frameworks 

This has to be one of the best written analogies between current framework use cases ever.

We indeed are in a state of using ANYTHING that can make our developer lives easier, no matter what the consequences are. An often times, consequences manifest themselves in increased costs, time-to-ship prolongation, complexity and speed.

Go read it. It's worth way more than the time spent.

Categories:  Other | Work
Thursday, 09 March 2006 12:54:08 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Regarding Origami 

Well, as more news bubbles up, there's a couple of things the 'Origami consortium' should do:

  • It should pull a Steve Jobs on Origami: "... and it's available today for $X99."
  • It should NOT discuss the follow-up models. I just do not want to know that in 6 months a better Origami will surface. One with a keyboard and 12 hour uptime, for example.
  • It should make sure that the Xbox 360 launch does not replay itself in terms of market congestion.

Tommorow at 9-12AM GMT a new Origami video will be available on Channel 9. I'm watching that space.

Categories:  Other | Personal
Wednesday, 08 March 2006 19:50:39 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 WCF February 2006 Intellisense Schema 

Juval Lowy, a fellow RD, posted a complete and compatibile Visual Studio 2005 schema for February 2006 CTP of Indigo (WCF).

Download here.

Copy it to Visual Studio Schema directory: c:\program files\microsoft visual studio 8\xml\schemas.

I wonder how he did it.

Categories:  .NET 3.0 - WCF
Wednesday, 08 March 2006 19:05:05 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

 Origami Mistery 

After several weeks of me following the Origami story, I'm now really dazzled.

Tried everything to find more details. RD/MVP channel is numb. The web is full of speculation. Nobody knows the details - it's being kept as a real secret.

Now, if Scoble says it's good, one has to concur. I'm so jazzed up, I'm thinking of buying one even if it sucks cat's eyeballs.

Is just can't suck that bad. It has to be something worth spending money on. I'm seeing it in person in Hannover, later this week.

Categories:  Personal
Monday, 06 March 2006 20:38:29 (Central Europe Standard Time, UTC+01:00)  #    Comments

 

Copyright © 2003-2024 , Matevž Gačnik
Recent Posts
RD / MVP
Feeds
RSS: Atom:
Archives
Categories
Blogroll
Legal

The opinions expressed herein are my own personal opinions and do not represent my company's view in any way.

My views often change.

This blog is just a collection of bytes.

Copyright © 2003-2024
Matevž Gačnik

Send mail to the author(s) E-mail