Impersonation

Layers of an application may be deployed across multiple physical tiers. Due
to this fact, there must be a way of transferring the user’s identity information across tier boundaries.
This is often called impersonation.

Windows Communication Foundation (WCF)

What is service:
A service is some functionality that is exposed via a structured messaging scheme. This functionality could be shared on any transport protocol like HTTP, TCP, MSMQ. The structure messaging scheme could be somthing like what is defined in HTTP requests/responses.

Originally code named "Indigo", WCF is one of four APIs introduced with the .NET Framework 3.0, in December 2006. WCF unifies several other existing distributed communication APIs supported by the .NET Framework 2.0. Previously, separate APIs for SOAP-based communications for maximum interoperability (Web Services), binary-optimized communications between applications running on Windows machines (.NET Remoting), transactional communications (Distributed Transactions), and asynchronous communications (Message Queues) existed. WCF unified all these mechanisms into a single, common, general service-oriented programming model for communications.

The principles of Service orientation says “we don’t think in terms of objects (Object Oriented) or components (Component oriented) because these two have problems when they come in distrubuted environments. There are differences whether you talk locally (in case of objects or components developed locally) and when you are talking in a distributed environment. So we are thinking in terms of messages. We accept messages and send messages”

Four tenets of SOA and how is it implemented in WCF Technology in a way,how can WCF to avoid the well-known pitfalls of using current technologies such as (WSE):
1) Boundaries are explicit :
Applications is communicating to each other by sending and receiving messages to each other.
2) Services are autonomous: you can't control any service out of your organization boundaries.
Your solution should be loosely coupled ,so it can tolerate these changes and continue running if one or more services are un available.
3) Services share schema,contracts not classes or types: simply each service publish the schema of the data which will be exchanged between the service and clients and how can be binded to the clients,these information is used by clients to consume the published services.
4)Compatibility is based on policy:Schemas and contracts exposed by the service is define the "Shape" of the service.if you familiar with WS Enhancements,it has its specification on WS-Security,WS-Interoperability....etc which has been encapsulated into the WCF unified platform.

Additional Service Oriented principles (you should adhere to simply because it is the right thing to do) :
1.  Services are secure.
2.Services leave the system in a consistent state.
3.Services are thread-safe.
4.  Services are reliable & robust.
        Interoperable
        Scaleable
        Available
     Responsive
     Disciplined

 

WCF a part of the .NET Framework that provides a unified programming model for rapidly building service-oriented applications that communicate across the web and the enterprise. It is a microsoft platform for SOA (service oriented architecture). So service oriented is a key feature of WCF. It is an attempt to do interoperability with other platforms.

It is a single extendable object model.

WCF is a core component of the .NET Framework 3.0 (formerly WinFX) which is included with Windows Vista and will support Windows 2003 and Windows XP platforms as well as the future version of Windows Server.

As its name suggests, WCF provides the .NET Framework with a basis for writing code to communicate across components, applications, and systems.

Services expose one or more endpoints where messages can be sent by the clients in order to get some information from the service or submit some data to the service.

Each endpoint consists of 3 properties (ABC)

Address (Where) :  URI indicates where the service is located.

Binding (How) : Technical implementation of the communication. It defines how i

Contract (What) : It is a technical description or interface.

Services expose one or more endpoints where messages can be sent. Each endpoint consists of an address, a binding, and a contract. The address specifies where to send messages. The binding describes how to send messages. And the contract describes what the messages contain. Clients need to know this information before they can access a service.

 

Services can package up endpoint descriptions to share with clients, typically by using Web Services Description Language (WSDL). Then clients can use the provided service description to generate code within their environment capable of sending and receiving the proper messages.

WCF Architecture

 

ABCs of WCF : Address, Binding and Contact.

When we are creating a service library, we will be applying attributes on our interfaces and classes to build something called Data Contracts and Service Contracts.

Contracts

Contracts define various aspects of the message system. It is a platform-neutral and standard way of describing what the service does.

In WCF we have 4 types of contract:
· Service Contract: Service contracts define the operations that a service will perform when executed. They tell the outside world a lot about the service such as message data types, operation locations, the protocols the client will need in order to communicate with the service, and the operations the service provides. It maps CLR types to WSDL.

Service contracts uses two types of attributes:

ServiceContract - This attribute is used to define the Interface.
OperationContract - This attribute is used to define the method inside Interface.

· Data Contract: It describes a data structure. It defines which data types can be transferred in the service. A Data Contract marks a business entity (class) as a participant in a Service Contract and Service Operation. It maps CLR types to XSD.

Data contracts uses two types of attributes:
DataContract : is used to define the class.
DataMember : is used to define the  properties.

· Fault Contract: A Fault Contract is the definition of how errors are raised and handled by WCF clients. There is no concept of an exception in WCF (this is a .NET only idea). Fault Contracts describe error conditions and behavior for managing these conditions.

· Message Contract: It is an extra functionality allows you to send message in a customized way.It defines the structure of the message over the wire. It can be typed or untyped and useful when there is an existing message format to comply with. It maps CLR types to SOAP messages.

Steps to create and use a WCF service:

WCF Message Exchange Patterns
WCF service contracts can express three message exchange patterns that can be used in your
services:

1. Simplex (One way)
One-way is a “fire-and-forget” style of messaging as in this scenario, the client initiates communication and sends a message to the service without for a reply from the service. The service consumes the message and performs some action but does not communicate back to the client. The client in the Simplex message pattern suffers from short-term memory loss. When the client sends the message, it has no idea it sent a message because it is not expecting a response.

2. Duplex : It allows client and service to communicate openly by exchanging messages at both ends. It is a peer-to-peer connection.

3. Request-Reply: This is the default pattern of exchanging messages in WCF. This is the most common pattern in today’s web services (ASMX) world. In this the client sends a message(Request) and waits until a reply is sent back(Reply).

Free images

The following are the tops sites providing images:
Stock.XCHNG (Tons of Free Images)
Morguefile (Also free images)
iStockPhoto (Not free, but Affordable prices)
Corbis (Excellent images but expensive)
GettyImages (One more Paid Site with good images)

Screen Capture in Windows Vista

Apple Mac 10.x have an easy to use Screen grab tool in-built in the system menu.
The good news is Windows Vista bundles (out of box) a great screen capture tool called "Snipping Tool". The tool helps you to Capture a portion of your screen so you can save, annotate, or share the image.
You can find the Snipping Tool either via Start > Accessories > Snipping Tool or by simply typing Snip into any Search window. But it is easy to create a shortcut for it by using the path %SystemRoot%\system32\SnippingTool.exe. This path should work in all Windows Vista (32 bit) editions. It also has rudimentary painting (pen) tool. The tool allows you to copy the URL associated with a screen area and you can control this in your application through this API.

Microsoft Contracts - The newest

Today I was reading some open source code. I saw a DLL referenced in the .NET project named "Microsoft.Contracts". I couldn't stop myself and started finding the facts about it. Hurray it is the the the latest technique developed by Microsoft which will be shipped with .NET 4.0.

The concept is based on a programming model known as Design By Contract."Design by Contract" is a method made famous by Bertrand Meyer in the Eiffel programming language where support is built right into the language constructs.

Code Contracts for .NET, is a general design-by-contract mechanism that all .NET programmers can now take advantage of. Using it, programmers provide method preconditions and postconditions. Also Contracts allow you to express object invariants in your code.

The basic idea is that a class can be viewed as having a contract with its clients whereby the class guarantees to provide certain results (postconditions of its methods) provided that the clients agree to satisfy certain requirements (preconditions of the class's methods). For example, consider a routine:
FindCustomer(int customerID)
The precondition might be that customerID is positive. The postcondition might be that we guarantee to find the customer, i.e., possibly among other things, that the return value is a non-empty string. A failure of the precondition indicates a bug in the caller, the client. A failure of the postcondition indicates a bug in the routine, the supplier.

PreConditions : These are expressed in the code using Contracts.Requires(...). PostConditions : These are expressed in the code using Contracts.Ensures(...).
Object Invariants : The Contract.Invariant() method is used to specify object invariants.

All of the contract methods are static methods de ned in the Contract class which appears in the
System.Diagnostics .Contracts namespace.

The library can be downloaded from http://research.microsoft.com/en-us/downloads/4ed7dd5f-490b-489e-8ca8-109324279968/default.aspx

OpenID

What is OpenID?
OpenID eliminates the need for multiple usernames across different websites, simplifying your online experience.
You get to choose the OpenID Provider that best meets your needs and most importantly that you trust. At the same time, your OpenID can stay with you, no matter which Provider you move to. And best of all, the OpenID technology is not proprietary and is completely free.
For businesses, this means a lower cost of password and account management, while drawing new web traffic. OpenID lowers user frustration by letting users have control of their login.
For geeks, OpenID is an open, decentralized, free framework for user-centric digital identity. OpenID takes advantage of already existing internet technology (URI, HTTP, SSL, Diffie-Hellman) and realizes that people are already creating identities for themselves whether it be at their blog, photostream, profile page, etc. With OpenID you can easily transform one of these existing URIs into an account which can be used at sites which support OpenID logins.
OpenID is still in the adoption phase and is becoming more and more popular, as large organizations like AOL, Microsoft, Sun, Novell, etc. begin to accept and provide OpenIDs. Today it is estimated that there are over 160-million OpenID enabled URIs with nearly ten-thousand sites supporting OpenID logins.

OpenID is an open protocol that enables a person to use a URL as an identity and use the same identity (the URL) at multiple web sites that support OpenID. Web- enabled applications can use the identity URL for authentication, authorization, and other purposes. It is a relatively new concept which puts the control of the identity into the hands of its owner, the end user. The owner of the identity can decide, and has control over, which information should be presented to an application or web site for authentication purpose.
Among other things, OpenID enables owners to:
· Login to web-enabled applications and web sites without ever entering any username and password information.
· Enable web sites to request information from a user; and empowering the user to choose which information is to be sent to a web site during authentication/authorization process.
· Chose which sets of information (also known as profiles or cards) to be sent to different web sites, based upon need and risk level.
· Allows implementation of graded and risk-based authorization.
· Implement an alternate to single sign on (SSO) for multiple applications within an organization.
· Implement an alternate mechanism for cross-company authentication (CCA) for affiliates and business partners.
· Integrate applications into the OpenID system using a simple and elegant mechanism.
· Lower cost of implementation and maintenance of an identity management solution.

Who Owns or Controls OpenID?
OpenID has arisen from the open source community to solve the problems that could not be easily solved by other existing technologies. OpenID is a lightweight method of identifying individuals that uses the same technology framework that is used to identify websites. As such, OpenID is not owned by anyone, nor should it be. Today, anyone can choose to be an OpenID user or an OpenID Provider for free without having to register or be approved by any organization.
The OpenID Foundation was formed to assist the open source model by providing a legal entity to be the steward for the community by providing needed infrastructure and generally helping to promote and support expanded adoption of OpenID.
As Brad Fitzpatrick (the father of OpenID) said, “Nobody should own this. Nobody’s planning on making any money from this. The goal is to release every part of this under the most liberal licenses possible, so there’s no money or licensing or registering required to play. It benefits the community as a whole if something like this exists, and we’re all a part of the community.”


Terminology

1. Identifier : URI or XRI
2. Replying party (RP, Consumer)
3. openID provider (Identity provider, openID server)

There are three major components in any OpenID system: Consumer, Identity Provider, and User Agent. These components interact with each other during the authentication process. Roles for these components are explained next.

1. The Consumer, which is the web site where you are trying to login, interacts with the Identity Provider and the User Agent (the web browser). An End User will try to login to the Consumer web sites using OpenID. During the authentication process, the Consumer will send some messages to the Identity Provider directly as well as via User Agent with the help of HTTP redirect messages.

2. The Identity Provider is the OpenID server that holds an End User’s
credentials. The Identity Provider will validate the ownership of an identity URL to the Consumer using two basic mechanisms which we shall discuss later in this chapter.

3. An End User will interact with the Consumer and Identity Provider using the User Agent. The User Agent is your web browser.

During the authentication process, the browser acts as the middle man between the Identity Provider and the Consumer web site for some messages. Typically, a Consumer will interact with the web browser as well as the Identity Provider during authentication process. However in some cases, the Consumer may use cached keys to authenticate a user without any direct communication with the Identity Provider.

 

There are two basic communications methods among different entities in an OpenID system:

1. Direct Communication
2. Indirect Communication.

In the Direct Communication mechanism, two entities directly talk to each other using the HTTP protocol. The HTTP POST method is used for direct communication.

With the Indirect Communications, two entities talk to each other via a third entity. This third entity is typically the web browser. Indirect communication may happen via HTTP Redirect or via HTML Form redirection.

OpenID has two major modes of operation: the Dumb mode and the Smart mode. These modes are based upon how intelligent the Consumer is. In Dumb mode, as the name implies, the consumer is not that smart and has to perform few additional steps every time a user logs in. In Smart mode, the Consumer keeps state information and caches shared keys for future use.

Dumb Mode Communications Flow

1. You visit the Consumer web site where you want to login.
2. The web site presents a web page where you enter your identity URL. Typically, you will enter your Identity URL (for ex http://myvikas.myopenid.com) and click on Login button. Different web sites may have different types of web pages but the process will remain the same.
3. The Consumer web site will clean up the Identifier URL and fetch the information from its current URL location. . In OpenID specification version 2, another XML protocol, known as Yadis, can also be used at this stage for service discovery.
4. After fetching the page, the Consumer will then parse it and determine the location of Identity Provider (OpenID Server). This parsing process is also called discovery. After parsing, the Consumer will then redirect the web browser to the Identity Provider to obtain the assertion information. This happens using the HTTP GET method. Optionally, the consumer may establish a connection with the identity provider at this point and exchange a shared secret for further communication. This is shown with a dotted line in Figure and marked as step 4a.
5. If the end user is not already logged into to Identity Provider, the Identity Provider may ask the End User to login. However, it should be noted that this part is outside the OpenID specifications and it is left to the Identity Provider to decide how to authenticate the End User. In some circumstances, if you have already logged into the Identity Provider web site, this part may be skipped altogether.
6. The Identity Provider website will return the assertion information with its signature to the Consumer via browser redirect. This assertion will represent either an authentication success or failure. The HTTP GET method is used in this step as well. Note that this is the Indirect Communication between Identity Provider and the Consumer.
7. During successful assertion, the Consumer will establish a direct connection with the Identity Provider, preferably over a secure SSL session. It will request the authentication information directly from the Identity Provider and compare it with the assertion information it received via User Agent (web browser). This is to double check the validity of the assertion in case a User Agent (or a malicious attacker) is trying to cheat.
8. If there is a match in the previous step, the End User will login to the website. Otherwise the login will fail.

Smart mode communication is almost same except a change in point-7. It is :
After a successful assertion, the Consumer verifies the assertion using the cached shared key. If there is a match in the previous step, the End User will login to the web site. Otherwise login will fail.

Detailed diagram of openID protocol:

There are a lots  of terms like XRDS, yadis described in this diagram. I will expore these terms soon in deeper detail.

Mashup

What is a Mashup?


A mashup is a website or web application that seamlessly combines content from more than one source into an integrated experience.Content used in mashups is typically sourced from a third party via a public interface or API. Other methods of sourcing content for mashups include Web feeds (e.g. RSS or Atom) and JavaScript.Many people are experimenting with mashups using eBay, Amazon, Google, and Yahoos APIs. The increased use and popularity of mashups has increased with the emergence of Web 2.0, which is characterized by active user participation and interaction.The architecture of mashup web applications is always composed of three parts:• The content provider: it is the source of the data. Data is made available using an API and different Web-protocols such as RSS, REST, and Web Service• The mashup site: is the web application that provides the new service using different data sources that are not owned by it.• The client web browser: is the user interface of the mashup. In a web-application, the content can be mashed by the client web browsers using client side web language for example JavaScript.Types of Mashups:There are many types of mashups, such as consumer mashups, data mashups, and business mashups. Consumer mashups: Consumer mashups combine different forms of media from multiple sources and combine them into a single graphical interface. Consumer mashups are aimed at the general public, that is, consumers. Examples of consumer mashups include the many Google Maps applications, iGuide and Radioclouds.Data mashups:Data mashups combine similar types of media and information from multiple sources into a single graphical representation. An example of a data mashup is the Havaria Information Services' AlertMap. which combines current data from over 200 sources related to severe weather conditions, biohazard threats and seismic information from around the world, and displays them on a single map of the world. Another example of a data mashup is Yahoo PipesBusiness mashups:Business mashups focus on various forms of data aggregation into a single presentation, but also allow for collaborative function ability amongst businesses and developers. Serena Software is a company involved in the business mashup industry.