Nicholas Allen's Indigo Blog

Windows Communication Foundation From the Inside

June, 2008

  • Nicholas Allen's Indigo Blog

    JSON Service Speed

    • 3 Comments

    I've been playing with the DataContractJsonSerializer that comes with Orcas recently to produce some JSON-based services. DataContractJsonSerializer works just like any other XmlObjectSerializer, except of course that the serialization output looks nothing like XML when written out.

    {"content1":"this is content","content2":"this is more content","version":1}

    If you attempt to push the serialized output through an XML reader or writer and examine it though, that works too through some simple but seemingly magical transformations that happen behind the scenes.

    <root type="object">
    <content1>this is content</content1>
    <content2>this is more content</content2>
    <version type="number">1</version>
    </root>

    This transformation trick is one that we've used elsewhere as well to give the appearance of a consistent and highly-structured set of data formats while not actually incurring the costs of that structure.

    That led me to start trying to observe when the simpler structure of JSON actually provides a performance advantage over the standard DataContractSerializer. I've found that while JSON wins in terms of size, it doesn't always win in terms of serialization speed. Here were the observations that I made.

    DataContractJsonSerializer tended to be faster for small and simple workloads. When the number of types was small and the types didn't have very many members, DataContractJsonSerializer could beat DataContractSerializer by 25%. This was most often true when the bulk of the object data was string content. On the other hand, DataContractSerializer caught up and then started winning as the types got more complicated. I also noticed that there were some primitive types, such as floating-point numbers, where DataContractSerializer always had a significant advantage. DataContractSerializer could turn a 25% loss into a 25% win just by changing several of the fields of a small type to doubles.

    This shows that performance is a very hard thing to predict without taking measurements. I would have expected DataContractJsonSerializer to consistently win given the simpler and smaller output format but I was able to find several data contracts taken from popular services for which that wasn't true.

    Next time: Timeout Error Messages

  • Nicholas Allen's Indigo Blog

    Framework Repairs

    • 1 Comments

    Spotted on Aaron Stebner's blog last night is an article for repairing or uninstalling Orcas from the command line. Having these commands handy is tremendously useful when you need to test installation and machine configuration issues. It's a lot easier to work with the installer than to set up a virtual machine for simple projects.

  • Nicholas Allen's Indigo Blog

    Another Last Call for XML Schema 1.1

    • 0 Comments

    New working drafts have been published for XSD 1.1, which starts a last call period for comments lasting from now until September 12th. The previous last calls in 2006 and 2007 resulted in a substantial number of comments and revisions.

    You can get the XSD 1.1 drafts from the W3C web site.

  • Nicholas Allen's Indigo Blog

    PInvoke Interop Assistant

    • 3 Comments

    I noticed a new tool on CodePlex the other day called the PInvoke Interop Assistant that automatically converts between managed and unmanaged type signatures. In addition to converting API functions, it also pulls together all of the structures and types used by the API. Here's a sample showing how it handles CoCreateInstance.

    [System.Runtime.InteropServices.StructLayoutAttribute(System.Runtime.InteropServices.LayoutKind.Sequential)]
    public struct IUnknown {
        
        /// IUnknownVtbl*
        public System.IntPtr lpVtbl;
    }
    
    [System.Runtime.InteropServices.StructLayoutAttribute(System.Runtime.InteropServices.LayoutKind.Sequential, CharSet=System.Runtime.InteropServices.CharSet.Ansi)]
    public struct GUID {
        
        /// unsigned int
        public uint Data1;
        
        /// unsigned short
        public ushort Data2;
        
        /// unsigned short
        public ushort Data3;
        
        /// unsigned char[8]
        [System.Runtime.InteropServices.MarshalAsAttribute(System.Runtime.InteropServices.UnmanagedType.ByValTStr, SizeConst=8)]
        public string Data4;
    }
    
    [System.Runtime.InteropServices.StructLayoutAttribute(System.Runtime.InteropServices.LayoutKind.Sequential)]
    public struct IUnknownVtbl {
        
        /// IUnknownVtbl_QueryInterface
        public IUnknownVtbl_QueryInterface AnonymousMember1;
        
        /// IUnknownVtbl_AddRef
        public IUnknownVtbl_AddRef AnonymousMember2;
        
        /// IUnknownVtbl_Release
        public IUnknownVtbl_Release AnonymousMember3;
    }
    
    /// Return Type: HRESULT->LONG->int
    ///This: IUnknown*
    ///riid: IID*
    ///ppvObject: void**
    [System.Runtime.InteropServices.UnmanagedFunctionPointerAttribute(System.Runtime.InteropServices.CallingConvention.StdCall)]
    public delegate int IUnknownVtbl_QueryInterface(ref IUnknown This, ref GUID riid, ref System.IntPtr ppvObject);
    
    /// Return Type: ULONG->unsigned int
    ///This: IUnknown*
    [System.Runtime.InteropServices.UnmanagedFunctionPointerAttribute(System.Runtime.InteropServices.CallingConvention.StdCall)]
    public delegate uint IUnknownVtbl_AddRef(ref IUnknown This);
    
    /// Return Type: ULONG->unsigned int
    ///This: IUnknown*
    [System.Runtime.InteropServices.UnmanagedFunctionPointerAttribute(System.Runtime.InteropServices.CallingConvention.StdCall)]
    public delegate uint IUnknownVtbl_Release(ref IUnknown This);
    
    public partial class NativeMethods {
        
        /// Return Type: HRESULT->LONG->int
        ///rclsid: IID*
        ///pUnkOuter: LPUNKNOWN->IUnknown*
        ///dwClsContext: DWORD->unsigned int
        ///riid: IID*
        ///ppv: LPVOID*
        [System.Runtime.InteropServices.DllImportAttribute("ole32.dll", EntryPoint="CoCreateInstance", CallingConvention=System.Runtime.InteropServices.CallingConvention.StdCall)]
    public static extern  int CoCreateInstance(ref GUID rclsid, ref IUnknown pUnkOuter, uint dwClsContext, ref GUID riid, ref System.IntPtr ppv) ;
    
    }
    
  • Nicholas Allen's Indigo Blog

    Security Session Inactivity

    • 0 Comments

    What does the InactivityTimeout on a secure channel do?

    The inactivity timeout on a message security channel controls how long the channel will allow pending security sessions to linger in its cache before giving up on them. This is completely different from the inactivity timeout on a reliable messaging channel, which controls how long the reliable session will live without an infrastructure message before being torn down, and the inactivity timeout in the application, which controls how long the service instance will live without an application message before being torn down.

    Next time: JSON Service Speed

  • Nicholas Allen's Indigo Blog

    How WebServiceHost Works

    • 1 Comments

    WebServiceHost is a new feature in Orcas that makes it easy to put up simple web services that are built on HTTP and POX. However, there's no requirement that forces you to build REST and POX services using WebServiceHost. WebServiceHost exists to make a simple case easy, but you're not locked into using that approach if the simple case doesn't apply to you.

    Here's everything behind WebServiceHost if you want to build your own.

    • WebServiceHostFactory exists to bootstrap WebServiceHost when building a web site in IIS
    • WebServiceHost disables any service metadata or help pages so that they don't steal any part of the URI space under your web site
    • WebServiceHost generates endpoints for all of your contract types with a WebHttpBinding so that you don't have to describe the service endpoints in a configuration file
    • WebServiceHost adds a WebHttpBehavior to all of your service endpoints so that Get and Invoke operations in your service contract work without any additional setup

    Next time: Security Session Inactivity

  • Nicholas Allen's Indigo Blog

    Mapping Client Certificates

    • 1 Comments

    Whenever my service receives a message the service operation fails because the user identity is not mapped to a Windows identity. How can I make this mapping?

    What's probably going wrong is that the user identity is specified by a certificate but there's no active mapping from the client certificate to a Windows account. By default, no mapping is performed. You can enable certificate mapping by setting mapClientCertificateToWindowsAccount on the service credentials to be true.

    <serviceCredentials>
    <clientCertificate>
    <authentication mapClientCertificateToWindowsAccount="true" />
    </clientCertificate>
    </serviceCredentials>

    The actual mappings are not provided by the service configuration. Mappings are typically defined using the certificate mapping features of either IIS or Active Directory. IIS mappings can be varied from web site to web site but it's difficult to manage more than a small number of mappings. Active Directory mappings are the same all across the directory but the centralized directory makes the mappings easier to manage.

    Next time: How WebServiceHost Works

  • Nicholas Allen's Indigo Blog

    Serializing XML to XML

    • 2 Comments

    How should I represent raw XML content in a contract?

    It seems like it would be really easy to have within the large blob of XML that makes up a message, a small blob of XML. However, it's more challenging to deal with that situation than you might expect because that small blob of XML has to be handled unlike everything else. With most contracts you can chew along the message and place each of the resulting bits in its proper place. When trying to preserve the raw XML though, you have to know when not to chew.

    In your contract you should use XMLSerializer formatted fields to turn off most of the unnecessary thinking regarding the XML content. Then, XmlSerializer knows about special handling for XmlElement and XmlAttribute to complete the mapping between pieces in the message and fields in your type. These two types work under the covers with XmlSerializer even though they don't implement the standard contract for serialization.

    With Orcas, you can also use the new XElement type that is defined by XLinq. XLinq doesn't have any deep integration with XmlSerializer but XElement directly implements the IXmlSerializable contract to make things work.

    Next time: Mapping Client Certificates

  • Nicholas Allen's Indigo Blog

    Other Technologies You Might Find Interesting

    • 1 Comments

    There were two CTP releases recently of technology that don't directly focus on web services but you might find that they make developing services easier.

    The first technology is called Velocity. Velocity is a platform for building distributed caches to make it easier to develop highly-scalable applications. There are some included samples for using Velocity with ASP.NET applications but you can reuse the platform in a variety of ways.

    The second technology is called Task Parallel Library and PLINQ. There are a set of parallel extensions for writing query and iteration expressions that automatically take advantage of the data and task parallelism present in high-level programming constructs.

    You can get several videos about these parallel extensions on Channel 9 as well.

  • Nicholas Allen's Indigo Blog

    Acting on Open

    • 1 Comments

    How do I run a custom event once when the service is first started?

    The easiest way to execute some custom code when a service is started is to hook the service's Open method. Although the Open method has two different moments in time that you might be interested in, I'll just say Open to refer to them both. Opening is the moment in time just before the service is started; Opened is the moment in time just after. There a few different ways of hooking Open depending on what objects you have available.

    If you have access to a ServiceHost instance before Open is called, then you can hook Open by attaching an event handler to either the Opening or Opened events. This is the least invasive approach.

    If you're the one that's actually responsible for creating the ServiceHost instance, then you can also build your custom event directly into the host. You do this by overriding either the OnOpened or OnOpening methods. In either case, be sure to call the base method at some point. This is a more invasive approach because you have to make a subclass but you have finer control over the timing of the custom event relative to other code.

    If you don't control the ServiceHost, then you're probably running inside a hosted environment that uses ServiceHostFactory. Similar to subclassing ServiceHost, you can subclass ServiceHostFactory to install your custom event. Typically you would create an instance of a ServiceHost subclass from the ServiceHostFactory rather than putting the custom event logic in the ServiceHostFactory itself.

    Here's an example program showing the ServiceHost subclass approach.

    using System;
    using System.ServiceModel;
    using System.ServiceModel.Channels;

    public class MyServiceHost : ServiceHost
    {
    public MyServiceHost(Type serviceType, params Uri[] baseAddresses)
    : base(serviceType, baseAddresses)
    {
    }

    protected override void OnOpened()
    {
    base.OnOpened();
    Console.WriteLine("On opened");
    }

    protected override void OnOpening()
    {
    base.OnOpening();
    Console.WriteLine("On opening");
    }
    }

    [ServiceContract]
    public interface IMyService
    {
    [OperationContract]
    string Echo(string s);
    }

    public class MyService : IMyService
    {
    public string Echo(string s)
    {
    return s;
    }
    }

    class Program
    {
    static void Main(string[] args)
    {
    string address = "http://localhost:8000/";
    Binding binding = new BasicHttpBinding();

    ServiceHost host = new MyServiceHost(typeof(MyService), new Uri(address));
    host.AddServiceEndpoint(typeof(IMyService), binding, "");
    host.Open();

    ChannelFactory<IMyService> proxyFactory = new ChannelFactory<IMyService>(binding);
    IMyService proxy = proxyFactory.CreateChannel(new EndpointAddress(address));
    Console.WriteLine(proxy.Echo("Test completed"));
    proxyFactory.Close();

    Console.ReadLine();
    host.Close();
    }
    }

    Next time: Serializing XML to XML

  • Nicholas Allen's Indigo Blog

    Serialization Temporary Assemblies

    • 5 Comments

    The XmlSerializer is one of the options WCF provides for mapping between XML and strongly-typed objects. An XmlSerializer is generally preferred over other serialization approaches, such as a DataContractSerializer, when the description of the type already exists as an XML schema.

    The conversion process for XmlSerializer relies on decorating a type with metadata attributes that describe how the type mapping should take place. These metadata attributes link together fields in the type with elements and attributes in the XML schema.

    Internally, XmlSerializer analyzes the metadata attributes that you provided on the type to automatically construct the appropriate serialization code. Code generation greatly speeds up the serialization process but requires building some temporary classes and assemblies to host the code. Since these assemblies need to live somewhere, they are placed into the standard system temporary directory. Most normal user accounts have access to this directory but sometimes you want to run your application using an account with very few privileges. An anonymous or restricted service account may not be able to write to the temporary directory, causing serialization to fail.

    There are two ways that you can adjust the interaction between the application account and the generation of temporary assemblies.

    The first approach is to grant the application account read and write privileges to the temporary directory. If you don't know where the system temporary directory is located, the error message that you got when serialization failed should include the file path where XmlSerializer was expecting to find the generated code.

    The second approach is to change where XmlSerializer writes the generated code to be a location where the application account has the appropriate privileges. You can change the location for generated code by adding a serialization section to your configuration file:

    <system.xml.serialization>
    <xmlSerializer tempFilesLocation="an absolute path of your choice"/>
    </system.xml.serialization>

    Next time: Acting on Open

  • Nicholas Allen's Indigo Blog

    Network Monitor 3.2 Beta

    • 0 Comments

    Earlier this week a new beta release came out for Network Monitor. Although the beta has a variety of new features, the one I'm most interested in is the change to the capture engine to reduce the number of dropped frames. I've had problems in the past with missing frames in Network Monitor captures, especially for fast networks when there is a substantial CPU load.

    You can get the release from the Network Monitor Connect site.

  • Nicholas Allen's Indigo Blog

    You Are Here

    • 1 Comments

    Inside of a service method, how do I know where the message was delivered?

    Without defining what distinguishes a location it's hard to explain where 'here' is. I've got a few guesses though based on the most common variations of this question:

    • OperationContext.Current.IncomingMessageHeaders.To
    • OperationContext.Current.IncomingMessageProperties.Via
    • HostingEnvironment.ApplicationVirtualPath
    • Assembly.GetExecutingAssembly().Location
    • HostingEnvironment.ApplicationPhysicalPath

    Next time: Serialization Temporary Assemblies

  • Nicholas Allen's Indigo Blog

    Web Service Webcasts in June

    • 1 Comments

    Five webcasts are coming this month to talk about some of the new web service features in Orcas. Each webcast is aimed at developers and lasts 60-90 minutes.

    Beyond the Endpoints with Windows Communication Foundation with Juval Lowy (Level 100) Wednesday, June 18, 2008 10:00 A.M.-11:30 A.M. Pacific Time

    Windows Communication Foundation (WCF) is more than just the next-generation platform for building connected systems. In many respects, WCF is the next development platform for Windows-based applications, providing system features that are presently crafted by hand on top of the Microsoft .NET Framework and the Windows operating system. In this webcast, we describe the power and productivity of WCF and demonstrate how it is a "better .NET Framework." We focus on the key system features of WCF so you can make educated decisions on aligning your product road map with WCF and assess the advantages of using WCF. We begin the webcast with a brief overview of WCF and the WCF architecture, and then we demonstrate data contract tolerance, instance management, transaction propagation, automatic synchronization, queued calls, and automatic security.

    geekSpeak: Workflow Services in .NET 3.5 with Jon Flanders (Level 200) Wednesday, June 18, 2008 12:00 P.M.-1:00 P.M. Pacific Time

    Windows Communication Foundation (WCF) and Windows Workflow Foundation (WF) are powerful technologies that were first introduced in the Microsoft .NET Framework 3.0. In release 3.5 of the .NET Framework, these two technologies work even better together. In this installment of geekSpeak, Jon Flanders from Pluralsight introduces you to workflow services , and he describes how workflow services unites WCF and WF and provides great new features for building solutions. Your hosts for this geekSpeak are Lynn Langit and Glen Gordon.

    Calling Services from Silverlight 2.0 with Jon Flanders (Level 300) Monday, June 23, 2008 9:00 A.M.-10:00 A.M. Pacific Time

    Microsoft Silverlight 2.0 browser plug-in provides an environment for building rich Internet applications (RIAs). Traditionally, these types of applications relied heavily on services such as Asynchronous JavaScript and XML (AJAX) for their functionality. In this webcast, we look at the facilities built into Silverlight 2.0 for calling services, and we discuss the options for implementing these services.

    Windows Communication Foundation and Windows Workflow Foundation Integration in Depth with Jesus Rodriguez (Level 400) Wednesday, June 25, 2008 10:00 A.M.-11:00 A.M. Pacific Time

    The combination of Windows Communication Foundation (WCF) and Windows Workflow Foundation (WF) provides the building block for the next generation of Microsoft .NET applications. With the release of Microsoft .NET Framework 3.5, developers now have multiple alternatives to build applications that combine WCF and WF. In this webcast, we illustrate some of the most common scenarios for integrating WCF and WF, and we explore mechanisms such as Durable Services, Workflow Services, rules-based authorization, line-of-business workflows, and other mechanisms that are best implemented by combining WCF and WF. We also share a series of best practices and techniques that developers can follow in order to implement a seamless integration between WCF and WF.

    Windows Workflow Communication in Depth with Matt Milner (Level 400) Thursday, June 26, 2008 9:00 A.M.-10:00 A.M. Pacific Time

    Windows Workflow Foundation (WF) provides a powerful framework for building reactive programs, which are programs that respond to events and inputs. One of the biggest challenges faced by developers new to Windows WF is figuring out the best way to communicate with the workflows that are running in the runtime. In this webcast, we cover the underlying communication architecture, how to create custom activities that allow you to wait for events or input, how to perform request/response style communication, and the send/receive activities available in the Microsoft .NET Framework 3.5.

  • Nicholas Allen's Indigo Blog

    Tracing Network Calls

    • 2 Comments

    Many common networking problems can be diagnosed by tracing System.Net events. This is often much easier than setting up packet captures or other software, particularly if you're working on a production machine. Since tracing is a part of the framework, it works almost everywhere just by dropping some additional configuration.

    Here's an example of a complete configuration file for turning on System.Net tracing.

    <configuration>
    <system.diagnostics>
    <trace autoflush="true" />
    <sources>
    <source name="System.Net">
    <listeners>
    <add name="MyTrace"/>
    </listeners>
    </source>
    </sources>
    <sharedListeners>
    <add name="MyTrace" type="System.Diagnostics.TextWriterTraceListener" initializeData="trace.txt" />
    </sharedListeners>
    <switches>
    <add name="System.Net" value="Verbose" />
    </switches>
    </system.diagnostics>
    </configuration>

    You can also make the event source more specific by changing System.Net to one of System.Net.Sockets, System.Net.Cache, or System.Net.HttpListener.

    Next time: You Are Here

  • Nicholas Allen's Indigo Blog

    First Web Browser on Windows

    • 0 Comments

    The first web browser for Windows was released 15 years ago by Thomas Bruce of the Cornell Legal Information Institute. June 8th marked the 15th anniversary of the 0.1 release, with a succession of followup releases soon after. Cello 0.2 was released on June 14th, 0.3 on June 16th, 0.4 on June 18th, 0.5 on June 24th, and 0.6 on June 30th. Fortunately, there were no more days left in June or else the web browser fad may have caught on. Cello quickly went into disuse and ceased being updated less than a year later.

    For those interested in nostalgia, here is Thomas's original release announcement.

    From: Thomas R. Bruce 
    Date: Tue, 8 Jun 93 22:00:52 GMT-1:00
    Organization: Legal Information Institute
     
    (Cross-posted to many lists and groups.  Please forgive necessary
    duplications)
     
    Folks:
     
    This is an announcement of Beta Release 0.1 of Cello, a
    World-Wide Web browser for Microsoft Windows 3.1
     
    Features:
     
    -- (HTTP/HTML) browser, with user-configurable colors  and fonts.
    -- Full-featured Gopher (though unfortunately not yet Gopher+)
    client, including a hyper-ized CSO which permits (sorta dumb)
    SMTP mailing.
    -- Transparent access (via WWW) to FTP, HyTelNet, Telnet, etc.
    etc. ad infinitum.
    -- Graphics and PostScript viewing and sound playing via
    MSWindows Associations...feature, using add-on, shareware
    viewers such as SNDTOOL, GV057, and the Windows version of
    GhostScript.
    -- Ad-hoc Telnet, FTP, and Gopher sessions.
    -- SLIP/PPP support with dialup scripting language.
    -- Supports wide range of LAN configurations via Distinct
    TCP/IP runtime stack.
     
         Things you should know:
     
    -- Hardware:
    Cello needs a Windows 3.1-capable machine with enhanced mode
    and (preferably) swapping enabled.  It is hungry for extended RAM.
    -- Software:
    Cello depends (for now...we're working on a Winsock version) on the
    Distinct TCP/IP runtime stack.  The LII has licensed the use of a
    runtime version of this software for use by US academic institutions
    for a period of one year, starting June 1, after which we will
    renegotiate the license.  Commercial organizations and non-academic
    users are strongly urged to contact Distinct directly at
    mktg.distinct.com.
    
    The Distinct software adds enormous functionality to the package,
    including SLIP/PPP support with scripting, and configuration for
    many types of LAN and networking layers.
    We are working on a Winsock version which will be available
    without restriction later this summer.
     
    --How to get it:
    FTP to fatty.law.cornell.edu, the /pub/LII/Cello subdirectory.  The
    distribution is in multiple files.  At a minimum, you will need
     
     README.1ST, which contains unpacking instructions.
     CELLO.ZIP, which contains the executable and Help application
     DIS.ZIP, which contains the runtime stack.
     
    Optionally, you should also get:
     
    VIEWERS.ZIP, which contains a graphics viewer and sound player for
    use with Cello.
     
    GSWIN.ZIP, which contains the Windows version of GhostScript.
     
    PLEASE NOTE that fatty is but an humble little Sparc and you can
    bring it to its knees fairly easily, so if you have another source
    for
    the GhostScript stuff please spare me and everyone else by going to
    the alternate source; the file is 2+ MB.
     
    Installation:
    Installation is performed by following the instructions in
    README.1ST, then using the online help.  Additional support is
    available from a listserv list called appropriately enough CELLO-L.
    To subscribe, send a message to listserv@fatty.law.cornell.edu with
    the one-liner:
     
             sub cello-l your full name
     
    in the body of the message.  cello-l is watched by the developer and
    by a few folks who graciously assisted in alpha testing and who
    know more about the software's treacherous behavior than its
    author; the listowner is Will Sadler at Indiana University Law
    School.
     
    We are also working on an archive of installation hints and tricks.
    Please try to take it easy on comp.infosystems.www; Tim already has
    too much to deal with (grin).
     
    Who'n'heck are these guys?:
     
    The Legal Information Institute, operating under the auspices of the
    Cornell Law School, is an entity set up to distribute legal
    information
    in hypertextual form by various means, including the Net.  Since
    there wasn't a Web client for the platform used most by lawyers and
    legal academics, we took it into our (ill-advised) heads to write
    one.
     
    This is it, almost.  For further information:
    lii@fatty.law.cornell.edu.
     
    Regards,
    Tb.
    
  • Nicholas Allen's Indigo Blog

    Silverlight 2 Beta 2

    • 0 Comments

    A promised Beta 2 was released later last week. In this case, later meant Friday after everyone went home so I updated the original article with a link to the download over the weekend. That means this doesn't count as the post for today. Scott Guthrie has a more detailed release announcement for the beta if you're interested.

  • Nicholas Allen's Indigo Blog

    Forwarding Transactions

    • 1 Comments

    I want to receive messages that contain a transaction and forward those messages to another service. How do I configure WCF to accept transactions without executing the service method under a transaction?

    In normal transactional messaging processing you would use the TransactionScopeRequired attribute to declare your interest in having a transaction. By setting TransactionScopeRequired to true, you are requesting a guarantee that a transaction scope exists when the service method is executed. If you've also set the TransactionFlow attribute to true and the sender flowed a transaction with the message, then that flowed transaction would be used to construct the transaction scope. Otherwise, a new transaction would be created before your service method is invoked.

    In this case you want the behavior of supporting a flowed transaction without actually creating the transaction scope. By setting TransactionScopeRequired to false, you are requesting that the service method not be provided with a transaction scope. However, you can still set TransactionFlow to true to allow the sender to flow a transaction with the message. This gives you the flowed transaction to forward to another service without creating unwanted transaction scopes. The incoming messages will include a TransactionMessageProperty if you want to access the flowed transaction.

    Next time: Tracing Network Calls

  • Nicholas Allen's Indigo Blog

    Improving Web Services Security Beta Guide

    • 1 Comments

    The WCF Security Guide content that I've mentioned a few times before is now done with early drafts and has been rolled up into a beta release of the full book. There's a ton of content in the real thing on top of what you've been seeing in the drafts.

    You can download the beta of the full security guide from CodePlex now.

    If you want to know what I think about the guide, here's the foreword I wrote for them:

    The computer industry has come to a realization – based on many years of slowly learning from painful experiences – that computer networks are hostile environments. Nevertheless, computer users demand as part of their basic expectations that applications take advantage of the ubiquitous and continuously available connectivity at their disposal to deliver a rich connected experience.

    It is now your task to design and assemble the loosely coupled service components that you have available in a way that blunts threats and thwarts attacks on the user’s precious assets. Your applications must withstand the hazards of living in a hostile networked environment. To make that possible, you must understand the risks that your applications face and you must be certain that the remedies you put in place properly mitigate the dangers of those risks.

    As someone who has been through several rounds of security and threat modeling for Windows Communication Foundation, I can say without hesitation that knowledge and experience are your greatest assets for designing secure Web service applications. The trick is to gain as much of that knowledge as possible from the painful experiences of other people rather than painful experiences of your own.

    J.D. Meier and team have done a fantastic job of assembling and digesting countless practical experiences into a convenient and centralized resource. Practitioners of service-oriented development with WCF will want to use this guide as both a means of learning about the fundamentals of Web service security and a reference for getting specific, step-by-step instructions for dozens of the most common security problems. I enjoy that this guide collects together several different approaches for learning about and implementing security solutions. By combining a variety of formats – scenarios, how-to articles, and guidelines are only a sample of the offered modes – solutions are both reinforced and made more easily discoverable through different entry points.

    The reason that I’m so excited to see Improving Web Services Security: Scenarios and Implementation Guidance for WCF is that having a secure system has become such a deep and pervasive requirement that security has to be treated as part and parcel of functionality. Having the Guide to make WCF security understandable and accessible adds value to the WCF platform by improving its usability as a whole. I highly recommend this book to anyone involved in the development, deployment, or management of WCF applications. This book has something of value for you whether it is read end to end or consumed tactically in parts to solve a specific problem. Security is too intrinsically important to pass up this aid to your success.

  • Nicholas Allen's Indigo Blog

    Silverlight 2 Beta 2 Coming

    • 0 Comments

    At TechEd yesterday the next beta release of Silverlight 2 was announced to come out later this week.

    In Beta 2 you'll be much closer to seeing the complete subset of WCF that has been ported to the Silverlight platform. In particular, the work we've done around JSON, configuration, extensibility, and adherence to the general WCF client programming model will be ready for you to play with. All of this functionality has been packed down into an extremely small download size to meet the goals of Silverlight. You'll also be getting a better WCF experience thanks to improvements to the underlying network stack that we've been able to take advantage of.

    You can get the download in pieces for the SDK, runtime, and other components; or, you can get it all in one package using the link below. 

  • Nicholas Allen's Indigo Blog

    Quotas for Copying Messages

    • 1 Comments

    Is it possible to copy a very large message? The CreateBufferedCopy method of Message requires a quota parameter that is only integer sized.

    There has always been a direct way around the problem of copying messages, which is that any message allows you to run it through an XmlReader or XmlWriter, depending on the convenience of your perspective. The XML APIs allow you to synchronously pull limitless amounts of content at your leisure, although they optionally can enforce quotas as well.

    The XML approach is somewhat painful though as running a message through a null loop to create a new copy requires much more careful coding than a method that is directly designed to stamp out copies. The XML approach also, while not implying any performance disadvantage, negates any potential performance advantage that might be gained by cleverly optimizing the copy operation for a specific implementation of message.

    However, I'm willing to take the interpretation that the quota of CreateBufferedCopy refers to the largest buffer that the copy may allocate rather than the largest message that the copy may represent. This is an important distinction because I may be able to represent a message that is much larger than I could hold in memory. For example, the message may be backed by a non-memory store or be algorithmically generated. The essence of a streamed message is that the message object in memory is much smaller than the message itself. Of course, none of the message implementations that I know of today decouple the representation size and message buffer size, but that doesn’t preclude an implementation like that existing in the future.

    Next time: Forwarding Transactions

  • Nicholas Allen's Indigo Blog

    Managed Services Engine June CTP

    • 2 Comments

    I'm a big fan of using service virtualization to solve a variety of problems with developing and managing web services. The Managed Services Engine is a solution built on top of WCF to supply a repository-based runtime and management tool for service virtualization. I hope to someday put the solutions team out of business by making service virtualization easier to do in the product. For now though, the Managed Services Engine is one of the better web service virtualization systems that I've seen. You can get their new June CTP on CodePlex, which replaces the previous beta release from last October.

    The latest information about the Managed Services Engine can be found in the list of supporting technologies.

Page 1 of 1 (22 items)