Mark Fussell's WebLog

More on Dublin and Windows Server.

mfussell — Wed, 29 Oct 2008 03:54:00 GMT

Here are a links to a couple of videos about Dublin.

Ron Jacobs has posted a video of a Dublin PDC Hands on Labs (HOL) on Endpoint TV here. This provides an introduction to deploying WCF and WF applications to Dublin, managing .NET workflows running on the server and showing some of the configuration support. This is a good first intro and of course there are many other features that I will cover in blog entries over the next few weeks.

Need more on Dublin? John Bristowe and the esteemed Canadian crew, pulled some of the product team together (myself, Miguel Susffalich and John Taylor) for an impromtu interview here at PDC on what Dublin provides for developers and why you should be interested in its capabilites if you currently develop, or plan to develop, WCF and WF applications and put them into production within your company.

Back up for air at PDC2008 with Dublin

mfussell — Tue, 28 Oct 2008 02:07:00 GMT

I haven't written in my blog for a long time, well over two years. Sometimes you just loose the momentum! Now I am at PDC which is like a big school reunion and better still can talk about the product that I have been working on for the last two years, Dublin. Dublin is the set of server capabilities to make Windows a server for WCF and WF applications and integrated into the Application Server role in Windows Server.

Ok, so what does Dublin do for me? In the same way the the Visual Studio Expressions suite crossed the web designer to the developer divide, by allowing these two roles to be closely integrated, Dublin crosses the developer to the IT pro divide by enabling apps created by developers to be handed off to IT managers, who then have a common set of tools to manage these WCF and WF business apps. Dublin provides a configured hosting environment with databases for persistence state and tracking, enterprise services for reliability, scale-out and monitoring, along with a set of tools integrated into IIS Manager that enable you to manage your WCF and WF applications.I will post some screen shots and go more in depth to the feature set that Dublin provides over the next fews days.

So if you are around at PDC, come and find me under the big Dublin balloon for some tech talk.

Car Anti-Innovation

mfussell — Fri, 26 May 2006 10:55:00 GMT

Here is an interesting fact that I read in the latest edition of the BBC Wildlife magazine which I thought summed up the car industry's attitude to fuel.

"US cars average 20.8 mpg. The Model T Ford managed 25mpg, the Ford Explorer SUV does 16mpg".

That's nearly 100 years of innovation! But, I can remotely eject 15 cupholders and flip down 5 TV screens from my car key fob.

So you want to learn WSE 3.0? A short primer on how and where to start.

mfussell — Fri, 26 May 2006 09:49:00 GMT

A question that I often get asked is - How do I get started learning about WSE 3.0 and what considerations need to be made when building secure Web services?

So I have put together some essential steps to help get you started on the road with WSE 3.0 along with some estimated times. I have also included some projects to spark ideas that you can build, because in the end that is the only true way to learn.

1) First go to the WSE Home Page here

Download the WSE 3.0 SDK and read the documentation introduction

Run each of the WSE Quickstarts samples and look through the code.

Work through the two detailed WSE 3.0 Hands on Labs (HOLs)

Exploring Security

Exploring Messaging

Total time - 2 days

2) Then go to the Patterns and Practices Home Page here

Read the Scenarios, Patterns, and Implementation Guidance for Web Services Enhancements (WSE) 3.0

Walk through the Web Service Security Guidance Quickstarts

Listen to the Web Casts for the Web Service Security on the same page

Total time - 3 days

3) Then return to the WSE Home Page and read the following articles

Read “What's New in Web Services Enhancements 3.0“

Read “Protect Your Web Services Through The Extensible Policy Framework In WSE 3.0 “

Total time - 1 day

4) And if you still need more listen to the Ron Jacobs Arc Casts on WSE 3.0

http://channel9.msdn.com/Shows/ARCast_with_Ron_Jacobs

Total time - 1 day if you are insane, spread over 1 week for mortals

Need some ideas? Here are some projects to build with WSE 3.0

Secure your existing Web services! Easy one this.
Get a finger print reader and using the fingerprint SDK create your own custom fingerprint XML token type. Now you can authenticate to a Web service using your fingerprint, rather than a having to use password or a certificate.
Using the examples in the messaging hands on lab (HOL) implement the SMTP protocol and use this to securely post messages to a Web service. The interesting aspect here is that this is a store and forward scenario which does not have to have a permanent connection. This is a classic case where message level security is a suitable technology choice.
Integrate with AzMan and ADAM for application level authorization and authentication.
Set up a web service at work called "15 minutes of Fame" with a spare big screen monitor in the hallway for all to see. Write a service to give everyone in your group 15 minutes of fame with timeslots that they can book, securely of course. If you use Kerberos or X509 certificates for security (use the former if you have Active Directory) offer a prize for anyone who can hack the site to change the message on the screen (no access to the box allowed of course) Sit back an relax knowing that your prize is safe.

MapCruncher - A seriously cool map mashup creation tool

mfussell — Fri, 26 May 2006 09:19:00 GMT

I went to a talk today on the newly released MapCuncher tool and was awed by its capabilities and posibilities. In a nutshell this tools enable you to take any map (PDF, bitmap etc), load up MSN Virtual Earth and then plot points between the two. After a minimum of 5-10 points it can nearly perfectly superimpose the two of top of each other. You are then able to generate a bunch of javascript and HTML files which can be published to any web site. The end result is that in a matter of 30 minutes to an hour you are able to generate your own dynamic, interactive maps which are superimposed on the satellite images from Virtual Earth.

Now, if you really want to see the route of that bike trail you can trace it exactly over the satellite image. Or if you take a national park map you can see the exact route of the hiking trail into the mountains. It is simply phenonenal given the simplicity of its use.

The site has several examples, but my favorites were how the developers, who are avid fliers, took their own digital photos out of an airplane window and then published aerial versions then those that already existed for a city called Forks in Washington state. The other MS internal one superimposed floor plans for MS Campus buildings onto Virtual Earth. We were left to consider how this technology can easily enable companies to not only show you the store that your item is in, but exacly the shelf and location in the store. A dream if you have ever visited a Fry's superstore to try an hunt down some elusive piece of computer equipment.

I expect to see a large number of mashup sites now given the extreme simplicity of this tool. Now I just need to dig out some electronic maps and get to work!

WSE 3.0 in June 2006 MSDN Magazine

mfussell — Wed, 24 May 2006 11:07:00 GMT

Great to see Aaron continuing to give WSE 3.0 love in his Service Station column. Now I just have to finish my "WCF for WSE Developers" article which keeps looking back at me half finished from my desk as a pile of scribbled notes. Currently I am attempting to churn out the security conceptual documentation for WCF along with Gudge and Jan, so you can blame/praise us for the final version. Suffice to say that there is plenty to explain given that security is a sprawling topic :-)

Biztalk WSE 3.0 Adapter Ships

mfussell — Wed, 24 May 2006 10:21:00 GMT

Jesus Rodriguez with Two Connect has filled the last gaping need for WSE 3.0 by delivering a Biztalk 2006 adapter which you can get here. We did a webcast together with Jesus doing a bunch of great demos to show off its capabilities. You can watch the webcast here.

The feature that has saved me many times with customers is the easy with which you can configure the WSE 3.0 policy pipeline processing. For example at the end of last week I faced a mail from a customer who wanted to do CertificateOverTransport secure communication between a WSE 3.0 client and a WCF service. Think a variant of UsernameOverCertificate. Although WCF has this feature built in through configuration it is not one of the pre-defined standard policy assertions shipped with WSE 3.0. No matter, we pulled out the code for the custom policy assertion from the WSE 3.0 SDK, added an X509 certificate to the message, signed with it and it just worked. WSE 3.0 is great like that, easy to adapt with a simple API.

So what has this got to do with the Biztalk WSE 3.0 adapter? The reason why this adapter is significant is that Biztalk 2006 is the best product for business integration and orchestration and you can deploy web services today using Biztalk. If you do, this is the adapter to use to provide a smooth upgrade and interoperability to WCF later. Jesus shows how the WSE 3.0 adapter can be easily used with custom policy processing as one of his many examples and certainly could have done my customer case with this Biztalk adapter. I have spoken to several MS field personnel who desperately need the WSE 3.0 adapter with Biztalk 2006.

I should also point out that WSE 2.0 SP3 is supported as a runtime component on .NET 2.0, which means that the WSE 2.0 Biztalk adapter (which has just shipped a Service Pack SP1) can also be used with Biztalk 2006. However WSE 2.0 SP3 will not interoperate with WCF services, almost entirely due to the differences in the WS-Addressing specification between these products.

Jesus, the WSE 3.0 adapter is a superb piece of work. I recommend that you to listen to the webcast here and download it here

WCF Loves ATLAS and the Windows Live Development Center

mfussell — Wed, 22 Mar 2006 09:06:00 GMT

Two great pieces of Web development were announced today. Steve posted his work on getting WCF and the ATLAS development environment aligned. The significance of this is that it shows the spectrum of capabilities of WCF from simple REST services, through AJAX supoprt to the feature rich WS-* protocols. Expect WCF to be the fundamental plumbing in many MS products over the next few years.

The other announcement was the availability of Windows Live developer center. Now you can start to more easily builld Web applications using Windows Live services.

WSE 3.0 - Kerberos, Secure Conversation and Stateful SCTs

mfussell — Wed, 08 Mar 2006 09:08:00 GMT

I thought that I would publish some discussion threads on WSE issues that I have had recently that highlight some common questions. A recent discussion question was this;

Question: "I need advice with WSE 3.0 and implementing a web service that requires a Kerberos token. It seems that my simple web service and Windows client should be straight-forward but I’m not able to get past the error “Security requirements are not satisfied because the security header is not present in the incoming message. System.Exception {System.InvalidOperationException}

Here is the client policy file. The server one is nearly identical:

<policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">
<extensions>
    <extension name="kerberosSecurity" type="Microsoft.Web.Services3.Design.KerberosAssertion, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
    <extension name="requireActionHeader" type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
    <extension name="kerberos" type="Microsoft.Web.Services3.Design.KerberosTokenProvider, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
</extensions>
<policy name="KerberosClient">
    <kerberosSecurity establishSecurityContext="true" renewExpiredSecurityContext="true" requireSignatureConfirmation="false" messageProtectionOrder="SignBeforeEncrypt" requireDerivedKeys="true" ttlInSeconds="300">
      <token>
        <kerberos targetPrincipal="host/MyServer" impersonationLevel="Impersonation" />
      </token>
      <protection>
        <request signatureOptions="IncludeAddressing, IncludeTimestamp, IncludeSoapBody" encryptBody="false" />
        <response signatureOptions="IncludeAddressing, IncludeTimestamp, IncludeSoapBody" encryptBody="false" />
        <fault signatureOptions="IncludeAddressing, IncludeTimestamp, IncludeSoapBody" encryptBody="false" />
      </protection>
    </kerberosSecurity>
    <requireActionHeader />
</policy>
</policies>"

Answer: It turns our that there are times when secure conversation and Kerberos can clash. When establishSecurityContext is set to true in the policy files (see above), then WSE 3.0 tries to acquire a Security Content Token (SCT) from the service to establish a secure conversation. The Request Security Context (RST) message sent from the client to acquire the SCT using the policy above uses a KerberosToken to protect the message so that only the service can decrypt the message. By default, WSE 3.0 generates stateful SCT’s (see Stateful Session section in this link) which means that the state of the SCT is carried with the SCT itself as a cookie value in the message. This state contains the server's KerberosToken inside of it, which you can see by looking for the <cookie> element in the SCT.

Since Kerberos Tokens can *only* ever be used once, using this stateful SCT doesn’t work. This is because every time the client makes a request to the service, it protects the message with that SCT, which carries the state with it. But because this state has a "use once" KerberosToken, the request fails at the server.

There are two options to work around this:
1) Don’t use SCT’s at all and hence do not use Secure Conversation. You can do this by setting establishSecurityContext to false in the policy file at both the client and the service.
2) Use SCT’s (i.e. establishSecurityContext set to true) but turn off stateful SCT by setting statefulSecurityContextToken to false inside <microsoft.web.services3> of web.config. e.g.

</tokenIssuer>

This can also be done on the Message tab in the WSE Configuration Settings available from the VS2005 Solution Explorer context menu.

1) Has the disadvantage of not taking advantage of the performance improvement of using secure conversation when the number of messages is >2. However you may only send a single message and therefore not require secure conversation, which is fine.

2) Is a better option as it still allow secure conversation (where messages are >2) and works because the SCT state is no carried with the message and simply cached on the server side. The one difference is that you can no longer use secure conversation in web farms, but you can still use Kerberos on web farms at a slight performance decrease. If you really need the performance improvement in a web farm scenario using Kerberos Token using secure conversation, then you need to maintain your own state on the server i.e. implement your own SCT cache using something like a SQL database as described in Managing Security Context Tokens in a Web Farm.

I will post more common discussion threads like this over the next few months. It is also worth sending questions to the Web Services Forum which we monitor on a regular basis

New WSE 3.0 Content

mfussell — Wed, 08 Mar 2006 08:52:00 GMT

Plenty of content continues to get produced for WSE 3.0. Working with Ron Jacobs and Don Smith we produced some ARCasts on WSE and X509 certs that you can be listen to here. All of Ron's ARCasts make avid listening to, especially in the car on the way to work (download and burn onto a CD). You can also find kerberos versions published here with username and password best practices usage coming soon.

Next month in the April 2006 MSDN magazine Aaron Skonnard has a great article on WSE 2.0 to WSE 3.0 migration. Combine this with the WSE 3.0 docs and this migration video sets you up well to understand how to migrate your code.

WSE 3.0 Webcasts and MSDN Articles

mfussell — Tue, 17 Jan 2006 03:47:00 GMT

Don Smith has posted links to some WSE 3.0 webcasts based on the WS-Security patterns and practices work that I have helped him with. We already have done a webcast on WSE 3.0 and X509 certificates usage which you can watch here with more to follow in the next two weeks. Read Don's posting for the details.

Also last month's and this month's MSDN magazine has plenty of WSE 3.0 content. There is Aaron Service Station article and Tomasz Janczuk, who is the developer lead for WSE 3.0, wrote a great article on the policy framework in WSE 3.0.

Tomasz and I also work together on WCF security (WSE is in fact owned by the WCF security feature team, so we ship multiple products) and what is interesting about this article is the description of the security header layouts in the message. When you start to use WSE and WCF as products you are in effect working with an API that enables you to generate messages that contain a <security> header element in a SOAP message according to the WS-Security (1.0 and 1.1), WS-Trust and WS-SecureConversation specifications. How these specifications are interpreted into messages on the wire is complex, especially to achieve interoperability across platforms. That is why the turnkey security scenarios introduced into WSE 3.0 and aligned with WCF simplify security by choosing preconfigure security header layouts in the SOAP message. These in turn come from reading the WS-SecurityPolicy spec to describe how the headers are built from assertions. In effect reading this article essentially gives you insight into not only the structure of WSE 3.0 messages but, also WCF messages where the turnkey scenarios overlap between the products.

Web Service Security Patterns and Practices

mfussell — Fri, 11 Nov 2005 11:29:00 GMT

The PAG guys (Jason Hogg, Don Smith) have been getting some great WSE 3.0 Security content together. I suggest that you download this and spend some time with it. It will all carry you through to WCF, so this is long term knowledge on message level security.

What next?

mfussell — Fri, 11 Nov 2005 11:05:00 GMT

Now that I have shipped WSE 3.0, a year to the day that I started on the project, a number of people have asked me, "What's next to fill the empty WSE void?" Well, WSE has always been very closely aligned with the security team in Windows Communication Foundation (WCF aka Indigo), so that is the natural place for me. Effectively I now work on getting the security features done in WCF, but I will still be writing WSE articles. The one that I have planned is "WCF for WSE 3.0 Developers" to help with the mental mapping between the two products.

WSE 3.0 and MSDN TV

mfussell — Fri, 11 Nov 2005 10:26:00 GMT

I did this MSDN TV piece on WSE 3.0. Enjoy.

WSE 3.0 Docs now on MSDN

mfussell — Fri, 11 Nov 2005 10:23:00 GMT

You can find them here. There is always more information that we would like to have in the documentation and so we are expecting to do a WSE 3.0 documentation refresh on MSDN at the start of December. Hence if you want the latest information it is usually best to look online.

Final Version of WSE 3.0 Released to MSDN

mfussell — Tue, 08 Nov 2005 00:59:00 GMT

WSE 3.0 has just been released to MSDN to coincide with the launch of Visual Studio 2005. You can find it here. The Readme is here

It was pretty tough getting this released to be on the same day, but we really wanted to ensure that the time difference between WSE 3.0 and VS2005 was as small as possible so that you could start building secure web services on the latest standards today that are also interoperable with Windows Communication Foundation (WCF). I have started to compile a set of WSE resource links, but there is plenty of content on the WSE home page.

There a significant paradigm shift when using WSE 3.0 compared to WSE 2.0 and to help with this the WSE Hands On Labs (HOLs) have been completely re-written. These were done by Aaron Skonnard and Keith Brown and are a great
starting point to understand the capabilities of this release. Most people use these HOLs to start off understanding the capabilities of WSE. We split the labs into Basic and Advanced labs to make it clearer when you are most likely to use a given feature. The examples that Aaron created showing how to plug new Transports into the WSE extensiblity model are extremely good. The labs can be found here;

WSE 3.0 Messaging Hands On Lab

WSE 3.0 Security Hands On Lab

I also update the "What's New in WSE 3.0" article for this release, so that the code and names were accurate. On the whole most of this article has stayed the same, which is good as it shows the original design goals at the start of the public CTP releases were solid.

We are going to create plenty more content for WSE 3.0 over the next few months. Tomasz Janczuk, who is the dev lead on WSE 3.0, has written a great article on how to implement your own security policies that will appear in the January 2006 issue of MSDN magazine (due out in Dec 2005). I am working on a WCF <-> WSE 3.0 interoperability article which includes "Understanding WCF for WSE Developers" which you should expect toward the end of this year. If you want a quick overview of the relationship between WSE 3.0 and WCF, I did a short MSDN TV on WSE 3.0 overview so you can watch me in person!

If you have further suggestions for articles or comments on the WSE 3.0 release I would love to hear from you. Enjoy this great release of WSE 3.0.

Want PDC?

mfussell — Tue, 25 Oct 2005 11:05:00 GMT

Then see here in all its glory.

What's happening with WSE 3.0

mfussell — Thu, 20 Oct 2005 07:54:00 GMT

If you look at the Web Services Developer Center at the moment you will see that the headlines are all on WSE 3.0 with articles from Keith Brown and Niels Flensted-Jensen as well as the latest and final Oct CTP release. The WSE team has been heads down for the last month busy cranking to get the bugs down, writing samples and articles, doing stress and performance runs, getting new versions of the hands on labs together, sign-off from external customer's applications and a myriad of other jobs. WSE 3.0 is going to launch at the same time as Visual Studio 2005 in November which is very soon. These are some of my favorite features that we have closed on in the last few weeks;

Integrated with ClickOnce - This was a big ask from the customer product feedback center and now WSE 3.0 is intergrated with ClickOnce. This enables you to either deploy just the WSE 3.0 runtime dll with your application or you can deploy the WSE 3.0 runtime MSI that will run when you install your application. I should also make it clear that you are also free to redistribute the WSE 2.0 and WSE 3.0 runtime dlls with your application by whatever means you desire, be that a batch file or your own setup tool.
Usability tweaks to the WSE Configuration Tool - It is amazing how small things help. One painful thing I kept doing was creating my own security token managers, particulary UsernameTokenManagers and everytime I had to dig out the namespace URL value and cut and paste this into the config file in order to override the default UsernameTokenManager. It was tedious and error prone. Now we have added these namespace values to the dropdown list on the Security tab and voila, life is much easier when providing your own one. But there's more - the ability to select from any of the certificate stores in the policy wizard (it was fixed to a single store previously), the ability to choose certificate revocation and caching modes and better descriptions for the "turnkey security scenarios" have all improved the tooling experience.
Performance. WSE 3.0 on .NET 2.0 is approximately 30% faster on message throughout (messages per second) than WSE 2.0 on .NET 1.1. Enough said. We will published the full numbers a month or so after shipping the final version of WSE 3.0.
Interoperability. WSE 3.0 is fully interoperable with the forthcoming WCF Beta 2 release. We have been working on this one for a while fixing issues on both sides. We have also done testing against the latest version of IBM's WebSphere and have achieved interoperabilty here however there are still tests to work through, but it looks good.
Docs and Samples. I have been especially busy here getting these together. Plenty more samples all with VB.NET versions have been added. With docs we also plan to have regular MSDN updates after the product ships, so this is really your best source of information.
64bit. WSE 3.0 runs like a treat on 64 bit machines (and this is native, not in WOW) and in many of the security scenarios we have been observing significantly improved performance throughput compared to 32 bit machines. Roughly this is looking like a 40% increase currently!
Stress - We have had WSE 3.0 stress runs running for over 4 weeks with hundreds of thousands of concurrent requests with nearly insignificant memory leaks for a long time now. Of course we need to do this on the final build of .NET v2.0 but currently it is looking to be a reliable product.
Security Review - Believe me that you have to have a lot of drink once you get sign-off on this from the security initiative. I did.

Hopefully this has given you some insight into the "shipping end game" for WSE 3.0. It is looking to be a great release and certainly it is setting the standard for ease of use when building secure, distributed applications with Web services.

Greatest people voted for by their nation

mfussell — Wed, 29 Jun 2005 11:08:00 GMT

Four lists to compare of the greatest people voted for by their nation. I will let you interpret the national differences based upon these choices.

Top 10 greatest Britons

1. Churchill
2. Brunel
3. Diana
4. Darwin
5. Shakespeare
6. Newton
7. Lennon
8. Elizabeth I
9. Nelson
10. Cromwell

Top 10 greatest Americans

1 Ronald Reagan

2 Abraham Lincoln

3 Martin Luther King

4 George Washington

5 Benjamin Franklin

6 George W Bush

7 Bill Clinton

8 Elvis Presley

9 Oprah Winfrey

10 Franklin D Roosevelt

Top 10 greatest French

Military and political leader Charles de Gaulle

Nobel Prize-winning physicist Marie Curie

Chemist and microbiology pioneer Louis Pasteur

Comedian Coluche

Prolific comic actor and singer Bourvil

Poet and novelist Victor Hugo

17th century playwright Molière

Singer Edith Piaf

Undersea explorer Jacques Cousteau

Jesuit priest Abbé Pierre, a poverty activist who also helped Jews escape from the Nazis

Top 10 Greatest Canadians
1 Tommy Douglas
2 Terry Fox
3 Pierre Elliott Trudeau
4 Sir Frederick Banting
5 David Suzuki
6 Lester B. Pearson
7 Don Cherry
8 Sir John A. Macdonald
9 Alexander Graham Bell
10 Wayne Gretzky

Get WSE 3.0 and WS-ReliableMessaging

mfussell — Tue, 28 Jun 2005 00:14:00 GMT

George is a dev/architect who has spent over eight months building a complete implementation of WS-ReliableMessaging to run on WSE 3.0. The fruits of his labour are an extensive reference example that can be downloaded from here. It persists messages to SQL Server and supports both direct (both ends up, available and connected) and queued ( neither end has to be available when the message is sent) approaches to reliable messaging.

WS-RM will not be part of the WSE 3.0 product, however this implementation shows you how to build reliable messaging into your application and being source code you can extend this as much as you want. Hearing feedback on issues and bugs with this implementation is always desired and the WSE newsgroup or WebServices Forum are the best places to do this.

What's New in WSE 3.0 MSDN Article

mfussell — Sat, 25 Jun 2005 10:03:00 GMT

I have written an article on What is New for WSE 3.0 which has now been posted on the Web Services Developer Center. This is written against the June CTP release so functionality will change before final RTM at the end of the year. Over the next few months I will post short snippets of interest on aspects of WSE 3.0 and as always it would be good to hear your opinions. The next CTP is scheduled for mid July, with a Beta 1 release in August.

System.Xml v2 Articles posted by Alex Homer

mfussell — Wed, 22 Jun 2005 10:47:00 GMT

Alex has written two good overview articles on System.Xml in .NET v2.0 - part 1 on the XmlReader and part 2 on the XmlWriter.

Anders Hejlsberg on XML and Programming Languages

mfussell — Tue, 14 Jun 2005 10:36:00 GMT

One good reason to sign up for PDC 2005 is to hear Anders elaborate more on this work

.NET 2.0 XML Perf Comparison with Sun

mfussell — Tue, 14 Jun 2005 09:50:00 GMT

As presented in my article on System.Xml Beta 1 (which was effectively re-written into the Beta 2 version of my System.Xml book) the #1 feature in the .NET 2.0 release for System.Xml was performance. In the past Sun has come out bashing the XML performance support in .NET 1.1 which I wrote about here. Now all has been vindicated officially with an XML performance comparison report between .NET 2.0 Beta2, .NET 1.1, and Sun Java 1.5 Platforms. Simply by looking at the bar charts, in the majority of scenarios .NET 2.0 Beta 2 was twice as fast as the Sun implementation when parsing XML. Superb!

Furthermore here is a comparison article for Web Services performance between .NET 2.0 Beta 2, .NET 1.1, Sun JWSDP 1.5 and IBM WebSphere 6.0. Of course these numbers were helped by the improvements in System.Xml. Now that I work on the WSE team we are also applying the perf love on higher level services such as XML digtial signature and WS-Security. However for those people who ask whether WSE 3.0 will be based on the XmlReader and XmlWriter for the pipeline processing, I am afraid that this is not going to happen. WSE is fundamentally XmlDocument (XML DOM) based and it is too much to move this to a stream based API in the 3.0 release. However the memory working set in WSE 3.0 has been improved substantially and when using MTOM combined with the ASMX pipeline and HTTP, it is possible to stream binary data from a service onto the network stream effeciently.

Now we just need to complete the performance comparison work by having an up-to-date face-off with the latest XSTL processors using the XSLTMark benchmark and the .NET 2.0 XslCompiledTransform class

WSE 3.0 Released on MSDN

mfussell — Fri, 03 Jun 2005 23:55:00 GMT

Having spent the last few months getting WSE 3.0 built, it is now live on MSDN here. This includes new Messaging and Security Hands on Labs (HOLs) to get you started on the new features. Next week there will be a WSE 3.0 overview article on MSDN

To provide feedback and suggestions on this WSE 3.0 release use the MSDN Product Feedback Center using the WSE product category.

To get support and ask questions on WSE 3.0 use the MSDN Web Services Forum

For those of you who are at TechEd 2005 next week I will be camped out at CSI cabana so come and find me and give me feedback on on WSE.

Enjoy.

New Features for Version 3.0

The introduction of Turnkey Security Scenarios that provide high level security building blocks that enable you to secure messaging patterns (such as request/response) rather than having to consider how to secure the request and response independently. These Turnkey Security Scenarios, otherwise known as security assertions, are best practices when securing end to end messages.
Improved Policy Framework

The Policy format has been simplified to reflect the Turnkey Security Scenarios. Policy still allows configuration-based declaration of security requirements for incoming and outgoing SOAP messages, but now concentrates on where to get the security tokens from based upon the chosen security assertion.
CLR attribute based programming. Policy files can now be associated with a client proxy or a service via a Policy attribute i.e. [Policy("ServerPolicy")]
Imperative and declarative programming models for policy have been aligned to provide uniform programming abstractions. In WSE 2.0 there was no correlation between the code written to secure a message exchange and declarative policy files. In WSE 3.0 through the use of the CLR Policy attribute and the SetPolicy method on WSE generated client proxies (via Visual Studio's Add Web Reference) policy files can now be used in code to secure a client or a service.
Policy also allows significant extensibility mechanisms for user-defined policies in code. By extending the Microsoft.Web.Services3.Design.PolicyAssertion class to create your own policy assertion, custom transformations of the SoapEnvelope can be performed at any stage in the pipeline. For example this enables you to define a logging assertion or have a policy assertion that enforces specified XML schemas for message validation. The same assertion can then be used in the declarative policy file.
An updated Security Settings Wizard that helps secure an application by generating a policy. The Security Settings Wizard also now reflects the Turnkey Security Scenarios when securing an application and walks you through the best choice of Policy assertion based upon your chosen security deployment.

ASP.NET Web services, otherwise known as ASMX Web services, can now be hosted outside of IIS, for example in console applications or NT services and called with the TCP/IP protocol. The existing lightweight, message-oriented, SOAP programming model SoapSender/ SoapReceiver classes remain.
Support for the W3C MTOM Recommendation to enable large amounts of binary data to be sent efficiently and securely.
Improved session management when using WS-SecureConversation and Security Context Tokens (SCTs). SCTs can now contain the original client authentication token when sent from the client to the service, which enable sessions to be re-established if lost e.g. when a service's appdomain is reset. This provides reliability for the session and enables sessions to be used in web farm scenarios.
WS-SecureConversation sessions can now be cancelled explicitly.
Integrated tool support with Visual Studio 2005 Beta 2. The WSE 3.0 configuration tool can be accessed via the context menu on the Visual Studio 2005 Solution Explorer.
Support for 64 bit runtime.
Support for updated Web services specifications including WS-Addressing, WS-Security, WS-Trust, and WS-SecureConversation.
Updated QuickStart samples.