http://blogs.msdn.com/jmeier/archive/tags/My+Projects/default.aspxTags: My Projectsen-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.msdn.com/jmeier/archive/2009/02/10/my-projects-on-msdn.aspxTue, 10 Feb 2009 22:51:14 GMT91d46819-8472-40ad-a661-2c78acb4018c:9411189J.D. Meier5http://blogs.msdn.com/jmeier/comments/9411189.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=9411189<p>This post is a simple way to browse the bulk of my patterns &amp; practices work on MSDN and CodePlex.&#160;&#160; After I walk customers through things, the next question is usually, &quot;OK, so where do we find this?&quot;&#160; This is the link I'll be sharing.</p> <p><strong>Guides</strong></p> <ul> <li><a href="http://www.codeplex.com/AppArchGuide" target="_blank">Application Architecture Guide 2.0</a> (CodePlex) </li> <li><a href="http://msdn.microsoft.com/en-us/library/aa302415.aspx" target="_blank">Building Secure ASP.NET Applications</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998530.aspx" target="_blank">Improving .NET Application Performance and Scalability</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms994921.aspx" target="_blank">Improving Web Application Security: Threats and Countermeasures</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949034.aspx" target="_blank">Improving Web Services Security: Scenarios and Implementation Guidance for WCF</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb924375.aspx" target="_blank">Performance Testing Guidance for Web Applications</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998382.aspx" target="_blank">Security Engineering Explained</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668991.aspx" target="_blank">Team Development with Visual Studio Team Foundation Server</a> </li> </ul> <p><strong>Performance</strong> </p> <p><em>Books / Guides</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/ms998530.aspx" target="_blank">Improving .NET Application Performance and Scalability</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb924375.aspx" target="_blank">Performance Testing Guidance for Web Applications</a> </li> </ul> <p><em>Methods</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/bb924361.aspx" target="_blank">Agile Performance Testing</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb924372.aspx" target="_blank">Load Testing</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998579.aspx" target="_blank">Measuring Performance</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb924367.aspx" target="_blank">Modeling Application Usage</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998574.aspx" target="_blank">Performance Code Inspection</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998544.aspx" target="_blank">Performance Design Inspection</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998534.aspx" target="_blank">Performance Engineering</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998537.aspx" target="_blank">Performance Modeling</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb924371.aspx" target="_blank">Performance Test Reporting</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb924356.aspx" target="_blank">Performance Testing</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb924374.aspx" target="_blank">Stress Testing</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998583.aspx" target="_blank">Tuning Performance</a> </li> </ul> <p><em>Guidelines</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/ms998537.aspx" target="_blank">Performance Design Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998547.aspx" target="_blank">.NET Framework Performance Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998551.aspx" target="_blank">.NET Interop Performance Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998569.aspx" target="_blank">ADO.NET Performance Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998549.aspx" target="_blank">ASP.NET Performance Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998565.aspx" target="_blank">Remoting Performance Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998541.aspx" target="_blank">Web Application Performance Design Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998562.aspx" target="_blank">Web Services Performance Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998559.aspx" target="_blank">XML Performance Guidelines</a> </li> </ul> <p><em>Checklists</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/ms998592.aspx" target="_blank">Performance Design Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979052.aspx" target="_blank">.NET Framework Performance Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998589.aspx" target="_blank">ADO.NET Performance Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998596.aspx" target="_blank">ASP.NET Performance Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms978923.aspx" target="_blank">Enterprise Services Performance Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms978943.aspx" target="_blank">Interop Performance Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979159.aspx" target="_blank">Remoting Performance Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979169.aspx" target="_blank">SQL Server Performance Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979173.aspx" target="_blank">Web Services Performance Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979180.aspx" target="_blank">XML Performance Checklist Checklist</a> </li> </ul> <p><em>Practices at a Glance</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/ms998512.aspx" target="_blank">Performance Practices at a Glance</a> </li> </ul> <p><em>How Tos</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/ms979195.aspx" target="_blank">How To - Optimize SQL Indexes</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979196.aspx" target="_blank">How To - Optimize SQL Queries</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979197.aspx" target="_blank">How To - Page Records in .NET Applications</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979198.aspx" target="_blank">How To Performance Capacity Planning for .NET Applications</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979200.aspx" target="_blank">How To - Submit and Poll for Long-Running Tasks</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms979204.aspx" target="_blank">How To - Use Custom Performance Counters from ASP.NET</a> </li> </ul> <p><strong>Security</strong> </p> <p><em>Guides</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/aa302415.aspx" target="_blank">Building Secure ASP.NET Applications</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms994921.aspx" target="_blank">Improving Web Application Security: Threats and Countermeasures</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998404.aspx" target="_blank">Security Engineering</a> </li> </ul> <p><em>Methods</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/ms998364.aspx" target="_blank">Security Code Inspection</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998367.aspx" target="_blank">Security Deployment Inspection</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/aa302421.aspx" target="_blank">Security Design Inspection</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms978516.aspx" target="_blank">Threat Modeling</a> </li> </ul> <p><em>Threats and Countermeasures</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/aa302418.aspx" target="_blank">Threats and Countermeasures for Web Applications</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949001.aspx" target="_blank">Threats and Countermeasures for Web Services</a> </li> </ul> <p><em>Cheat Sheets</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/ms978518.aspx" target="_blank">Web Application Security Frame</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949070.aspx" target="_blank">Web Services Security Frame</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949070.aspx" target="_blank">Web Services Security Patterns</a> </li> </ul> <p><em>Guidelines</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/aa480477.aspx" target="_blank">.NET Framework Security Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998264.aspx" target="_blank">ADO.NET Security Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998258.aspx" target="_blank">ASP.NET Security Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949068.aspx" target="_blank">WCF Security Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/aa302420.aspx" target="_blank">Web Application Security Design Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949020.aspx" target="_blank">Web Services Security Design Guidelines</a> </li> </ul> <p><em>Checklists</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/aa480474.aspx" target="_blank">.NET Framework Security Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/aa480473.aspx" target="_blank">ADO.NET Security Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998249.aspx" target="_blank">ASP.NET Security Checklist</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949052.aspx" target="_blank">WCF Security Checklist</a> </li> </ul> <p><em>Practices at a Glance</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/aa480479.aspx" target="_blank">.NET Framework Security Practices at a Glance</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998372.aspx" target="_blank">ASP.NET Security Practices at a Glance</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949062.aspx" target="_blank">WCF Security Practices at a Glance</a> </li> </ul> <p><em>Questions and Answers</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/bb981440.aspx" target="_blank">ASP.NET Security Questions and Answers</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949043.aspx" target="_blank">WCF Security Questions and Answers</a> </li> </ul> <p><em>Explained</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/aa480476.aspx" target="_blank">ASP.NET Forms Authentication Explained</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/aa480475.aspx" target="_blank">ASP.NET Windows Authentication Explained</a> </li> </ul> <p><em>Application Scenarios</em> </p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/cc949093.aspx" target="_blank">WCF Intranet Scenario - Web to Remote WCF Using Transport Security (Original Caller, TCP)</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949089.aspx" target="_blank">WCF Intranet scenario - Web to Remote WCF Using Transport Security (Trusted Subsystem, HTTP)</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949041.aspx" target="_blank">WCF Intranet Scenario - Web to Remote WCF Using Transport Security (Trusted Subsystem, TCP)</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949032.aspx" target="_blank">WCF Intranet Scenario - Windows Forms to Remote WCF Using Transport Security (Original Caller, TCP)</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949024.aspx" target="_blank">WCF Internet Scenario - WCF and ASMX Client to Remote WCF Using Transport Security (Original Caller, HTTP)</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949088.aspx" target="_blank">WCF Internet Scenario - Web to Remote WCF Using Transport Security (Trusted Subsystem, TCP)</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949050.aspx" target="_blank">WCF Internet Scenario - Windows Forms Client to Remote WCF Using Message Security (Original Caller, HTTP)</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/aa302385.aspx" target="_blank">ASP.NET Intranet Scenarios</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/aa302386.aspx" target="_blank">ASP.NET Extranet Scenarios</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/aa302387.aspx" target="_blank">ASP.NET Internet Scenarios</a> </li> </ul> <p><em>ASP.NET Security How Tos</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/ms998300.aspx" target="_blank">How To - Connect to SQL Server Using SQL Authentication in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998292.aspx" target="_blank">How To - Connect to SQL Server Using Windows Authentication in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998297.aspx" target="_blank">How To - Create a Service Account for ASP.NET Applications</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/aa480478.aspx" target="_blank">How To - Improve Security When Hosting Multiple Applications</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998325.aspx" target="_blank">How To - Instrument ASP.NET Applications for Security</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998274.aspx" target="_blank">How To - Prevent Cross-Site Scripting in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998310.aspx" target="_blank">How To - Protect Forms Authentication in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb355989.aspx" target="_blank">How To - Protect from Injection Attacks in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998271.aspx" target="_blank">How To - Project from SQL Injection Attacks in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998331.aspx" target="_blank">How To - Use ADAM for Roles in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998336.aspx" target="_blank">How To - Use Authorization Manager (AzMan) in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998360.aspx" target="_blank">How To - Use Forms Authentication with Active Directory in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998345.aspx" target="_blank">How To - Use Forms Authentication with Active Directory in Multiple Domains</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998317.aspx" target="_blank">How To - Use Forms Authentication with SQL Server in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998306.aspx" target="_blank">How To - Use Health Monitoring in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998351.aspx" target="_blank">How To - Use Impersonation and Delegation in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998355.aspx" target="_blank">How To - Use Protocol Transition and Constrained Delegation in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998267.aspx" target="_blank">How To - Use Regular Expressions to Constrain Input in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998320.aspx" target="_blank">How To - Use the Network Services Account to Access Resources in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998314.aspx" target="_blank">How To - Use Role Manager in ASP.NET</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/ms998358.aspx" target="_blank">How To - Use Windows Authentication in ASP.NET 2.0</a> </li> </ul> <p><em>WCF Security How Tos</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/cc949006.aspx" target="_blank">How to: Audit and Log Security Events in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949011.aspx" target="_blank">How to: Create and Install Temporary Certificates in WCF for Message Security During Development</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949067.aspx" target="_blank">How to: Create and Install Temporary Certificates in WCF for Transport Security During <br />Development</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949057.aspx" target="_blank">How to: Create and Install Temporary Client Certificates in WCF During Development</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949080.aspx" target="_blank">How to: Host WCF in a Windows Service Using TCP</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949013.aspx" target="_blank">How to: Impersonate the Original Caller in WCF Calling from a Web Application</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949055.aspx" target="_blank">How to: Impersonate the Original Caller in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949075.aspx" target="_blank">How to: Perform Input Validation in WCF</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949095.aspx" target="_blank">How to: Perform Message Validation with Schema Validation in WCF</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949012.aspx" target="_blank">How to: Use basicHttpBinding with Windows Authentication and TransportCredentialOnly in WCF from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc948997.aspx" target="_blank">How to: Use Certificate Authentication and Message Security in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949005.aspx" target="_blank">How to: Use Certificate Authentication and Transport Security in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949014.aspx" target="_blank">How to: Use Delegation for Flowing the Original Caller Credentials to the Back End in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949048.aspx" target="_blank">How to: Use Health Monitoring to Instrument a WCF Service for Security</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949092.aspx" target="_blank">How to: Use netTcpBinding with Windows Authentication and Message Security in WCF from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949091.aspx" target="_blank">How to: Use netTcpBinding with Windows Authentication and Transport Security in WCF from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949022.aspx" target="_blank">How to: Use Protocol Transition for Impersonating and Delegating the Original Caller in WCF</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949027.aspx" target="_blank">How to: Use the SQL Server Role Provider with Username Authentication in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949054.aspx" target="_blank">How to: Use the SQL Server Role Provider with Windows Authentication in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949082.aspx" target="_blank">How to: Use Username Authentication with the SQL Server Membership Provider and Message Security in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949025.aspx" target="_blank">How to: Use Username Authentication with Transport Security in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949010.aspx" target="_blank">How to: Use wsHttpBinding with Username Authentication and TransportWithMessageCredential in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949030.aspx" target="_blank">How to: Use wsHttpBinding with Windows Authentication and Message Security in WCF Calling from Windows Forms</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/cc949017.aspx" target="_blank">How to: Use wsHttpBinding with Windows Authentication and Transport Security in WCF Calling from Windows Forms</a> </li> </ul> <p><strong>Visual Studio Team System</strong></p> <p><em>Guides</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/bb668991.aspx" target="_blank">Team Development with Visual Studio Team Foundation Server</a> </li> </ul> <p><em>Guidelines</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/bb668941.aspx" target="_blank">Team Build Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668944.aspx" target="_blank">Source Control Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668943.aspx" target="_blank">Reporting Guidelines</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668942.aspx" target="_blank">Project Management Guidelines</a> </li> </ul> <p><em>Practices at a Glance</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/bb668945.aspx" target="_blank">Team Build Practices at a Glance</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668948.aspx" target="_blank">Source Control Practices at a Glance</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668947.aspx" target="_blank">Reporting Practices at a Glance</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668946.aspx" target="_blank">Project Management Practices at a Glance</a> </li> </ul> <p><em>Questions and Answers</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/bb668950.aspx" target="_blank">Source Control Practices at a Glance</a> </li> </ul> <p><em>How Tos</em></p> <ul> <li><a href="http://msdn.microsoft.com/en-us/library/bb668968.aspx" target="_blank">How To: Add a New Developer to Your Project in Visual Studio 2005 Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668977.aspx" target="_blank">How To: Automatically Run Code Analysis with Team Build in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668978.aspx" target="_blank">How To: Create a Custom Report for Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668979.aspx" target="_blank">How To: Create a &#8220;Risk over Time&#8221; Report for Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668980.aspx" target="_blank">How To: Create Custom Check-in Policies in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668981.aspx" target="_blank">How To: Create Your Source Tree in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668982.aspx" target="_blank">How To: Customize a Process Template in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668983.aspx" target="_blank">How To: Customize a Report in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668988.aspx" target="_blank">How To: Manage Projects in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668969.aspx" target="_blank">How To: Migrate Source Code to Team Foundation Server from Visual Source Safe</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668976.aspx" target="_blank">How To: Perform a Baseless Merge in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668971.aspx" target="_blank">How To: Set Up a Continuous Integration Build in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668975.aspx" target="_blank">How To: Set Up a Scheduled Build in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668986.aspx" target="_blank">How To: Structure ASP.NET Applications in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668994.aspx" target="_blank">How To: Structure Windows Applications in Visual Studio Team Foundation Server</a> </li> <li><a href="http://msdn.microsoft.com/en-us/library/bb668992.aspx" target="_blank">How To: Structure Your Source Control Folders in Team Foundation Server</a> </li> </ul> <p><strong>My Related Posts</strong></p> <ul> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/03/04/patterns-and-practices-complete-catalog.aspx">patterns &amp; practices Complete Catalog</a> </li> </ul><img src="http://blogs.msdn.com/aggbug.aspx?PostID=9411189" width="1" height="1">patterns and practicesMy Projectshttp://blogs.msdn.com/jmeier/archive/2008/10/27/new-release-patterns-practices-app-arch-guide-2-0-beta-1.aspxTue, 28 Oct 2008 01:24:23 GMT91d46819-8472-40ad-a661-2c78acb4018c:9019239J.D. Meier16http://blogs.msdn.com/jmeier/comments/9019239.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=9019239<div class="noprint" style="float: right; margin: 2px"><img title="AppArchGuidev2" style="display: inline" height="172" alt="AppArchGuidev2" src="http://blogs.msdn.com/blogfiles/jmeier/WindowsLiveWriter/NewReleasepatternspracticesAppArc.0Beta1_D893/AppArchGuidev2_thumb.gif" width="132" border="0" /> </div> <p>Today we released our <a href="http://www.codeplex.com/AppArchGuide" target="_blank">patterns &amp; practices App Arch Guide 2.0 Beta 1</a>.&#160; This is our guide to help solution architects and developers make the most of the Microsoft platform.&#160; It's a distillation of many lessons learned.&#160; It’s principle-based and pattern-oriented to provide a durable, evolvable backdrop for application architecture.&#160; It's a collaborative effort among product team members, field, industry experts, MVPs, and customers.&#160; Keep in mind it’s Beta so there’s still moving parts and we’re processing quite a bit of feedback across the guide.&#160; Now’s the time to bang on it. </p> <p><strong>5 Parts</strong></p> <ul> <li>Part I, “Fundamentals” </li> <li>Part II, “Design” </li> <li>Part III, “Layers” </li> <li>Part IV, “Quality Attributes” </li> <li>Part V, “Archetypes – Design and Patterns” </li> </ul> <p><strong>Chapters</strong></p> <ul> <li>Chapter 1 - Fundamentals of Application Architecture </li> <li>Chapter 2 - .NET Platform Overview </li> <li>Chapter 3 - Application Archetypes </li> <li>Chapter 4 - Deployment Patterns </li> <li>Chapter 5 - Arch Styles </li> <li>Chapter 6 - Quality Attributes </li> <li>Chapter 7 - Layers and Tiers </li> <li>Chapter 8 - Designing Your Architecture </li> <li>Chapter 9 - Architecture and Design Guidelines </li> <li>Chapter 10 - Designing Services </li> <li>Chapter 11 - Communication Guidelines&#160; </li> <li>Chapter 12 - Presentation Layer Guidelines </li> <li>Chapter 13 - Business Layer Guidelines </li> <li>Chapter 14 - Data Access Layer Guidelines </li> <li>Chapter 15 - Service Layer Guidelines </li> <li>Chapter 16 - Performance Engineering </li> <li>Chapter 17 - Security Engineering </li> <li>Chapter 18 - Mobile Application </li> <li>Chapter 19 - Office Business Application (OBA) </li> <li>Chapter 20 - Rich Client Application </li> <li>Chapter 21 - Rich Internet Application (RIA) </li> <li>Chapter 22 - Service Archetype </li> <li>Chapter 23 - SharePoint LOB Application </li> <li>Chapter 24 - Web Application </li> </ul> <p><strong>Key Scenarios <br /></strong>The guide helps you address the following scenarios:</p> <ul> <li>Choose the right architecture for your application. </li> <li>Choose the right technologies </li> <li>Make more effective choices for key engineering decisions. </li> <li>Map appropriate strategies and patterns. </li> <li>Map relevant patterns &amp; practices solution assets. </li> </ul> <p><strong>Key Features</strong></p> <ul> <li><strong>Canonical app frame</strong> - describes at a meta-level, the tiers and layers that an architect should consider. Each tier/layer is described in terms of its focus, function, capabilities, common design patterns and technologies. </li> <li><strong>App Types</strong>.&#160; Canonical application archetypes to illustrate common application types.&#160; Each archetype is described in terms of the target scenarios, technologies, patterns and infrastructure it contains. Each archetype will be mapped to the canonical app frame. They are illustrative of common app types and not comprehensive or definitive. </li> <li><strong>Arch Frame</strong> - a common set of categories for hot spots for key engineering decisions. </li> <li><strong>Quality Attributes</strong> - a set of qualities/abilities that shape your application architecture: performance, security, scalability, manageability, deployment, communication, etc. </li> <li><strong>Principles, patterns and practices</strong> - Using the frames as backdrops, the guide overlays relevant principles, patterns, and practices. </li> <li><strong>Technologies and capabilities</strong> - a description/overview of the Microsoft custom app dev platform and the main technologies and capabilities within it. </li> </ul> <p><strong>Conceptual Framework <br /></strong>At a high level, the guide is based on the following conceptual framework for application architecture:</p> <p><a href="http://blogs.msdn.com/blogfiles/jmeier/WindowsLiveWriter/NewReleasepatternspracticesAppArc.0Beta1_D893/ArchMetaFrame2_2.gif"><img title="ArchMetaFrame2" style="border-top-width: 0px; display: inline; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" height="259" alt="ArchMetaFrame2" src="http://blogs.msdn.com/blogfiles/jmeier/WindowsLiveWriter/NewReleasepatternspracticesAppArc.0Beta1_D893/ArchMetaFrame2_thumb.gif" width="450" border="0" /></a> </p> <p><strong>Reference Application Architecture <br /></strong>We used the following reference application architecture as a backdrop for explaining how to design effective layers and components:</p> <p><a href="http://blogs.msdn.com/blogfiles/jmeier/WindowsLiveWriter/NewReleasepatternspracticesAppArc.0Beta1_D893/RefAppArch_2.gif"><img title="RefAppArch" style="border-top-width: 0px; display: inline; border-left-width: 0px; border-bottom-width: 0px; border-right-width: 0px" height="427" alt="RefAppArch" src="http://blogs.msdn.com/blogfiles/jmeier/WindowsLiveWriter/NewReleasepatternspracticesAppArc.0Beta1_D893/RefAppArch_thumb.gif" width="350" border="0" /></a> </p> <p><strong>Key Links</strong></p> <ul> <li><a href="http://www.codeplex.com/AppArchGuide" target="_blank">Application Architecture Guide 2.0 – The Book</a> (CodePlex) </li> <li><a href="http://www.codeplex.com/AppArch" target="_blank">Application Architecture Guide 2.0 – Knowledge Base</a> (CodePlex) </li> </ul> <p><strong>Core Dev Team</strong></p> <ul> <li>J.D. Meier , Alex Homer, David Hill, Jason Taylor, Prashant Bansode , Lonnie Wall, Rob Boucher, Akshay Bogawat </li> </ul> <strong>Contributors / Reviewers</strong> <br /> <ul> <li><strong>Test team</strong>: Rohit Sharma, Praveen Rangarajan </li> <li><strong>Edit team</strong>: Dennis Rea. </li> <li><strong>External Contributors/Reviewers</strong>. Adwait Ullal; Andy Eunson; Christian Weyer; David Guimbellot; David Weller; Derek Greer; Eduardo Jezierski; Evan Hoff; Gajapathi Kannan; Jeremy D. Miller; Kent Corley; Mark Baker; Paul Ballard; Norman Headlam; Ryan Plant; Sam Gentile; Udi Dahan </li> <li><strong>Microsoft Contributors / Reviewers.</strong> Ade Miller; Anoop Gupta; Bob Brumfield; Brad Abrams; Brian Cawelti; Bhushan Nene; Burley Kawasaki; Carl Perry; Chris Keyser; Chris Tavares; Clint Edmonson; David Hill; Denny Dayton; Diego Dagum; Dmitri Martynov; Dmitri Ossipov; Don Smith; Dragos Manolescu; Elisa Flasko; Eric Fleck; Erwin van der Valk; Faisal Mohamood; Francis Cheung; Gary Lewis; Glenn Block; Gregory Leake; Ilia Fortunov; J.R. Arredondo; John deVadoss; Joseph Hofstader; Koby Avital; Loke Uei Tan; Mehran Nikoo; Michael Puleio; Mike Walker; Mubarak Elamin; Nick Malik; Nobuyuki Akama; Ofer Ashkenazi; Pablo Castro; Pat Helland; Phil Haack; Reed Robison; Rob Tiffany; Ryno Rijnsburger; Scott Hanselman; Serena Yeoh; Srinath Vasireddy; Tom Hollander; Wojtek Kozaczynski </li> </ul> <p><strong>My Related Posts</strong></p> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/09/02/patterns-practices-app-arch-guide-2-0-project.aspx">patterns &amp; practices App Arch Guide 2.0 Project</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/09/26/app-arch-guide-2-0-overview-slides.aspx">App Arch Guide 2.0 Overview Slides</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/09/24/abstract-for-application-architecture-guide-2-0.aspx">Abstract for Application Architecture Guide 2.0</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/09/03/app-arch-meta-frame.aspx">App Arch Meta-Frame</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/09/18/app-types.aspx">App Types</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/09/22/architecture-frame.aspx">Architecture Frame</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/09/11/guidelines-are-live.aspx">App Arch Guidelines</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/09/07/layers-and-components.aspx">Layers and Components</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/09/17/key-software-trends.aspx">Key Software Trends</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/10/09/cheat-sheet-patterns-practices-catalog-at-a-glance-posted-to-codeplex.aspx">Cheat Sheet: patterns &amp; practices Catalog at a Glance Posted to CodePlex</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/10/21/cheat-sheet-patterns-practices-pattern-catalog-posted-to-codeplex.aspx">Cheat Sheet: patterns &amp; practices Pattern Catalog Posted to CodePlex</a></li><img src="http://blogs.msdn.com/aggbug.aspx?PostID=9019239" width="1" height="1">patterns and practicesMy ProjectsAppArchhttp://blogs.msdn.com/jmeier/archive/2008/06/19/wcf-security-guide-is-now-available-in-html.aspxThu, 19 Jun 2008 05:07:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:8619805J.D. Meier2http://blogs.msdn.com/jmeier/comments/8619805.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=8619805<p>Our guide, <a href="http://www.codeplex.com/WCFSecurityGuide" target="_blank">patterns &amp; practices Improving Web Services Security:Scenarios and Implementation Guidance for WCF</a> is now available in HTML.</p><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8619805" width="1" height="1">SecurityMy ProjectsWCFhttp://blogs.msdn.com/jmeier/archive/2008/06/04/new-release-patterns-practices-wcf-security-guide-beta.aspxWed, 04 Jun 2008 23:01:12 GMT91d46819-8472-40ad-a661-2c78acb4018c:8573905J.D. Meier3http://blogs.msdn.com/jmeier/comments/8573905.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=8573905<p>Today we released our WCF Security guide, <a href="http://www.codeplex.com/WCFSecurityGuide" target="_blank">patterns &amp; practices Improving Web Services Security: Scenarios and Implementation Guidance for WCF</a>.&nbsp; This is our Microsoft playbook for Windows Communication Foundation (WCF - "Indigo".)&nbsp; It shows you how to build secure Web services using WCF.&nbsp; It's a compendium of proven practices, product team recommendations and insights from the field. <p><strong>Download the guide</strong> <ul> <li><a href="https://www.codeplex.com/Release/ProjectReleases.aspx?ProjectName=WCFSecurityGuide&amp;ReleaseId=14070" target="_blank">Download the Guide</a></li></ul> <p><strong>Contents at a Glance</strong></p> <ul> <li>Part I, "Security Fundamentals for Web Services"</li> <li>Part II, "Fundamentals of WCF Security"</li> <li>Part III, "Intranet Application Scenarios"</li> <li>Part IV, "Internet Application Scenarios" </li></ul> <p><strong>Chapters</strong></p> <ul> <li>Ch 01 - Security Fundamentals for Web Services</li> <li>Ch 02 - Threats and Countermeasures for Web Services</li> <li>Ch 03 - Security Design Guidelines for Web Services </li> <li>Ch 04 - WCF Security Fundamentals</li> <li>Ch 05 - Authentication, Authorization and Identities in WCF</li> <li>Ch 06 - Impersonation and Delegation in WCF</li> <li>Ch 07 - Message and Transport Security in WCF</li> <li>Ch 08 - WCF Bindings Fundamentals </li> <li>Ch 09 - Intranet – Web to Remote WCF Using Transport Security (Original Caller, TCP)</li> <li>Ch 10 - Intranet – Web to Remote WCF Using Transport Security (Trusted Subsystem,HTTP)</li> <li>Ch 11 - Intranet – Web to Remote WCF Using Transport Security (Trusted Subsystem TCP)</li> <li>Ch 12 - Intranet – Windows Forms to Remote WCF Using Transport Security (Original Caller, TCP) </li> <li>Ch 13 - Internet – WCF and ASMX Client to Remote WCF Using Transport Security (Trusted Subsystem, HTTP)</li> <li>Ch 14 - Internet – Web to Remote WCF Using Transport Security (Trusted Subsystem, TCP)</li> <li>Ch 15 - Internet – Windows Forms Client to Remote WCF Using Message Security (Original Caller, HTTP) </li></ul> <p><strong>Reference</strong></p> <ul> <li>WCF Security Checklist</li> <li>WCF Security Guidelines</li> <li>WCF Security Practices at a Glance</li> <li>WCF Questions and Answers (Q&amp;A)</li> <li>How Tos</li> <li>WCF Security Resources</li></ul> <p><strong>Contributors and Reviewers </strong></p> <ul> <li><strong>External</strong>: Andy Eunson; Anil John; Anu Rajendra; Brandon Bohling; Chaitanya Bijwe; Daniel Root; David P. Romig, Sr.; Dennis Rea; Kevin Lam; Michele Bustamante; Parameswaran Vaideeswaran; Rockford Lotka; Rudolph Araujo; Santosh Bejugam </li> <li><strong>Microsoft</strong>: Alik Levin; Brandon Blazer; Brent Schmaltz; Curt Smith; David Bradley; Dmitri Ossipov; Don Smith; Jan Alexander; Jason Hogg; Jason Pang; John Steer; Marc Goodner; Mark Fussell; Martin Gudgin; Martin Petersen-Frey; Mike de Libero; Mohammad Al-Sabt; Nobuyuki Akama; Ralph Squillace; Richard Lewis; Rick Saling; Rohit Sharma; Scott Mason; Sidd Shenoy; Sidney Higa; Stuart Kwan; Suwat Chitphakdibodin; T.R. Vishwanath; Todd Kutzke; Todd West; Vijay Gajjala; Vittorio Bertocci; Wenlong Dong; Yann Christensen; Yavor Georgiev </li></ul><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8573905" width="1" height="1">SecurityMy ProjectsWCFhttp://blogs.msdn.com/jmeier/archive/2008/05/09/patterns-practices-wcf-security-practices-at-a-glance-now-available.aspxFri, 09 May 2008 23:53:27 GMT91d46819-8472-40ad-a661-2c78acb4018c:8481995J.D. Meier3http://blogs.msdn.com/jmeier/comments/8481995.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=8481995<p>For this week's release in our <a href="http://www.codeplex.com/WCFSecurity" target="_blank">patterns &amp; practices WCF Security Guidance project,</a> we released our first version of our <a href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Practices%20at%20a%20Glance" target="_blank">WCF Security Practices at a Glance</a>.&nbsp; Practices At a Glance gives you a bird's-eye view of how to perform common tasks.&nbsp; They are scannable and outcome-driven so that you can quickly browse the problem/solution pairs.&nbsp; Rather than a laundry list of granular tasks, we organize them by our Web Services Security frame (still evolving.) <p><strong>Categories<br></strong>Here's how we grouped our WCF Security Practices at a Glance so far: <ul> <li><strong>Auditing and Logging</strong></li> <li><strong>Authentication</strong></li> <li><strong>Authorization</strong></li> <li><strong>Configuration Management</strong></li> <li><strong>Deployment Considerations</strong></li> <li><strong>Exception Management</strong></li> <li><strong>Hosting</strong></li> <li><strong>Impersonation/Delegation </strong></li> <li><strong>Input Validation</strong></li> <li><strong>Message Security </strong></li> <li><strong>Proxy Considerations </strong></li> <li><strong>Sensitive Data</strong></li> <li><strong>Transport Security</strong></li></ul> <p>Here's a snapshot of the problems solved from our Practices At a Glance, but you can see our answers explained at our WCF Security Guidance project site. </p> <p><strong>Auditing and Logging</strong> </p> <ul> <li><em>How to audit authentication events</em></li> <li><em>How to audit authorization events</em></li> <li><em>How to enable WCF message logging</em></li> <li><em>How to enable WCF tracing</em></li> <li><em>How to use Health Monitoring in WCF </em></li> <li><em>How to view log information</em></li> <li><em>How to view trace information</em></li> <li><em>How to log traces to a WMI provider</em></li> <li><em>How to turn off audit failure suppression</em> </li></ul> <p><strong>Authentication</strong> </p> <ul> <li><em>How to authenticate users against the SQL Membership Provider</em></li> <li><em>How to authenticate users against Active Directory</em></li> <li><em>How to authenticate users against Active Directory without windows authentication</em></li> <li><em>How to authenticate users with certificates</em></li> <li><em>How to map certificates with windows accounts</em></li> <li><em>How to authenticate users against a custom user store</em></li> <li><em>How to authenticate users with Kerberos direct to support non-WCF clients with windows authentication</em> </li></ul> <p><strong>Authorization</strong> </p> <ul> <li><em>How to authorize imperatively</em></li> <li><em>How to authorize declaratively</em></li> <li><em>How to authorize users against Windows groups</em></li> <li><em>How to authorize users against Windows groups using the AspNetWindowsTokenRoleProvider</em></li> <li><em>How to authorize users against the SQL Role Provider</em></li> <li><em>How to authorize users against the ASP.Net Role Provider</em></li> <li><em>How to assign the current principal with IAuthorizationPolicy to allow authorization using custom authentication</em> </li></ul> <p><strong>Configuration Management</strong> </p> <ul> <li><em>How to encrypt sensitive data in your configuration files</em></li> <li><em>How to run your service under a specific identity</em></li> <li><em>How to create a service account for your WCF service</em></li> <li><em>How to stop clients from referencing your service</em></li> <li><em>How to protect against message replay attacks</em> </li></ul> <p><strong>Deployment Considerations</strong> </p> <ul> <li><em>How to configure certificates to enable SSL in IIS</em></li> <li><em>How to map Windows accounts with certificates</em></li> <li><em>How to create a Service Principle Name (SPN)</em></li> <li><em>How to configure WCF for NATs and Firewalls</em></li> <li><em>How to create an X.509 certificate</em> </li></ul> <p><strong>Exception Management</strong> </p> <ul> <li><em>How to shield exception information with fault contracts</em></li> <li><em>How to create an error handler to log details of faults for auditing purposes</em></li> <li><em>How to handle unhandled exceptions in downstream services</em></li> <li><em>How to throw an exception with complex types or data contracts with a fault exception</em></li> <li><em>How to handle unknown faults in a service </em></li> <li><em>How to implement a data contract to propagate exception details for debugging purposes</em></li> <li><em>How to implement fault contracts in call back functions</em> </li></ul> <p><strong>Hosting </strong></p> <ul> <li><em>How to host WCF in IIS</em></li> <li><em>How to host WCF in a Windows service</em></li> <li><em>How to self-host WCF</em></li> <li><em>How to configure a least-privilege account to host your service</em> </li></ul> <p><strong>Impersonation/Delegation</strong> </p> <ul> <li><em>How to choose between trusted subsystem and impersonation/delegation </em></li> <li><em>How to impersonate the original caller when using Windows authentication</em></li> <li><em>How to impersonate programmatically in WCF </em></li> <li><em>How to impersonate declaratively in WCF</em></li> <li><em>How to delegate the original caller to call backend services when using Windows authentication</em></li> <li><em>How to impersonate the original caller without Windows authentication</em></li> <li><em>How to impersonate the original caller using S4U Kerberos extensions.</em></li> <li><em>How to delegate the original caller using S4U Kerberos extensions.</em></li> <li><em>How to impersonate and delegate using LogonUser Windows API</em></li> <li><em>How to flow the original caller from an ASP.NET client to WCF</em></li> <li><em>How to control access to a remote resource based on the original callers identity.</em> </li></ul> <p><strong>Input Validation</strong> </p> <ul> <li><em>How to protect your service from malicious messages</em></li> <li><em>How to protect your service from malicious input</em></li> <li><em>How to protect your service from denial of service attacks</em></li> <li><em>How to validate parameters with parameter inspectors</em></li> <li><em>How to validate parameters with message inspectors using schemas</em></li> <li><em>How to validate data contracts with message inspectors using schemas</em></li> <li><em>How to validate message contracts with message inspectors using schemas</em></li> <li><em>How to use regular expressions validate format, range and length in schemas</em></li> <li><em>How to validate inbound messages on a service</em></li> <li><em>How to validate outbound messages on a service</em></li> <li><em>How to validate outbound messages on the client</em></li> <li><em>How to validate inbound messages on the client</em></li> <li><em>How to validate input parameters</em></li> <li><em>How to validate output parameters</em> </li></ul> <p><strong>Message Security</strong> </p> <ul> <li><em>How to use message security</em></li> <li><em>How to partially encrypt a message</em></li> <li><em>How to use out-of-band credentials with message security</em> </li></ul> <p><strong>Proxy Considerations</strong> </p> <ul> <li><em>How to avoid proxy spoofing</em></li> <li><em>How to expose service metadata for your clients</em></li> <li><em>How to create a proxy to a service hosted in IIS that requires certificate authentication and transport security</em> </li></ul> <p><strong>Sensitive Data</strong> </p> <ul> <li><em>How to encrypt sensitive data in configuration files</em></li> <li><em>How to protect sensitive data in memory</em></li> <li><em>How to protect sensitive data on the network</em> </li></ul> <p><strong>Transport Security</strong> </p> <ul> <li><em>How to use transport security</em></li> <li><em>How to use secure conversations in WCF</em> </li></ul> <p><strong>X.509 Certificates</strong> </p> <ul> <li><em>How to create a temporary X.509 certificate for transport security</em></li> <li><em>How to create a temporary X.509 certificate for message security</em></li> <li><em>How to create a temporary X.509 certificate for certificate authentication</em> </li></ul> <p><strong>My Related Posts</strong></p> <ul> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/05/01/6-new-patterns-practices-wcf-security-how-tos.aspx">6 New patterns &amp; practices WCF Security How Tos</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/25/patterns-practices-wcf-security-questions-and-answers-now-available.aspx">patterns &amp; practices WCF Security Questions and Answers Now Available</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/17/patterns-practices-wcf-3-5-security-guidelines-now-available.aspx">patterns &amp; practices WCF 3.5 Security Guidelines Now Available</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/11/patterns-practices-wcf-security-guidance-updated-application-scenarios.aspx">patterns &amp; practices WCF Security Guidance: Updated Application Scenarios</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/04/patterns-and-practices-wcf-security-application-scenarios.aspx">patterns &amp; practices WCF Security Application Scenarios</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/03/27/patterns-and-practices-wcf-security-guidance-now-available.aspx">patterns &amp; practices WCF Security Guidance Now Available</a></li></ul><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8481995" width="1" height="1">SecurityMy ProjectsWCFhttp://blogs.msdn.com/jmeier/archive/2008/05/01/6-new-patterns-practices-wcf-security-how-tos.aspxThu, 01 May 2008 23:12:44 GMT91d46819-8472-40ad-a661-2c78acb4018c:8447554J.D. Meier3http://blogs.msdn.com/jmeier/comments/8447554.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=8447554<p>We have 6 new How Tos for this week's release of our <a href="http://www.codeplex.com/WCFSecurity" target="_blank">patterns &amp; practices WCF Security Guidance Project</a>. <p><strong>WCF Security How Tos</strong> <ul> <li><a href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Perform%20Input%20Validation%20in%20WCF&amp;referringTitle=How%20Tos" target="_blank">How To - Perform Input Validation in WCF</a> <li><a href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Perform%20Message%20Validation%20with%20Schemas%20in%20WCF&amp;referringTitle=How%20Tos" target="_blank">How To - Perform Message Validation with Schemas in WCF</a> <li><a href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20basicHttpBinding%20with%20Windows%20Authentication%20and%20TransportCredentialOnly%20in%20WCF%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target="_blank">How To - Use basicHttpBinding with Windows Authentication and TransportCredentialOnly in WCF from Windows Forms</a> <li><a href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20Certificate%20Authentication%20and%20Message%20Security%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target="_blank">How To - Use Certificate Authentication and Message Security in WCF calling from Windows Forms</a> <li><a href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20netTcpBinding%20with%20Windows%20Authentication%20and%20Message%20Security%20in%20WCF%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target="_blank">How To - Use netTcpBinding with Windows Authentication and Message Security in WCF from Windows Forms</a> <li><a href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20wsHttpBinding%20with%20Username%20Authentication%20and%20TransportWithMessageCredential%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target="_blank">How To - Use wsHttpBinding with Username Authentication and TransportWithMessageCredential in WCF calling from Windows Forms</a></li></ul> <p>My Related Posts</p> <ul> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/25/patterns-practices-wcf-security-questions-and-answers-now-available.aspx">patterns &amp; practices WCF Security Questions and Answers Now Available</a> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/17/patterns-practices-wcf-3-5-security-guidelines-now-available.aspx">patterns &amp; practices WCF 3.5 Security Guidelines Now Available</a> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/11/patterns-practices-wcf-security-guidance-updated-application-scenarios.aspx">patterns &amp; practices WCF Security Guidance: Updated Application Scenarios</a> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/04/patterns-and-practices-wcf-security-application-scenarios.aspx">patterns &amp; practices WCF Security Application Scenarios</a> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/03/27/patterns-and-practices-wcf-security-guidance-now-available.aspx">patterns &amp; practices WCF Security Guidance Now Available</a></li></ul><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8447554" width="1" height="1">SecurityMy ProjectsWCFhttp://blogs.msdn.com/jmeier/archive/2008/04/25/patterns-practices-wcf-security-questions-and-answers-now-available.aspxFri, 25 Apr 2008 05:13:59 GMT91d46819-8472-40ad-a661-2c78acb4018c:8423239J.D. Meier4http://blogs.msdn.com/jmeier/comments/8423239.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=8423239<p>What are your key security-related questions with WCF?&nbsp; More importantly, what are the answers?&nbsp; For this week's release of our <a href="http://www.codeplex.com/WCFSecurity" target="_blank">WCF Security Guidance Project</a>, we posted our <a href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Questions%20and%20Answers&amp;referringTitle=Home" target="_blank">WCF Security Q&amp;A (Questions and Answers)</a> to CodePlex.&nbsp; <p>To create the questions and answers set, we first gathered and organized recurring questions from our field, support, customers and forums.&nbsp; We then worked through to create precise answers.&nbsp; What you get is a browsable collection of questions and answers, organized by our security frame.&nbsp;&nbsp; The security frame maps to actionable categories of your application. <p>Here's a snapshot of the questions from our Q&amp;A, but you can see our answers explained at our WCF Security Guidance project site. <p><strong>Design Considerations</strong> </p> <ul> <li><em>How do I decide on an authentication strategy?</em></li> <li><em>How do I decide on an authorization strategy?</em></li> <li><em>When should I use message security vs. transport security?</em></li> <li><em>How do I use my existing Active Directory infrastructure?</em></li> <li><em>What bindings should I use over the Internet?</em></li> <li><em>What bindings should I use over the Intranet?</em></li> <li><em>When should I use resource-based authorization vs. roles-based authorization?</em></li> <li><em>When should I impersonate the original caller?</em></li> <li><em>When should I flow the original caller’s identity to back-end resources?</em></li> <li><em>How do I migrate to WCF from an ASMX web service?</em></li> <li><em>How do I migrate to WCF from a COM application?</em></li> <li><em>How do I migrate to WCF from a DCOM application?</em></li> <li><em>How do I migrate to WCF from a WSE application?</em> </li></ul> <p><strong>Auditing and Logging</strong> </p> <ul> <li><em>What WCF Service security events should be logged?</em></li> <li><em>How do I enable logging and auditing in WCF?</em></li> <li><em>How do I enable auditing in WCF?</em></li> <li><em>How do I stop my service if there has been an auditing failure?</em></li> <li><em>How do I log important business events in WCF?</em></li> <li><em>How do I implement log throttling in WCF?</em></li> <li><em>How do I use Health Monitoring Feature with WCF?</em></li> <li><em>How do I protect my log files?</em></li> <li><em>How to I pass user identity information in a message for auditing purpose?</em> </li></ul> <p><strong>Authentication</strong> </p> <ul> <li><em>How do I decide on an authentication strategy in WCF?</em></li> <li><em>When should I use brokered authentication?</em></li> <li><em>When should I use the SQL Server Membership provider?</em></li> <li><em>How do I authenticate against Active Directory?</em></li> <li><em>How do I authenticate against a SQL store?</em></li> <li><em>How do I authenticate against a custom store?</em></li> <li><em>How do I protect passwords in my user store? </em></li> <li><em>How do I use certificate authentication with X.509 certificates?</em></li> <li><em>What is the most common authentication scenario for intranet applications?</em></li> <li><em>What is the most common authentication scenario for internet applications?</em></li> <li><em>How do I support authentication for multiple client types? </em></li> <li><em>What is federated security?</em></li> <li><em>How do I send credentials in the message when I am using transport security?</em></li> <li><em>How do I avoid cleartext passwords?</em> </li></ul> <p><strong>Authorization</strong> </p> <ul> <li><em>How do I decide on an authorization strategy in WCF?</em></li> <li><em>What’s the difference between resource-based, roles-based and claims-based authorization?</em></li> <li><em>How do I use Windows groups for role authorization in WCF?</em></li> <li><em>How do I use the SQL Role provider for ASPNET role authorization in WCF?</em></li> <li><em>How do I use the Windows Token role provider for ASPNET role authorization in WCF?</em></li> <li><em>How do I use the Authorization Store role provider for ASPNET role authorization in WCF?</em></li> <li><em>What’s the difference between declarative and imperative roles authorization?</em></li> <li><em>How do I restrict access to WCF operations to specific Windows users?</em></li> <li><em>How do I associate roles with a certificate?</em></li> <li><em>What is a service principle name (SPN)?</em></li> <li><em>How do I create a service principle name (SPN)?</em> </li></ul> <p><strong>Bindings</strong> </p> <ul> <li><em>What is a binding?</em></li> <li><em>What bindings are available?</em></li> <li><em>Which bindings are best suited for the Internet?</em></li> <li><em>Which bindings are best suited for the Intranet?</em></li> <li><em>How do I choose an appropriate binding? </em></li> <li><em>Configuration Management </em></li> <li><em>How do I encrypt sensitive data in WCF configuration file?</em></li> <li><em>How do I run a WCF Service with a particular identity?</em></li> <li><em>How do I create a service account for running my WCF Service?</em></li> <li><em>When should I use a configuration file versus the WCF object model?</em></li> <li><em>What is a metadata exchange (MEX) binding?</em></li> <li><em>How do I keep clients from referencing my service? </em></li></ul> <p><strong>Exception Management </strong></p> <ul> <li><em>How do I implement a global exception handler?</em></li> <li><em>What is a fault contract?</em></li> <li><em>How do I define a fault contract?</em></li> <li><em>How do I avoid sending exception details to the client?</em> </li></ul> <p><strong>Hosting </strong></p> <ul> <li><em>How do I configure a least privileged account to host my service?</em></li> <li><em>When should I host my service in IIS?</em></li> <li><em>When should I host my service in a Windows service?</em></li> <li><em>When should I self-host my service? </em></li> <li><em>Impersonation/Delegation </em></li> <li><em>What are my impersonation options?</em></li> <li><em>What is the difference between impersonation and delegation?</em></li> <li><em>How do I impersonate the original caller for an operation call?</em></li> <li><em>How do I temporarily impersonate the original caller in an operation call?</em></li> <li><em>How do I impersonate a specific (fixed) identity?</em></li> <li><em>What is constrained delegation?</em></li> <li><em>What is protocol transition?</em></li> <li><em>How do I flow original caller from ASP.NET client to WCF Service?</em></li> <li><em>What is the difference between declarative and programmatic impersonation?</em></li> <li><em>What is the trusted subsystem model?</em></li> <li><em>When should I flow the original caller to back-end code? </em></li> <li><em>How do I control access to a remote resource based on the original caller’s identity?</em> </li></ul> <p><strong>Input/Data Validation </strong></p> <ul> <li><em>How do I implement input and data validation in WCF?</em></li> <li><em>What is schema validation?</em></li> <li><em>What is parameter validation?</em></li> <li><em>Should I validate before or after message serialization?</em></li> <li><em>How do I protect my service from denial of service attacks?</em></li> <li><em>How do I protect my service from malicious input attacks?</em></li> <li><em>How do I protect my service from malformed messages? </em></li> <li><em>Message Protection </em></li> <li><em>When should I use message security?</em></li> <li><em>When should I use transport security?</em></li> <li><em>How do I protect my message when there are intermediaries routing my message?</em></li> <li><em>How do I protect my message when there are multiple protocols used during message</em></li> <li><em>transit?</em></li> <li><em>How do I implement partial message encryption?</em> </li></ul> <p><strong>Proxy Considerations</strong> </p> <ul> <li><em>When should I use a channel factory?</em></li> <li><em>When do I need to expose a metadata exchange endpoint for my service?</em></li> <li><em>How do I avoid proxy spoofing?</em> </li></ul> <p><strong>Sensitive Data </strong></p> <ul> <li><em>How do I protect sensitive data in configuration files?</em></li> <li><em>How do I protect sensitive data in memory?</em></li> <li><em>How do I protect my metadata?</em></li> <li><em>How do I protect sensitive data from being read on the wire?</em></li> <li><em>How do I protect sensitive data from being tampered with on the wire?</em></li> <li><em>How do I authenticate a message was sent by the expected sender?</em></li> <li><em>How do I encrypt data within my message?</em> </li></ul> <p><strong>X.509 Certificates</strong> </p> <ul> <li><em>How do I create X.509 certificates?</em></li> <li><em>Do I need to create a certificate signed by the root CA certificate?</em></li> <li><em>How do I use X.509 certificate revocation?</em></li> <li><em>How do I authenticate users with X.509 certificates, and then perform role-based access control using an Active Directory domain?</em> </li></ul> <p><strong>Deployment Considerations</strong> </p> <ul> <li><em>What are the additional considerations for using WCF in a webfarm?</em></li> <li><em>How do I configure WCF for NATs and Firewalls?</em></li> <li><em>How do I configure Active Directory groups and accounts for role-based authorization checks?</em></li> <li><em>How do I create an X.509 certificate?</em></li> <li><em>When should I use a Service Principle Name (SPN)?</em></li> <li><em>How do I configure a least privileged account for my service?</em> </li></ul> <p><strong>My Related Posts</strong></p> <ul> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/17/patterns-practices-wcf-3-5-security-guidelines-now-available.aspx">patterns &amp; practices WCF 3.5 Security Guidelines Now Available</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/11/patterns-practices-wcf-security-guidance-updated-application-scenarios.aspx">patterns &amp; practices WCF Security Guidance: Updated Application Scenarios</a> </li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/04/patterns-and-practices-wcf-security-application-scenarios.aspx">patterns &amp; practices WCF Security Application Scenarios</a> </li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/03/27/patterns-and-practices-wcf-security-guidance-now-available.aspx">patterns &amp; practices WCF Security Guidance Now Available</a></li></ul><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8423239" width="1" height="1">SecurityMy ProjectsWCFhttp://blogs.msdn.com/jmeier/archive/2008/04/17/patterns-practices-wcf-3-5-security-guidelines-now-available.aspxThu, 17 Apr 2008 18:38:33 GMT91d46819-8472-40ad-a661-2c78acb4018c:8403465J.D. Meier10http://blogs.msdn.com/jmeier/comments/8403465.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=8403465<p>For this week's release in our <a href="http://www.codeplex.com/WCFSecurity" target="_blank">patterns &amp; practices WCF Security Guidance project</a>, we released our first version of our <a href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Guidelines" target="_blank">WCF 3.5 Security Guidelines</a>.&nbsp; Each guideline is a nugget of what to do, why, and how.&nbsp; The goal of the guideline format is to take a lot of information, compress it down, and turn insight into action. <p>The downside is that it's tough to create prescriptive guidelines that are generic enough to be reusable, but specific enough to be helpful.&nbsp; The upside is that customers find the guidelines help them cut through a lot of information and take action.&nbsp; We contextualize the guidelines as much as we can, but ultimately you're in the best position to do the pattern matching to find which guidelines are relevant for your scenarios, and how you need to tailor them. <p>Here's a snapshot of the guidelines, but you can see our security guidelines explained at our WCF Security Guidance project site. <p><strong>Categories</strong><br>Our WCF Security guidelines are organized using the following buckets:</p> <ul> <li>Auditing and Logging </li> <li>Authentication </li> <li>Authorization </li> <li>Binding </li> <li>Configuration Management </li> <li>Exception Management </li> <li>Hosting </li> <li>Impersonation and Delegation </li> <li>Input/Data Validation </li> <li>Proxy Considerations </li> <li>Deployment considerations&nbsp; </li></ul> <p><strong>Auditing and Logging</strong> </p> <ul> <li>Use WCF auditing to audit your service</li> <li>If non-repudiation is important, consider setting SuppressAuditFailure property to false</li> <li>Use message logging to log operations on your service</li> <li>Instrument for user management events</li> <li>Instrument for significant business operations </li> <li>Protect log files from unauthorized access</li> <li>Do not log sensitive information </li></ul> <p><strong>Authentication </strong></p> <ul> <li>Know your authentication options</li> <li>Use Windows Authentication when you can</li> <li>If you support non-WCF clients using windows authentication and message security, consider using the Kerberos direct option</li> <li>If your users are in AD, but you can’t use windows authentication, consider using username authentication </li> <li>If your clients have certificates, consider using client certificate authentication</li> <li>If you need to streamline certificate distribution to your clients for message encryption, consider using the negotiate credentials option</li> <li>If your users are in a custom store, consider using username authentication with a custom validator</li> <li>If your users are in a SQL membership store, use the SQL Membership Provider</li> <li>If your partner applications need to be authenticated when calling WCF services, use client certificate authentication. </li> <li>If you are using username authentication, use SQL Server Membership Provider instead of custom authentication</li> <li>If you need to support intermediaries and a variety of transports between client and service, use message security to protect credentials </li> <li>If you are using username authentication, validate user login information</li> <li>Do not store passwords directly in the user store</li> <li>Enforce strong passwords </li> <li>Protect access to your credential store</li> <li>If you are using Windows Forms to connect to WCF, do not cache credentials </li></ul> <p><strong>Authorization </strong></p> <ul> <li>If you use ASP.NET roles, use the ASP.NET Role Provider</li> <li>If you use windows groups for authorization, use ASP.NET Role Provider with AspNetWindowsTokenRoleProvider</li> <li>If you store role information in SQL, consider using the SQL Server Role Provider for roles authorization</li> <li>If you store role information in Windows Groups, consider using the WCF PrincipalPermissionAttribute class for roles authorization</li> <li>If you need to authorize access to WCF operations, use declarative authorization</li> <li>If you need to perform fine-grained authorization based on business logic, use imperative authorization </li></ul> <p><strong>Binding </strong></p> <ul> <li>If you need to support clients over the internet, consider using wsHttpBinding.</li> <li>If you need to expose your WCF service to legacy clients as an ASMX web service, use basicHttpBinding</li> <li>If you need to support remote WCF clients within an intranet, consider using netTcpBinding.</li> <li>If you need to support local WCF clients, consider using netNamedPipeBinding.</li> <li>If you need to support disconnected queued calls, use netMsmqBinding.</li> <li>If you need to support bidirectional communication between WCF Client and WCF service, use wsDualHttpBinding. </li></ul> <p><strong>Configuration Management</strong> </p> <ul> <li>Use Replay detection to protect against message replay attacks</li> <li>If you host your service in a Windows service, expose a metadata exchange (mex) binding</li> <li>If you don’t want to expose your WSDL, turn off HttpGetEnabled and metadata exchange (mex)</li> <li>Manage bindings and endpoints in config not code</li> <li>Associate names with the service configuration when you create service behavior, endpoint behavior, and binding configuration</li> <li>Encrypt configuration sections that contain sensitive data </li></ul> <p><strong>Exception Management</strong> </p> <ul> <li>Use structured exception handling</li> <li>Do not divulge exception details to clients in production</li> <li>Use a fault contract to return error information to clients</li> <li>Use a global exception handler to catch unhandled exceptions </li></ul> <p><strong>Hosting </strong></p> <ul> <li>If you are hosting your service in a Windows Service, use a least privileged custom domain account</li> <li>If you are hosting your service in IIS, use a least privileged service account</li> <li>Use IIS to host your service unless you need to use a transport that IIS does not support </li></ul> <p><strong>Impersonation and Delegation</strong> </p> <ul> <li>Know the impersonation options</li> <li>If you have to flow the original caller, use constrained delegation</li> <li>Consider LogonUser when you need to impersonate but you don’t have trusted delegation</li> <li>Consider S4U when you need a Windows token and you don’t have the original caller’s credentials</li> <li>Use programmatic impersonation to impersonate based on business logic</li> <li>When impersonating programmatically be sure to revert to original context</li> <li>Only impersonate on operations that require it</li> <li>Use OperationBehavior to impersonate declaratively </li></ul> <p><strong>Input/Data Validation</strong> </p> <ul> <li>If you need to validate parameters, use parameter inspectors</li> <li>If your service has operations that accept message or data contracts, use schemas to validate your messages</li> <li>If you need to do schema validation, use message inspectors </li> <li>Validate operation parameters for length, range, format and type</li> <li>Validate parameter input on the server </li> <li>Validate service responses on the client</li> <li>Do not rely on client-side validation</li> <li>Avoid user-supplied file name and path input</li> <li>Do not echo untrusted input </li></ul> <p><strong>Proxy Considerations</strong> </p> <ul> <li>Publish your metadata over HTTPS to protect your clients from proxy spoofing</li> <li>If you turn off mutual authentication, be aware of service spoofing </li></ul> <p><strong>Deployment considerations</strong> </p> <ul> <li>Do not use temporary certificates in production</li> <li>If you are using a custom domain account in the identity pool for your WCF application, create an SPN for Kerberos to authenticate the client.</li> <li>If you are using a custom service account and need to use trusted for delegation, create an SPN</li> <li>If you are hosting your service in a Windows Service, using a custom domain identity, and ASP.NET needs to use constrained trusted for delegation when calling the service, create an SPN</li> <li>Use IIS to host your service unless you need to use a transport that IIS does not support</li> <li>Use a least privileged account to run your WCF service</li> <li>Protect sensitive data in your configuration files </li></ul> <p><strong>My Related Posts</strong></p> <ul> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/11/patterns-practices-wcf-security-guidance-updated-application-scenarios.aspx">patterns &amp; practices WCF Security Guidance: Updated Application Scenarios</a></li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/04/04/patterns-and-practices-wcf-security-application-scenarios.aspx">patterns &amp; practices WCF Security Application Scenarios</a> </li> <li><a href="http://blogs.msdn.com/jmeier/archive/2008/03/27/patterns-and-practices-wcf-security-guidance-now-available.aspx">patterns &amp; practices WCF Security Guidance Now Available</a></li></ul><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8403465" width="1" height="1">SecurityMy ProjectsWCFhttp://blogs.msdn.com/jmeier/archive/2008/04/11/patterns-practices-wcf-security-guidance-updated-application-scenarios.aspxFri, 11 Apr 2008 06:32:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:8378021J.D. Meier9http://blogs.msdn.com/jmeier/comments/8378021.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=8378021<P>For this week's release in our <A href="http://www.codeplex.com/WCFSecurity" target=_blank mce_href="http://www.codeplex.com/WCFSecurity">patterns &amp; practices WCF Security Guidance project</A>, we added new sections to our <A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Application%20Scenarios&amp;referringTitle=Home" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Application%20Scenarios&amp;referringTitle=Home">WCF Security Application Scenarios</A>.&nbsp; We added sections for analysis, code and configuration examples.&nbsp; The analysis section explains the rationale behind some of the decisions.&nbsp; </P> <P>The idea behind the application scenarios is to show you a before and after look of end-to-end solutions.&nbsp; Rather than a single solution, we give you a set of solutions to pick from.&nbsp; The main parameters that vary in each solution include: Intranet vs. Internet, ASP.NET client vs. Windows Forms clients, TCP vs. HTTP, impersonation/delegation vs. trusted subsystem, and AD (domain credentials) vs. a custom user store. </P> <P><STRONG>WCF Security Application Scenarios <BR></STRONG>Intranet </P> <UL> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Intranet%20%u2013%20Web%20to%20Remote%20WCF%20Using%20Transport%20Security%20%28Trusted%20Subsystem%20TCP%29&amp;referringTitle=Application%20Scenarios" target=_blank>Intranet – Web to Remote WCF Using Transport Security (Trusted Subsystem TCP)</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Intranet%20%u2013%20Web%20to%20Remote%20WCF%20Using%20Transport%20Security%20%28Trusted%20Subsystem%2c%20HTTP%29&amp;referringTitle=Application%20Scenarios" target=_blank>Intranet – Web to Remote WCF Using Transport Security (Trusted Subsystem, HTTP)</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Intranet%20%u2013%20Web%20to%20Remote%20WCF%20Using%20Transport%20Security%20%28Original%20Caller%2c%20TCP%29&amp;referringTitle=Application%20Scenarios" target=_blank>Intranet – Web to Remote WCF Using Transport Security (Original Caller, TCP)</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Intranet%20%u2013%20Windows%20Forms%20to%20Remote%20WCF%20Using%20Transport%20Security%20%28TCP%29&amp;referringTitle=Application%20Scenarios" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Intranet%20%u2013%20Windows%20Forms%20to%20Remote%20WCF%20Using%20Transport%20Security%20%28TCP%29&amp;referringTitle=Application%20Scenarios">Intranet – Windows Forms to Remote WCF Using Transport Security (TCP)</A> </LI></UL> <P>Internet </P> <UL> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Internet%20%u2013%20Web%20to%20Remote%20WCF%20Using%20Transport%20Security%20%28Trusted%20Subsystem%29&amp;referringTitle=Application%20Scenarios" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Internet%20%u2013%20Web%20to%20Remote%20WCF%20Using%20Transport%20Security%20%28Trusted%20Subsystem%29&amp;referringTitle=Application%20Scenarios">Internet – Web to Remote WCF Using Transport Security (Trusted Subsystem)</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Internet%20%u2013%20Windows%20Forms%20Client%20Calling%20WCF%20Using%20Message%20Security&amp;referringTitle=Application%20Scenarios" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=Internet%20%u2013%20Windows%20Forms%20Client%20Calling%20WCF%20Using%20Message%20Security&amp;referringTitle=Application%20Scenarios">Internet – Windows Forms Client Calling WCF Using Message Security</A> </LI></UL> <P>Note that if there's enough interest and time, we'll add a scenario that shows accessing an existing custom user store (i.e. you aren't using Membership.)&nbsp; </P> <P><STRONG>My Related Posts</STRONG> </P> <UL> <LI><A href="http://blogs.msdn.com/jmeier/archive/2008/04/04/patterns-and-practices-wcf-security-application-scenarios.aspx" mce_href="http://blogs.msdn.com/jmeier/archive/2008/04/04/patterns-and-practices-wcf-security-application-scenarios.aspx">patterns &amp; practices WCF Security Application Scenarios</A> </LI> <LI><A href="http://blogs.msdn.com/jmeier/archive/2008/03/27/patterns-and-practices-wcf-security-guidance-now-available.aspx" mce_href="http://blogs.msdn.com/jmeier/archive/2008/03/27/patterns-and-practices-wcf-security-guidance-now-available.aspx">patterns &amp; practices WCF Security Guidance Now Available</A> </LI></UL><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8378021" width="1" height="1">SecurityMy ProjectsWCFhttp://blogs.msdn.com/jmeier/archive/2008/03/27/patterns-and-practices-wcf-security-guidance-now-available.aspxThu, 27 Mar 2008 19:04:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:8339917J.D. Meier20http://blogs.msdn.com/jmeier/comments/8339917.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=8339917<P>Our <A href="http://www.codeplex.com/WCFSecurity" target=_blank mce_href="http://www.codeplex.com/WCFSecurity">patterns &amp; practices WCF Security Guidance Project</A> is in progress on CodePlex.&nbsp; This is our first release of prescriptive guidance modules for WCF Security.&nbsp; </P> <P><STRONG>How Tos</STRONG> <BR>Our How Tos give you step by step instructions for performing key tasks:</P> <UL> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Create%20and%20Install%20Temporary%20Certificates%20in%20WCF%20for%20Message%20Security%20During%20Development&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Create%20and%20Install%20Temporary%20Certificates%20in%20WCF%20for%20Message%20Security%20During%20Development&amp;referringTitle=How%20Tos">How To - Create and Install Temporary Certificates in WCF for Message Security During Development</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Create%20and%20Install%20Temporary%20Certificates%20in%20WCF%20for%20Transport%20Security%20during%20Development&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Create%20and%20Install%20Temporary%20Certificates%20in%20WCF%20for%20Transport%20Security%20during%20Development&amp;referringTitle=How%20Tos">How To - Create and Install Temporary Certificates in WCF for Transport Security During Development</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Impersonate%20the%20Original%20Caller%20in%20WCF%20calling%20from%20Web%20Application&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Impersonate%20the%20Original%20Caller%20in%20WCF%20calling%20from%20Web%20Application&amp;referringTitle=How%20Tos">How To - Impersonate the Original Caller in WCF calling from Web Application</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Impersonate%20the%20Original%20Caller%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Impersonate%20the%20Original%20Caller%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos">How To - Impersonate the Original Caller in WCF calling from Windows Forms</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20netTcpBinding%20with%20Windows%20Authentication%20and%20Transport%20Security%20in%20WCF%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20netTcpBinding%20with%20Windows%20Authentication%20and%20Transport%20Security%20in%20WCF%20from%20Windows%20Forms&amp;referringTitle=How%20Tos">How To - Use netTcpBinding with Windows Authentication and Transport Security in WCF from Windows Forms</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20SQL%20Role%20Provider%20with%20Username%20Authentication%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20SQL%20Role%20Provider%20with%20Username%20Authentication%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos">How To - Use SQL Role Provider with Username Authentication in WCF from Windows Forms</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20SQL%20Role%20Provider%20with%20Windows%20Authentication%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20SQL%20Role%20Provider%20with%20Windows%20Authentication%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos">How To - Use SQL Role Provider with Windows Authentication in WCF from Windows Forms</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20Username%20Authentication%20with%20the%20SQL%20Membership%20Provider%20and%20Message%20Security%20in%20WCF%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20Username%20Authentication%20with%20the%20SQL%20Membership%20Provider%20and%20Message%20Security%20in%20WCF%20from%20Windows%20Forms&amp;referringTitle=How%20Tos">How To - Use Username Authentication with the SQL Membership Provider and Message Security in WCF from Windows Forms</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20wsHttpBinding%20with%20Windows%20Authentication%20and%20Message%20Security%20in%20WCF%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20wsHttpBinding%20with%20Windows%20Authentication%20and%20Message%20Security%20in%20WCF%20from%20Windows%20Forms&amp;referringTitle=How%20Tos">How To - Use WsHttpBinding with Windows Authentication and Message Security in WCF from Windows Forms</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20wsHttpBinding%20with%20Windows%20Authentication%20and%20Transport%20Security%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%20-%20Use%20wsHttpBinding%20with%20Windows%20Authentication%20and%20Transport%20Security%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=How%20Tos">How To - Use wsHttpBinding with Windows Authentication and Transport Security in WCF calling from Windows Forms</A> </LI></UL> <P><STRONG>Videos <BR></STRONG>Our videos step you visually through key guidance:</P> <UL> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%3a%20How%20to%20Host%20WCF%20in%20a%20Windows%20Service&amp;referringTitle=Video%20Index" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%3a%20How%20to%20Host%20WCF%20in%20a%20Windows%20Service&amp;referringTitle=Video%20Index">Video: How To - Host WCF in a Windows Service</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%3a%20Impersonate%20the%20Original%20Caller%20in%20WCF%20calling%20from%20a%20Windows%20Form&amp;referringTitle=Video%20Index" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%3a%20Impersonate%20the%20Original%20Caller%20in%20WCF%20calling%20from%20a%20Windows%20Form&amp;referringTitle=Video%20Index">Video: How To - Impersonate the Original Caller in WCF calling from a Windows Form</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20to%3a%20Use%20basicHttpBinding%20with%20Certificate%20Authentication%20from%20Windows%20Forms&amp;referringTitle=Video%20Index" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20to%3a%20Use%20basicHttpBinding%20with%20Certificate%20Authentication%20from%20Windows%20Forms&amp;referringTitle=Video%20Index">Video: How To - Use basicHttpBinding with Client certificate in WCF from Windows Forms</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20to%3a%20Use%20netTcpBinding%20with%20Windows%20Authentication%20and%20MessageSecurity&amp;referringTitle=Video%20Index" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20to%3a%20Use%20netTcpBinding%20with%20Windows%20Authentication%20and%20MessageSecurity&amp;referringTitle=Video%20Index">Video: How To - Use netTcpBinding with Windows Authentication and Message Security</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20to%20Use%20SQL%20Role%20Provider%20with%20Username%20Authentication%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=Video%20Index" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20to%20Use%20SQL%20Role%20Provider%20with%20Username%20Authentication%20in%20WCF%20calling%20from%20Windows%20Forms&amp;referringTitle=Video%20Index">Video: How To - Use SQL Role Provider with Username Authentication in WCF calling from Windows Forms</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%3a%20Use%20WsHttpBinding%20with%20Certificate%20Authentication%20with%20Message%20Security%20%28object%20model%20programming%29%20&amp;referringTitle=Video%20Index" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%3a%20Use%20WsHttpBinding%20with%20Certificate%20Authentication%20with%20Message%20Security%20%28object%20model%20programming%29%20&amp;referringTitle=Video%20Index">Video: How To - Use WsHttpBinding with Certificate Authentication with Message Security</A> </LI> <LI><A href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%3a%20Use%20WsHttpBinding%20with%20Windows%20Authentication%20with%20Message%20Security&amp;referringTitle=Video%20Index" target=_blank mce_href="http://www.codeplex.com/WCFSecurity/Wiki/View.aspx?title=How%20To%3a%20Use%20WsHttpBinding%20with%20Windows%20Authentication%20with%20Message%20Security&amp;referringTitle=Video%20Index">Video: How To - Use WsHttpBinding with Windows Authentication with Message Security</A> </LI></UL> <P><STRONG>About WCF</STRONG> <BR>Windows Communication Foundation (WCF) is a service-oriented platform for building and consuming secure, reliable, and transacted services.&nbsp; It unifies the programming models for ASMX, Enterprise services and .NET Remoting.&nbsp; It supports multiple protocols including named pipes, TCP, HTTP, and MSMQ.&nbsp; WCF promotes loose coupling, supports interoperability, and encapsulates the latest web service standards.&nbsp; With WCF, you get flexibility in choosing protocol, message encoding formats, and hosting.&nbsp;&nbsp; For more information, see the <A href="http://msdn2.microsoft.com/en-us/netframework/aa663324.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/netframework/aa663324.aspx">MSDN WCF Developer Center</A>. </P> <P><STRONG>About the Project</STRONG> <BR>WCF provides a lot of options and flexibility.&nbsp; The goal of our patterns &amp; practices WCF Security Guidance Project is to find the key combinations of security practices for WCF&nbsp;that work for customers and share them more broadly.&nbsp; At a high-level, you can think of the project in terms of these main buckets:</P> <UL> <LI><STRONG>Application Scenarios</STRONG> - These are whiteboard solutions for common end-to-end application scenarios. </LI> <LI><STRONG>How Tos</STRONG> - These are step-by-step instructions for performing key end-to-end tasks. </LI> <LI><STRONG>Building Codes</STRONG> - These are our sets of rules and practices.&nbsp; This includes Guidelines, Checklists, and Practices at a Glance. </LI> <LI><STRONG>Reference</STRONG> - This includes Explained, Cheat Sheets, and Q&amp;A guidance. </LI></UL> <P>The plan is to incrementally share our guidance modules on CodePlex as we go, then build a guide, then port the guidance to MSDN once it's baked.</P><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8339917" width="1" height="1">SecurityMy ProjectsWCFhttp://blogs.msdn.com/jmeier/archive/2008/01/02/guidance-share-sweep.aspxWed, 02 Jan 2008 18:48:06 GMT91d46819-8472-40ad-a661-2c78acb4018c:6956141J.D. Meier2http://blogs.msdn.com/jmeier/comments/6956141.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=6956141<p>One of the most important things I did while I was on vacation was sweeping <a href="http://www.GuidanceShare.com" target="_blank">Guidance Share</a>.&nbsp; Guidance Share is where I consolidate my body of software engineering guidance and test user experiences.&nbsp; I redesigned the home page for simpler browsing and findability.&nbsp; It was more pain than pleasure for me, but if it helps the broader community, that's my payback. <p>Here's a highlight of Guidance Share:</p> <ul> <li>Browsable nuggets for software performance and security <li>Durable, evolvable frames for security and performance (think of these as maps) <li>How Tos, Guidelines, Checklists and more </li></ul> <p>Guidance Share gives me a unique vantage point that I haven't been able to get any other way.&nbsp; The act of building it and evolving it helps me make gain new insights.&nbsp; It also forces me to find ways to be extremely efficient.&nbsp; I then try to carry these lessons over to MSDN and to help shape patterns &amp; practices information models.&nbsp; I don't own the MSDN experience, but I can give input.&nbsp; Guidance Share helps me solidify my recommendations with living proof.&nbsp; It's also let's me quickly experiment with new user experiences. <p>My biggest lesson learned is how difficult it is to integrate information and make it useful, even when you own it.&nbsp; It's one thing to have a snapshot of information that's useful for a given point in time; it's another to create a stable backdrop with a firm foundation that can evolve over time.&nbsp; The key is factoring volatile from stable information, and enabling them to play well together.</p> <p>Note that Guidance Share is under construction and there are some obviously empty areas, but it's a work in progress.&nbsp; It's a living knowledge base for software engineering that I periodically sweep to share the best that I've learned.</p> <p>Enjoy!</p><img src="http://blogs.msdn.com/aggbug.aspx?PostID=6956141" width="1" height="1">SecurityPerformanceGuidance EngineeringSoftware EngineeringMy Projectshttp://blogs.msdn.com/jmeier/archive/2007/12/01/now-on-amazon-performance-testing-guidance-for-web-applications.aspxSat, 01 Dec 2007 03:15:07 GMT91d46819-8472-40ad-a661-2c78acb4018c:6621336J.D. Meier2http://blogs.msdn.com/jmeier/comments/6621336.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=6621336<p>Our <a href="http://www.amazon.com/Performance-Testing-Guidance-Web-Applications/dp/0735625700/ref=sr_11_1?ie=UTF8&amp;qid=1196463760&amp;sr=11-1" target="_blank">patterns &amp; practices Performance Testing Guidance for Web Applications book</a> is now available on Amazon. <ul> <li><a href="http://www.amazon.com/Performance-Testing-Guidance-Web-Applications/dp/0735625700/ref=sr_11_1?ie=UTF8&amp;qid=1196463760&amp;sr=11-1" target="_blank">Buy the Book on Amazon</a></li> <li><a href="http://www.codeplex.com/PerfTestingGuide/Release/ProjectReleases.aspx?ReleaseId=6690" target="_blank">Download the PDF</a></li> <li><a href="http://msdn2.microsoft.com/en-us/library/bb924375.aspx" target="_blank">Browse the HTML</a></li></ul><img src="http://blogs.msdn.com/aggbug.aspx?PostID=6621336" width="1" height="1">PerformanceMy Projectshttp://blogs.msdn.com/jmeier/archive/2007/12/01/now-on-amazon-team-development-with-visual-studio-team-foundation-server.aspxSat, 01 Dec 2007 03:10:54 GMT91d46819-8472-40ad-a661-2c78acb4018c:6621321J.D. Meier3http://blogs.msdn.com/jmeier/comments/6621321.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=6621321<p>Our <a href="http://www.amazon.com/Development-Visual-Studio-Foundation-Server/dp/0735625719/ref=sr_11_1?ie=UTF8&amp;qid=1196464421&amp;sr=11-1 " target="_blank">patterns &amp; practices Team Development with Visual Studio Team Foundation Server book</a> is now available on Amazon. <ul> <li><a href="http://www.amazon.com/Development-Visual-Studio-Foundation-Server/dp/0735625719/ref=sr_11_1?ie=UTF8&amp;qid=1196464421&amp;sr=11-1" target="_blank">Buy the Book on Amazon</a> <li><a href="http://www.codeplex.com/TFSGuide/Release/ProjectReleases.aspx?ReleaseId=6280" target="_blank">Download the PDF</a> <li><a href="http://msdn2.microsoft.com/en-us/library/bb668991.aspx" target="_blank">Browse the HTML</a></li></ul><img src="http://blogs.msdn.com/aggbug.aspx?PostID=6621321" width="1" height="1">My ProjectsVisual Studiohttp://blogs.msdn.com/jmeier/archive/2007/10/27/now-on-msdn-patterns-practices-performance-testing-guidance-for-web-applications.aspxSat, 27 Oct 2007 09:59:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:5704789J.D. Meier9http://blogs.msdn.com/jmeier/comments/5704789.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=5704789<P>You can now find our <A class="" href="http://msdn2.microsoft.com/en-us/library/bb924375.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924375.aspx">patterns &amp; practices Performance Testing Guidance for Web Applications on MSDN</A> in HTML.&nbsp; It's the same guidance we hosted on CodePlex.&nbsp; CodePlex was our channel for agile release of the guidance.&nbsp; Once we baked the guidance, we ported it to MSDN.</P> <P><STRONG>Contents at a Glance</STRONG><BR>Here's the </P> <UL> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924375.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924375.aspx">Landing Page</A></LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924355.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924355.aspx">Foreword By Alberto Savoia</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924373.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924373.aspx">Foreword By Rico Mariani</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924376.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924376.aspx">Introduction</A> </LI></UL> <P><STRONG>Chapters</STRONG></P> <UL> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924356.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924356.aspx">Chapter 1 – Fundamentals of Web Application Performance Testing</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924357.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924357.aspx">Chapter 2 – Types of Performance Testing</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924358.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924358.aspx">Chapter 3 – Risks Addressed Through Performance Testing</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924359.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924359.aspx">Chapter 4 – Web Application Performance Testing Core Activities</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924360.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924360.aspx">Chapter 5 – Coordinating Performance Testing with an Iteration-Based Process</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924361.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924361.aspx">Chapter 6 – Managing an Agile Performance Test Cycle</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924362.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924362.aspx">Chapter 7 – Managing the Performance Test Cycle in a Regulated (CMMI) Environment</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924363.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924363.aspx">Chapter 8 – Evaluating Systems to Increase Performance-Testing Effectiveness</A></LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924364.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924364.aspx">Chapter 9 – Determining Performance Testing Objectives</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924368.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924368.aspx">Chapter 10 – Quantifying End-User Response Time Goals</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924366.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924366.aspx">Chapter 11 – Consolidating Various Types of Performance Acceptance Criteria</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924367.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924367.aspx">Chapter 12 – Modeling Application Usage</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924368.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924368.aspx">Chapter 13 – Determining Individual User Data and Variances</A></LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924369.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924369.aspx">Chapter 14 – Test Execution</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924370.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924370.aspx">Chapter 15 – Key Mathematic Principles for Performance Testers</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924371.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924371.aspx">Chapter 16 – Performance Test Reporting Fundamentals</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924372.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924372.aspx">Chapter 17 – Load-Testing Web Applications</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb924374.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb924374.aspx">Chapter 18 – Stress-Testing Web Applications</A> </LI></UL> <P><STRONG>Download<BR></STRONG>You can <A class="" href="http://www.codeplex.com/PerfTestingGuide" target=_blank mce_href="http://www.codeplex.com/PerfTestingGuide">download the patterns &amp; practices Performance Testing Guidance for Web Applications</A> from CodePlex.</P> <P><STRONG>Guidance Explorer Scenario</STRONG><BR>If you want to tailor the guidance for your scenario, you can <A class="" href="http://www.codeplex.com/GuidanceExplorer" target=_blank mce_href="http://www.codeplex.com/GuidanceExplorer">download Guidance Explorer</A> from CodePlex.&nbsp; Using Guidance Explorer, you can create custom views by dragging and dropping the relevant guidance and then tailoring it as you see fit.&nbsp; You can then save your view or an item to Word or HTML</P><img src="http://blogs.msdn.com/aggbug.aspx?PostID=5704789" width="1" height="1">patterns and practicesPerformanceMy Projectshttp://blogs.msdn.com/jmeier/archive/2007/10/26/patterns-practices-visual-studio-team-system-guidance-now-on-msdn.aspxSat, 27 Oct 2007 01:22:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:5696520J.D. Meier7http://blogs.msdn.com/jmeier/comments/5696520.aspxhttp://blogs.msdn.com/jmeier/commentrss.aspx?PostID=5696520<P>You can now find our <A class="" href="http://msdn2.microsoft.com/en-us/library/bb668991.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668991.aspx ">patterns &amp; practices&nbsp;Team Development with Visual Studio Team Foundation Server guide&nbsp;on MSDN</A> in HTML.&nbsp; It's the same guidance we hosted on CodePlex.&nbsp; CodePlex was our channel for agile release.&nbsp; Once we baked the guidance, we ported to MSDN.&nbsp; For some customers, MSDN is a trusted source, so being on MSDN is important.&nbsp; Additionally, MSDN provides some additional hooks and channels.</P> <P><STRONG>Contents At a Glance</STRONG><BR>Here's the guide at a glance</P> <UL> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668991.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668991.aspx">Landing Page</A></LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668989.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668989.aspx">Foreword By Jeff Beehler</A></LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668949.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668949.aspx">Foreword by Brian Harry</A></LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668990.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668990.aspx">Foreword by Rob Caron</A></LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668987.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668987.aspx">Introduction</A></LI></UL> <P><STRONG>Chapters</STRONG></P> <UL> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668951.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668951.aspx">Ch 01 – Introducing the Team Environment</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668952.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668952.aspx">Ch 02 – Team Foundation Server Architecture</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668953.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668953.aspx">Ch 03 – Structuring Projects and Solutions in Source Control</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668954.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668954.aspx">Ch 04 – Structuring Projects and Solutions in Team Foundation Source Control</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668955.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668955.aspx">Ch 05 – Defining Your Branching and Merging Strategy</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668956.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668956.aspx">Ch 06 – Managing Source Control Dependencies in Visual Studio Team System</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668958.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668958.aspx">Ch 07 – Team Build Explained</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668957.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668957.aspx">Ch 08 – Setting Up Continuous Integration with Team Build</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668959.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668959.aspx">Ch 09 – Setting Up Scheduled Builds with Team Build</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668960.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668960.aspx">Ch 10 – Large Project Considerations</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668961.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668961.aspx">Ch 11 – Project Management Explained</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668962.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668962.aspx">Ch 12 – Work Items Explained</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668963.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668963.aspx">Ch 13 – Process Templates Explained</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668964.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668964.aspx">Ch 14 – MSF for Agile Software Development Projects</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668965.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668965.aspx">Ch 15 – Reporting Explained</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668966.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668966.aspx">Ch 16 – Team Foundation Server Deployment</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668967.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668967.aspx">Ch 17 – Providing Internet Access to Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668970.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668970.aspx">Ch 18 – What’s New in Visual Studio Team System 2008 Team Foundation Server</A></LI></UL> <P><STRONG>Guidelines</STRONG></P> <UL> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668941.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668941.aspx">Guidelines: Team Build</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668944.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668944.aspx">Guidelines: Source Control</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668943.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668943.aspx">Guidelines: Reporting</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668942.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668942.aspx">Guidelines: Project Management</A> </LI></UL> <P><STRONG>Practices at a Glance</STRONG></P> <UL> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668945.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668945.aspx">Practices at a Glance: Team Build</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668948.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668948.aspx">Practices at a Glance: Source Control</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668947.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668947.aspx">Practices at a Glance: Reporting</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668946.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668946.aspx">Practices at a Glance: Project Management</A> </LI></UL> <P><STRONG>Questions and Answers</STRONG></P> <UL> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668950.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668950.aspx">Questions and Answers:&nbsp; Source Control</A> </LI></UL> <P><STRONG>How Tos</STRONG></P> <UL> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668968.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668968.aspx">How To: Add a New Developer To Your Project in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668977.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668977.aspx">How To: Automatically Run Code Analysis with Team Build in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668978.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668978.aspx">How To: Create a Custom Report for Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668979.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668979.aspx">How To: Create a Risk Over Time Report for Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668980.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668980.aspx">How To: Create Custom Check-in Policies in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668981.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668981.aspx">How To: Create Your Source Tree in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668982.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668982.aspx">How To: Customize a Process Template in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668983.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668983.aspx">How To: Customize a Report in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668988.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668988.aspx">How To: Manage Projects in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668969.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668969.aspx">How To: Migrate Source code to Team Foundation Server from Visual Source Safe</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668976.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668976.aspx">How To: Perform a Baseless Merge in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668971.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668971.aspx">How To: Set Up a Continuous Integration Build in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668975.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668975.aspx">How To: Set Up a Scheduled Build in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668986.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668986.aspx">How To: Structure ASP.NET Applications in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668994.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668994.aspx">How To: Structure Windows Applications in Visual Studio Team Foundation Server</A> </LI> <LI><A class="" href="http://msdn2.microsoft.com/en-us/library/bb668992.aspx" target=_blank mce_href="http://msdn2.microsoft.com/en-us/library/bb668992.aspx">How To: Structure Your Source Control Folders in Visual Studio Team Foundation Server</A> </LI></UL> <P mce_keep="true"><STRONG>Download<BR></STRONG>You can <A class="" href="http://www.codeplex.com/TFSGuide/release/projectreleases.aspx?releaseid=6280" target=_blank mce_href="http://www.codeplex.com/TFSGuide/release/projectreleases.aspx?releaseid=6280">download the Team Development with Visual Studio Team Foundation Server Guide</A> from CodePlex.</P> <P mce_keep="true"><STRONG>Guidance Explorer Scenario</STRONG><BR>If you want to tailor the guidance for your scenario, you can <A class="" href="http://www.codeplex.com/guidanceExplorer" target=_blank mce_href="http://www.codeplex.com/guidanceExplorer">download Guidance Explorer</A> from CodePlex.&nbsp; Using Guidance Explorer, you can&nbsp;create custom views by dragging and dropping the relevant guidance and then tailoring it as you see fit.&nbsp; You can then&nbsp;save&nbsp;your view&nbsp;or an item to Word or HTML.&nbsp; </P><img src="http://blogs.msdn.com/aggbug.aspx?PostID=5696520" width="1" height="1">patterns and practicesMy ProjectsVisual Studio