Sajay : WS-* and WCF

WCF 4: AddDefaultEndpoints

Sajay — Tue, 18 Aug 2009 03:38:00 GMT

Note: Cross posted from Sajay.
Permalink

Here is another little goodie we have which will help in reducing configuration. You can use the ServiceHostBase.AddDefaultEndpoints which will pretty much probe your service implementation for contracts and expose them as shown below. Notice that I don't need to specify anything more than the base address and the type of the service and I have actually commented out the call to the API. You can find more details about the simplified configuration here.

const string address = "net.tcp://localhost:8080/";
const string address2 = "http://localhost:8081/";
ServiceHost host = new ServiceHost(typeof(Service1), new Uri(address), new Uri(address2));
//host.AddDefaultEndpoints(); 
host.Open();

ServiceThrottlingBehavior defaults for .NET 4

Sajay — Tue, 21 Jul 2009 23:59:04 GMT

This is one of the new updates that you will find with the .NET 4 installation. This was a decision we reached after understanding the fact that almost all customers had to bump this number up to a sweet spot of around 100 sessions. However the initial decision of keeping a very low number was a conscious one. We wanted to make sure this throttle would be hit really early on the development cycle and would cause a forced learning of service throttling behavior and how you need to think about performance of your service.

	3.0 to .NET 3.5 Sp1	.NET 4
MaxConcurrentCalls	16	16* Processor Count
MaxConcurrentSessions	10	100* Processor Count
MaxConcurrentInstances	Sum (26)	Sum (116*Processor Count)

There are few more goodies like more indicative performance counters to show you if your close to hitting this throttle value and if you need to bump this value up any more. For example if your 80% usage then you know that you have about 20% more throughput. But if your CPU is already fully loaded then probably you need to lower the values since you might actually have maxed out a much lower throughput value and it might be more optimal to process lesser calls.

Note: Cross posted from Sajay.
Permalink

WCF Scalability and IIS

Sajay — Wed, 20 Aug 2008 00:03:00 GMT

Couldn't get better than this. Wenlong has pretty much detailed out to the gory details of understanding WCF scalability in these posts.

The fact you realize is that one bottle neck is enough to kill your scalability.

Finally Zermatt's here

Sajay — Sat, 12 Jul 2008 19:57:00 GMT

IIts been a long wait. After working with customers for getting out their token service and doing all the claim based black magic, finally we have a framework. Its not a bubble gum and match stick situation more and its a full framework.

If you want to build applications and solve your federation problems which i have had a lot of previous posts on then you really want to take a look at this. Vittorio is put up quite a cool set of links and a very neat overview which I don't want to cut paste here.

The one thing i have seen is the ease of integrating with Zermatt. Those of you who want to just go to the gory details head out to Keith's post- or white paper directly on connect-

I still remember working with Vittorio and Martin in getting up the STS during the indigo beta days .. nice to see this out which really makes it easy to get your security around your solution. I would like to emphasize on the fact that claim's based approach is a security solution and not just an approach. The spec is so rich if you have the time to digest it cause it breaks down complex problems of multi-hop scenario and delegation really simple. Transformations are another area which I am interested in and would see how Zermat solves this problems.

Happy spelunking.

Time for your operation execution using the Operation invoker.

Sajay — Sat, 26 Apr 2008 10:46:00 GMT

Have you ever wanted to do something like this .

// Define a service contract.

[ServiceContract(Namespace="http://Microsoft.ServiceModel.Samples")]

public interface ICalculator

{

[OperationContract]

[PerfOperationBehavior]

double Add(double n1, double n2);

[OperationContract]

double Subtract(double n1, double n2);

[OperationContract]

double Multiply(double n1, double n2);

[OperationContract]

double Divide(double n1, double n2);

}

Where you probably wanted to write some code to log the time for the operation or just update some performance counter on the server. If you are already familiar with Operation invoker then the rest rest of the post is just a waste of time since i just wanted to show how the operation invoker could be used pretty much inject your code into the pipeline to see what is the execution time of your operation.

These are pretty much the steps you need to do.

Create an operation behavior obviously since you want to attach to the operation.
Implement the IOperationInvoker for kind of intercepting operation invocation.
Attach a counter extension to log the start and end of the operation.

And you pretty much have your behavior you can just add on the operation.

Here is the behavior and the classes required to implement this and shows a very bare bone implementation of the ticks that would occur between invocations of an operation.

FInd the full solution attached below.

using System;

using System.Collections.Generic;

using System.Text;

using System.ServiceModel.Description;

using System.ServiceModel.Dispatcher;

using System.ServiceModel;

using System.Diagnostics;

namespace Microsoft.Samples.Wcf.Performance

{

[AttributeUsage(AttributeTargets.Method)]

public class PerfOperationBehavior : System.Attribute, IOperationBehavior

{

#region IOperationBehavior Members

void IOperationBehavior.AddBindingParameters(OperationDescription operationDescription,

System.ServiceModel.Channels.BindingParameterCollection bindingParameters)

{

}

void IOperationBehavior.ApplyClientBehavior(OperationDescription operationDescription,

System.ServiceModel.Dispatcher.ClientOperation clientOperation)

{

}

void IOperationBehavior.ApplyDispatchBehavior(OperationDescription operationDescription,

System.ServiceModel.Dispatcher.DispatchOperation dispatchOperation)

{

dispatchOperation.Invoker = new PerfCounterOperationInvoker(dispatchOperation.Invoker);

}

void IOperationBehavior.Validate(OperationDescription operationDescription)

{

}

#endregion

}

internal class PerfCounterOperationInvoker : IOperationInvoker

{

IOperationInvoker innerOperationInvoker;

public PerfCounterOperationInvoker(IOperationInvoker invoker)

{

this.innerOperationInvoker = invoker;

}

#region IOperationInvoker Members

object[] IOperationInvoker.AllocateInputs()

{

return this.innerOperationInvoker.AllocateInputs();

}

object IOperationInvoker.Invoke(object instance, object[] inputs, out object[] outputs)

{

OperationContext.Current.Extensions.Add(new PerfOperationContextExtension());

try

{

return this.innerOperationInvoker.Invoke(instance, inputs, out outputs);

}

finally

{

OperationContext.Current.Extensions.Remove(

OperationContext.Current.Extensions.Find<PerfOperationContextExtension>());

}

IAsyncResult IOperationInvoker.InvokeBegin(object instance, object[] inputs, AsyncCallback callback, object state)

{

OperationContext.Current.Extensions.Add(new PerfOperationContextExtension());

return this.innerOperationInvoker.InvokeBegin(instance, inputs, callback, state);

}

object IOperationInvoker.InvokeEnd(object instance, out object[] outputs, IAsyncResult result)

{

OperationContext.Current.Extensions.Remove(

OperationContext.Current.Extensions.Find<PerfOperationContextExtension>());

return this.innerOperationInvoker.InvokeEnd(instance, out outputs, result);

}

bool IOperationInvoker.IsSynchronous

{

get { return this.innerOperationInvoker.IsSynchronous; }

}

#endregion

}

internal class PerfOperationContextExtension : IExtension<OperationContext>

{

long ticks;

#region IExtension<OperationContext> Members

public void Attach(OperationContext owner)

{

ticks = DateTime.Now.Ticks;

}

public void Detach(OperationContext owner)

{

ticks = DateTime.Now.Ticks - ticks;

Debug.WriteLine(string.Format("Operation : {0} took {1} ticks",

owner.IncomingMessageHeaders.Action,

ticks));

}

#endregion

}

Sending a simple String using WCF - Understanding the channel stack.

Sajay — Tue, 26 Feb 2008 12:55:00 GMT

The snippet below might not be for the faint hearted. Primarily since its quite gory wcf. I realized that there is so much abstraction in the Service model's channel layers thats its only justice that someone does a simple sample in how to send and read raw messages. I would suggest you to understand the ICommunicationObject by Nicholas before this.

I would not be diving into security and behaviors for this post but just wanted to touch upon using a simple IRequest and IReply channel. Now for those of you not familiar with MEP this would be a good time to figure out what are the different kinds of MEP (message exchange patterns) that WCF support. I would like to point you to http://blogs.msdn.com/drnick/archive/2007/03/08/channel-shapes.aspx where Nicholas has given a nice diagram for this.

In this post i use the HTTP model which is enabled through the Request reply pattern. The service in short is an Http listener and uses, as the name would suggest a, ChannelListener and the client which is capable of sending a message would use the channel factory. Both of these are created from the Binding.

If you program in WCF you come across a lot of references to the channel stack. One of the key take aways of this pattern is that the underlying channel has some duties delegated to it to be performed by the above layer and there are some fundament rules that have to be obeyed by every channel in the channel stack

You can take a look below on how raw strings can be sent across. The intent of this sample is to show how the binding is used to create the channel Listeners and the channel factory.

1. The Channel Listener - The channel listener used here uses the Http listener and to start the listening service we use the IReplyChannel . We can invoke RecieveRequest which would give us the calling transport channel. This can be used to respond to the calling client. We can send a reply back to the caller using this RequestContext.

Use the Binding to build the channel listener.
Open the listener.
Get the transport channel using AcceptChannel();
Open the transport.

2. Channel Factory - To send a message across to the listener we use the binding to create the channel factory.

Build the channel factory usign the Binding.
Buid the channel to send using the channel factory
send the message to the server using the Request on the IRequestChannel. As you would notice the request method also give your an output message which is what the server responds with.

Message response = channel.Request(msg);

You can check out the full sample here.

using System;

using System.Collections.Generic;

using System.Text;

using System.ServiceModel;

using System.ServiceModel.Channels;

using System.Threading;

namespace WcfRawMessages

{

class Program

{

static void Main(string[] args)

{

//Start the listener

ServiceHelpers.StartListener();

//Invoke with test messages.

for (int i = 0; i < 10; i++)

{

TestClientHelper.SendTestMessage();

}

Console.ReadLine();

ServiceHelpers.Stop();

}

public class BindingHelpers

{

public static Uri Address = new Uri("http://localhost:8089");

public static Binding GetBinding()

{

CustomBinding binding = new CustomBinding();

//add the encoder and the binding

MessageEncodingBindingElement mbe = new TextMessageEncodingBindingElement();

mbe.MessageVersion = MessageVersion.None;

binding.Elements.Add(mbe);

binding.Elements.Add(new HttpTransportBindingElement());

return binding;

}

public class ServiceHelpers

{

static IReplyChannel transportChannel;

public static void StartListener()

{

Binding binding = BindingHelpers.GetBinding();

IChannelListener<IReplyChannel> listener = binding.BuildChannelListener<IReplyChannel>(BindingHelpers.Address);

listener.Open();

transportChannel = listener.AcceptChannel();

transportChannel.Open();

Thread t = new Thread(delegate(object state)

{

//Gory while loop to recieve messages from the transport

while (true)

{

try

{

//Use the request context to recieve a message

RequestContext request = transportChannel.ReceiveRequest();

if (request != null)

{

Message msg = request.RequestMessage;

Console.WriteLine(msg.GetBody<string>());

//Send the response…

Message replymessage = Message.CreateMessage(msg.Version, "http://responseAction/");

request.Reply(replymessage);

request.Close();

msg.Close();

replymessage.Close();

}

catch (CommunicationException ex)

{

Console.WriteLine("Communication Exception " + ex.Message);

}

if (transportChannel.State != CommunicationState.Opened)

break;

}

});

t.Start();

}

internal static void Stop()

{

transportChannel.Close();

//transportChannel.Abort();

}

public class TestClientHelper

{

static IChannelFactory<IRequestChannel> factory;

static int counter = 0;

public static void SendTestMessage()

{

Binding binding = BindingHelpers.GetBinding();

//Create the channel factor.

if (factory == null)

{

factory = binding.BuildChannelFactory<IRequestChannel>(BindingHelpers.Address);

factory.Open();

}

//Create the channel.

IRequestChannel channel = factory.CreateChannel(new EndpointAddress(BindingHelpers.Address));

channel.Open();

Message msg = Message.CreateMessage(binding.MessageVersion, "", "Body Text" + counter++);

Message response = channel.Request(msg);

channel.Close();

msg.Close();

response.Close();

}

Timeouts and WCF - httpRuntime

Sajay — Tue, 24 Jul 2007 10:42:00 GMT

There seems to be very little documentation around the timeout behaviors for the client and service and configuring so many knobs can get you in a fix if you dont know what you are tweaking. The below snippet shows how enable one of these scenarios to keep connections open for long processing message. Bad as it sounds this might be required if we are designing a synchonour system with large processing times per service.

The underlying fact is that in v1 of WCF there is more than the knobs.
The underlying httpRuntime is also responsible for the connection and this knob also needs to be set to accept long calls and large execution times.

<system.web>
<httpRuntime executionTimeout="400000"/>
</system.web>

The next setting required to be done is on the client. We also need t specify the sendTimeout if we know that the send process is going to take a while.

ChannelFactory<ServiceReference.IService1> cf = new ChannelFactory<Client.ServiceReference.IService1>("BasicHttpBinding_IService1");

BasicHttpBinding b = (cf.Endpoint.Binding as BasicHttpBinding);

b.SendTimeout = new TimeSpan(0,6,10);

IService1 proxy = cf.CreateChannel();

try

{

Console.WriteLine(proxy.GetData(6));

Console.ReadLine();

}

finally

{

if((proxy as IChannel).State == CommunicationState.Opened)

(proxy as IChannel).Close();

}

Applying Service Orientation through WCF

Sajay — Sun, 24 Jun 2007 19:00:00 GMT

I was supposed to talk more about Development processes at Techmela on this Topic. But then I decided to share one particular aspect that i have learned over and over again when dealing with customers who have gone and developed multi-layered services and clients. There are some common aspects that i have noticed with many customers and queries.

Being a consultant in this space does teach you a lot of problems that customers face and you being to see patterns. I would have liked to leave solutions for each one of these points mentioned but realized that its very situational and depends on a lot of factors. Solutions are mostly specific to each requirement and there have been very few that can be just solved with out of the box patterns

Durable Tokens Across Services - Share your tokens

Sajay — Fri, 20 Apr 2007 09:32:00 GMT

There seems to be quite a number of time when you want to perform your authentication once and then you just go ahead the want to just call a service without performing the authentication again.

What are some advantages of this ?

1. You get to manage your authentication independently. - Also results in a single point of failure.

2. You can build solutions that can leverage an existing authentication framework and save time building that

3. You could have many services talk to each other and share credentials across and build connected systems as they don't have to manager user bases or authentication stores independently. Still there are dependency on user details but the application is freed from worrying about the actual authentication scheme.

4. And many more depending on your scenario :)

The SDK already has a DurableTokenSecurity Sample and in this post the only modification to that is the way the token cache is built on the client side. If you haven't yet understood the sample, then the you need to understand how the token is picked up and cached and replayed back.

Understanding Durable Tokens

The endpoint has a ClientCredentials behavior. You have to remove the default behavior and slap on your own. the client credentials is also responsible for retrieving the credentials for a service and sending it out with the service request.

factory.Endpoint.Behaviors.Remove<ClientCredentials>();

factory.Endpoint.Behaviors.Add(durableCreds);

The durable credential extends the ClientCredentials and has a reference to the cache that supplies the tokens and stores the token. The SDK sample comes with multiple forms of cache. A file cache and in memory cache. You can choose what cache you would like as they have the separate uses.

Next step would be to understand how the cache is used. The DurableIssuedSecurityTokenProvider implements the SecurityTokenProvider which is responsible for retrieving the token from the cache and uses the instance of the cache that is provided and calls the Add or TryGet that queries the concrete implementation of the cache. The GetTokenCore is what is used to retrieve the token from the cache.

protected override SecurityToken GetTokenCore(TimeSpan timeout)

On walking through the implementation of the cache you see that the cache add or removes the tokens and the key is what governs how the tokens are retrieved. In the actual sample the key is is qualified as shown.

Key key = new Key(target.Uri, (issuer == null) ? null : issuer.Uri);

and when the URI is used.

Changes to the Cache to share the Tokens across Multiple Service

Changing the key pretty much increases or changes the total scope of the token. if you changed the key to something like this

Key key = new Key(new Uri(target.Uri.GetLeftPart(UriPartial.Authority)),
(issuer == null) ? null : issuer.Uri);

This pretty much says that the same token can be used across multiple services with the same Authority(usually the domain name in this case).

So there we go we have increased the scope and in this case but you can write your own key building logic and even use something like a predefined list of keys to retrieve the tokens and share them across multiple services.

Check out the source attached and let me know in case you have some queries around this.

WCF Performance Comparison

Sajay — Thu, 05 Apr 2007 05:54:36 GMT

I have been waiting for this article for quite some time. Read all about it here

Thoughts on BasicHttpBinding, Security and SSL

Sajay — Fri, 05 Jan 2007 07:32:00 GMT

BasicHttpBinding, can there be security?. Yes! The point is this binding can be secured and that too with transport level security and restricted to https(SSL) or message level Check this post for details. http://blogs.msdn.com/drnick/archive/2006/06/01/612672.aspx.
Another common question is about user name security tokens. Please note that user name security tokens cannot be send on the clear. There are quite a few posts on the forums with this quesiton. The point is you need to have a security binding element within the binding you use to send this token across cause WCF doesnt allow clear text tokens to be transfered over the wire. Now this being said, the security may be at the transport or the message layer and not restricted to just message. This means you can deploy something with SSL and use text encoding and send a UserNamePassword token cause the security here is done by the trasnport. The only requirement is that there be a security binding element somewhere in the channel stack so that there is a gurantee that the user name and password is securely tranfered across the wire.
Do we need valid certs to use SSL? No we dont need a valid cert. The Sample below shows how you can use a self made cert to setup SSL on a port using netsh on vista and send a username token. Please note this is not production code and only shows the capabilites. Ideally you require IIS to be setup with a valid cert and make sure your requested name matches the cert.

This sample basically shows the use of the PermissiveCertificatePolicy that enables use of self made certs.

You need to setup SSL for your security element. Username tokens cannot be send clear ont he wire.

If you are on vista setup the certificate for SSL using netsh with something like this.

C:\Windows\system32>netsh http add sslcert ipport=0.0.0.0:8080 certhash=05eef6e118e516869a75f96057a2310ecdb8a44f appid={00112233-4455-6677-8899-AABBCC
DDEEFF}

SSL Certificate successfully added

The code blow shows a self hosted service with a permissive certificate policy so that you can use certs made using makecert etc.

using System;

using System.Collections.Generic;

using System.Text;

using System.ServiceModel;

using System.ServiceModel.Description;

using System.Security.Cryptography.X509Certificates;

using System.Net;

using System.IdentityModel.Selectors;

namespace SimpleUNP

{

[ServiceContract]

interface IService

{

[OperationContract]

string Do();

}

public class ServiceImplementation : IService

{

public string Do()

{

return "Hello Service";

}

public class CustomUNPValidator : UserNamePasswordValidator

{

public override void Validate(string userName, string password)

{

Console.BackgroundColor = ConsoleColor.Red;

Console.WriteLine("Username at the service : " + userName);

Console.ResetColor();

}

class Program

{

static void Main(string[] args)

{

string addr = "https://localhost:8080/MyService";

Uri[] baseAddrs = new Uri[] { new Uri(addr) };

BasicHttpBinding binding = new BasicHttpBinding();

binding.Security.Mode = BasicHttpSecurityMode.TransportWithMessageCredential;

binding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.UserName;

using (ServiceHost sh = new ServiceHost(typeof(ServiceImplementation), baseAddrs))

{

sh.Description.Behaviors.Find<ServiceDebugBehavior>().IncludeExceptionDetailInFaults = true;

sh.Credentials.UserNameAuthentication.UserNamePasswordValidationMode = System.ServiceModel.Security.UserNamePasswordValidationMode.Custom;

sh.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator = new CustomUNPValidator();

sh.AddServiceEndpoint(typeof(IService), binding, "");

sh.Open();

Console.WriteLine("Host listening on " + sh.BaseAddresses[0].AbsolutePath);

try

{

// WARNING: This code is only needed for test certificates such as those created by makecert. It is

// not recommended for production code.

PermissiveCertificatePolicy.Enact("CN=localhost");

ChannelFactory<IService> cf = new ChannelFactory<IService>(binding, addr);

cf.Credentials.UserName.UserName = "TestUsername";

cf.Credentials.UserName.Password = "";

IService proxy = cf.CreateChannel();

Console.WriteLine(proxy.Do());

}

catch (Exception ex)

{

}

// WARNING: This code is only needed for test certificates such as those created by makecert. It is

// not recommended for production code.

class PermissiveCertificatePolicy

{

string subjectName;

static PermissiveCertificatePolicy currentPolicy;

PermissiveCertificatePolicy(string subjectName)

{

this.subjectName = subjectName;

ServicePointManager.ServerCertificateValidationCallback +=

new System.Net.Security.RemoteCertificateValidationCallback(RemoteCertValidate);

}

public static void Enact(string subjectName)

{

currentPolicy = new PermissiveCertificatePolicy(subjectName);

}

bool RemoteCertValidate(object sender, X509Certificate cert, X509Chain chain, System.Net.Security.SslPolicyErrors error)

{

if (cert.Subject == subjectName)

{

return true;

}

return false;

}

TransportWithMessageCredentials - I need to know who is knocking on my door.

Sajay — Sat, 30 Dec 2006 19:28:00 GMT

The point to be noted here is that even though the security facts of comminication like integrity and confidentiality is taken care of by the transport we might not get enough information from the client as to "Who are you?". Now for this case you need to add in some credentials about the clients.

It is exactly for this that the security mode of transport with message credentials might come in handy. Now when using SSL for security, mostly for IIS hosted apps you might require to send the user credentials, windows identity,username etc. This basically can be achieved by specifying the binding as follows.

The point is that there is no credentials required on the transport and the credentials can be send at the message level and WCF would actually identitify the windows credentials used and you can check the ServiceSecurityContext of the current operation context and obtain the identity of the user.

The other points to be noted in this sample http://msdn2.microsoft.com/en-us/library/ms751427.aspx that shows transport security is that the certificate has to be setup on IIS. Please not that

PermissiveCerticificatePolicy.Encat has to happen for the process to use the sample certs that are created by the scripts and you
the same SSL certificate has to be set up.

I have modified the sample to show 2 scenarios, one with windows credentials and the other with a custom usename validator.

Adding a Message Header without using a MessageContract

Sajay — Sat, 30 Dec 2006 06:44:00 GMT

Using Message contracts is quite a straight forward way of creating and adding message headers.But then again you might just want to add a header without going downt that route like this post by Kenny. You generally come across 2 scenarios where you want to add headers in every message or just for a particular set of operations that you would like to control. The code below shows you how to add headers for every operation using a Client behavior or just to a particular set calls using the OperationContextScope which would give you access to current operation context on the client side.

You can modify the outgoing message headers on using the OperationContext. If you are using a client instance(generated proxy then you can uset he inner channel ref: article) or else you can just use the channel factory and get the client channel.

Here the first operation is called without the a scoped header and the header is added only after the first call to the proxy happens. and the same operation can now access the header newly added header.

using System;

using System.Collections.Generic;

using System.Text;

using System.ServiceModel;

using System.ServiceModel.Description;

using System.ServiceModel.Channels;

using System.ServiceModel.Dispatcher;

namespace SoapHeaderSample

{

[ServiceContract]

public interface ICalculatorService

{

[OperationContract]

int Add(int a, int b);

}

public class CalculatorService : ICalculatorService

{

public int Add(int a, int b)

{

//Get the header in the operation

MessageHeaders hdrs = OperationContext.Current.IncomingMessageHeaders;

int hdrIndex = hdrs.FindHeader("BehaviorHeader", "BehaviorHeaderNS");

int scopeHdrIndex = hdrs.FindHeader("ScopedHeader", "ScopedHeaderNS");

Console.WriteLine("HeaderContent at service:" + hdrs.GetHeader<string>(hdrIndex));

if(scopeHdrIndex >=0)

Console.WriteLine("ScopedHeader Content at service:" + hdrs.GetHeader<string>(scopeHdrIndex));

return a + b;

}

class Program

{

static void Main(string[] args)

{

string addr = "net.tcp://localhost:5050/ServiceModelSamples";

Uri[] baseAddrs = new Uri[] { new Uri(addr) };

using (ServiceHost host = new ServiceHost(typeof(CalculatorService), baseAddrs))

{

host.AddServiceEndpoint(typeof(ICalculatorService), new NetTcpBinding(), "");

host.Open();

Console.WriteLine("Host listening at " + host.BaseAddresses[0]);

Console.ReadLine();

//Call the service

ChannelFactory<ICalculatorService> cf = new ChannelFactory<ICalculatorService>(new NetTcpBinding(), addr);

cf.Endpoint.Behaviors.Add(new EndpointBehaviorAddHeader());

ICalculatorService proxy = cf.CreateChannel();

try

{

using (OperationContextScope scope = new OperationContextScope(proxy as IClientChannel))

{

Console.WriteLine("\tResult " + proxy.Add(10, 100));

//Add the new header for this operation

Console.WriteLine("\nNew Header added.\n");

OperationContext.Current.OutgoingMessageHeaders.Add(

MessageHeader.CreateHeader("ScopedHeader", "ScopedHeaderNS", "Scoped header value"));

Console.WriteLine("\tResult " + proxy.Add(10, 100));

}

finally

{

IChannel c = proxy as IChannel;

if(c !=null && c.State == CommunicationState.Opened)

c.Close();

}

public class EndpointBehaviorAddHeader : IEndpointBehavior

{

public void AddBindingParameters(ServiceEndpoint endpoint, BindingParameterCollection bindingParameters)

{}

public void ApplyClientBehavior(ServiceEndpoint endpoint, System.ServiceModel.Dispatcher.ClientRuntime clientRuntime)

{

clientRuntime.MessageInspectors.Add(new MessageInspectorAddHeader());

}

public void ApplyDispatchBehavior(ServiceEndpoint endpoint, System.ServiceModel.Dispatcher.EndpointDispatcher endpointDispatcher)

{}

public void Validate(ServiceEndpoint endpoint)

{}

}

public class MessageInspectorAddHeader : IClientMessageInspector

{

public void AfterReceiveReply(ref Message reply, object correlationState)

{}

public object BeforeSendRequest(ref Message request, IClientChannel channel)

{

MessageHeader hrd = MessageHeader.CreateHeader("BehaviorHeader", "BehaviorHeaderNS", "BehaviorHeader header content");

request.Headers.Add(hrd);

return null;

}

Checking the SIDs in the WindowsClaimSet

Sajay — Wed, 27 Dec 2006 21:06:00 GMT

In continuation to my post of SAM vs PP, we concluded that to avoid fractured policy checking we can still check if the user belongs to a particular group by checking the occurence of an SID in the WindowsClaimSet that he submits to the service.

One of the problems that I faced to view the SID of an object was in the SDDL format for direct comparison. The Sid is basically represented as a SDDL string. If someone can point me to some proper tool besides these, it would be greatly helpful. these are the one's i used.
You can use GetSID.exe that is a part of the the support tools that ship with Windows 2003 to find the SID as SDDL string. Or there is another tool PSID from SysInternals that helps you get this string pretty easily and both are command line tools.

Once you get this value you can compare the Claim Set for the occurence of this SID to figure out if the user provided a claim.

using System;
using System.Collections.Generic;
using System.Text;
using System.ServiceModel;
using System.IdentityModel.Policy;
using System.Collections.ObjectModel;
using KBE.Service.Diagnostics;
using System.Security.Permissions;
using System.Security.Principal;
using System.IdentityModel.Claims;
using System.Configuration;

public class CustomServiceAuthorizationManager : ServiceAuthorizationManager
{
    protected override bool CheckAccessCore(OperationContext operationContext)
    {
        System.Diagnostics.Debug.WriteLine("CheckAccess -- Started" + Utility.GetUserDetails());
        try

{
foreach (ClaimSet cs in OperationContext.Current.ServiceSecurityContext.AuthorizationContext.ClaimSets)

            {
                if (cs is WindowsClaimSet)
                {
                    foreach (Claim c in cs)
                    {
                        if (c.ClaimType == ClaimTypes.Sid)
                        {
                            SecurityIdentifier sid = c.Resource as SecurityIdentifier;

                            if (sid != null)
                            {
                                // Check if the SID is a claim for the group
                                if (sid.Value == ConfigurationManager.AppSettings["AuthorizationPermissionRole"])
                                    return true;

                            }
                       }
                    }
                }
            }
            return false;

        }
        catch (Exception ex)
        {
            System.Diagnostics.Debug.WriteLine("\tException : " + ex.Message);
            throw;
        }
        finally
        {
            System.Diagnostics.Debug.WriteLine("CheckAccess -- Ended");
        }
    }

    protected override ReadOnlyCollection<IAuthorizationPolicy> GetAuthorizationPolicies(OperationContext operationContext)
    {
        return base.GetAuthorizationPolicies(operationContext);
    }
}

Configuraiton Entry

</appSettings>

ServiceAuthorizationManager and PrincipalPermission

Sajay — Fri, 22 Dec 2006 06:33:00 GMT

You may face a problem when trying to check for Principal permission and demand in the CheckAccessCore of the SerivceAuthorizationManager and you might see a security exception. This is primarily because the threads principal is not set when this demand check in the SAM happens.

You can however do a Principal Permission check within the operation either by a Demand() operation for the principal or delcaratively in code. This what Brent Schmaltz who helped with this issue said.

"There are two advantages of the SAM approach it is:

centralized and every call will be routed through there. This avoids what I like to call the ‘fractured policy system” where one needs to touch all access points to understand the authorization policy. This is similar to the File System. For example with this method it is difficult to answer: Can X access Y, without having X attempt to access Y?
called way up the stack and is hence has a performance advantage."

The solutions was to check the WindowsClaimSet. This claim set holds all the SIDs that is required and we can check the claim set if the SID of the group you require exits and bump the user out and authorizer the user using this. Basically you have a collection of SecurityIdentifiers in the WindowsClaimSet.

Next time - Checking SID's in the WindowsClaimSet