If you have a WCF service exposing endpoints with the NetMsmqBinding, you may come across my old pal, error code 0xc00e002f when you have web application clients. If you’ve already had your required interactive login on the web server with your AppPool’s service account and have already registered your AppPool service account’s user certificate for message queuing, then you should be ok.

If you are using IIS 7 or 7.5, there is one more piece to the puzzle. Go into Advanced Settings on your Application Pool, and find “Load User Profile” under the Process Model section. “Load User Profile” on these latest versions of IIS needs to be true to get your service account’s user certificate passed to MSMQ. I fought this for a while before finally finding it. And now… :)

I’m not sure if what I’m doing is actually the right way to create a “user control” in ASP.NET MVC, but it’s worth sharing this tidbit either way. Instead of using a MVC View User Control to create a hidden field, a text box, two anchors, and three JavaScript functions, I chose to put it all in a HtmlHelper in which I write out the HTML and JavaScript myself. Everything worked fine except the almost magical auto-repopulating of the hidden and text fields after a post that didn’t work as expected as in a typical MVC View Page.

The situation: I have a page that needs to be called as a popup from many pages in my MVC application. The page allows single or multiple selection of “items” driven by an XML file. In the event that one day, almost always immediately, I have two or more of these “controls” on one view page, I need the two fields and the three JavaScript functions to have unique names so they don’t cross paths and cause unexpected behavior. I had an ASP.NET User Control to do this in plain old ASP.NET (POAN) since v1.1, and I can’t live without it.

The confusion: If I were to place the hidden, textbox, anchors, and JavaScript functions directly in the calling page, something magical happens after a post. If the controls had values before the post, they appear to magically retain there values after the post. It wasn’t until a colleague of mine, Sat, and I dug into Reflector for a while did we realize what was happening. Html.TextBox, Html.Hidden, and others all do something similar to auto-magically re-populate their values after the post. Since I’m writing out my fields as <input type=”hidden”/> and <input type=”text”/>, the magic doesn’t happen.

      NOTE: The magic will also not happen if you just write <input type=”text”/> on the page. It only happens if you use Html.TextBox.

The solution: I am still new to MVC and still trying to wrap my head around the “right way” to do things. Reflector showed that the HtmlHelpers all looked at the ModelState in the ViewData before rendering their HTML. They looked for their value by key (key being the control/tag name), and, if present, used that as the control/tag’s value. Bing! Maybe I should do the same thing. So just before I go to town with TagBuilder to assemble my controls/tags, I look in the ViewData’s ModelState for my value. If it is there, it must have been posted there by me (my control).

Works like a charm! Now my hidden, textbox, two anchors, and three JavaScript functions are bundled nicely inside of an HtmlHelper class that looks and feels like I’m using a built-in ASP.NET MVC HtmlHelper class. Most importantly, I have the pleasure of typing only this on all my consuming pages.

I’ve been talking about Geneva for a long time. I got the basics down earlier in the year. I tried to come up with my own set of sample apps, but failed to get anywhere. With the official release, and renaming to Windows Identity Foundation (WIF), I have renewed inspiration.

I read Michele Leroux Bustamante’s MSDN magazine article, Claim-Based Authorization with WIF, last night. After reading the article, I was confident that I could get a claims-aware WCF service stood up with a custom STS in a matter of hours. Today I downloaded and installed WIF. I also installed the WIF SDK and all of the prerequisite hotfixes. I perused the readme files and looked through some of the samples code. Everything is layed out sensibly, the samples are commented sufficiently, and the samples include setup and cleanup batch scripts when necessary.

The samples include:

Quick Start

1. Simple Claims Aware Web Application
2. Simple Claims Aware Web Service
3. Simple Web Application With Information Card SignIn
4. Simple Web Application With Managed STS
5. Claims Aware Web Application in a Web Farm
6. Using Claims In IsInRole

End-to-end Scenario

1. Authentication Assurance
2. Federation For Web Services
3. Federation For Web Applications
4. Identity Delegation
5. Web Application With Multiple SignIn Methods
6. Federation Metadata

Extensibility

1. Claims Aware AJAX Application
2. Convert Claims To NT Token
3. Customizing Request Security Token
4. Customizing Token
5. WSTrustChannel
6. Claims-based Authorization

All of the samples I’ve run through so far are great. The only thing that I’m not in love with is all the XML required to wire this stuff up. Maybe some Juval-style extensions would make it less painful.

One more thing… it looks like all of the XP users will finally have to upgrade. WIF only works with Vista, Win7, and Win2008. I heard that Win2003 compatibility will arrive in December.

Download Windows Identity Foundation

Download Windows Identity Foundation SDK

Using the NetTcpBinding on a WCF service is secure by default. Unless you override the default settings, you will enjoy Transport Security using Windows authentication and the EncrpytAndSign protection level. When you create a new WCF service library, Visual Studio creates a config file with the following identity block:

 

If you wipe this config file clean like me to write a much cleaner and shorter config file, this identity block is the first thing to go. Sadly, most people also add a binding configuration with <security mode=”None”/>. I have done this too in an Intranet environment. The samples and book examples out there don’t show how to write an actual production environment service that cares for different machines in the same domain. While the default settings work when testing on your local machine, they don’t work in a simple Intranet environment.

Most of the difficulty I experienced when starting to work with WCF was getting security to work with the TCP binding. Everything worked so easily during development, but everything broke down once deployed to the development server. It didn’t help that the only errors I saw were timeout exceptions. If I had known about the Service Trace Viewer, I could have easily determine the cause and Googled (Bing wasn’t around then) for a solution. Instead, I chose the easier (and much less secure) way out… rely on my firewall and turn security off.

As mentioned before, the NetTcpBinding is secure by default with transport security using Windows authentication. The problem most experience when moving the service to a different machine is caused by NT authentication failing. If you use svcutil to generate your client config file and your host doesn’t have the identity block mentioned above, svcutil will not add a key piece of information to the client config file. The missing element is, you guessed it, the identity block. Without it, you will likely get an exception and see a stack trace similar to this:

[System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed, see inner exception.]
...
[System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception.]
...
[System.ComponentModel.Win32Exception: The target principal name is incorrect.]
...

If you add tracing to your client, you will see that without specifying an identity block WCF will make the call with a DNS identity set to the name of the host. Notice the blue arrows.

You can see that the EndpointReference does not have an <Identity> block. Without that identity block, WCF cannot create a valid ServicePrincipalName. You can find this in Reflector, following this path:

• System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider+WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade() – This is where the SecurityNegociationException is being thrown.
• System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider+WindowsStreamSecurityUpgradeInitiator.InitiateUpgradePrepare() – This method populates an EndpointIdentity and ServicePrincipalName to be used immediately after for NT authentication.

When the identity is not specified, it falls back to trying to create an SPN from the host address. I have seen this work on a machine that has two DNS names, using the DNS name that does not match the NETBIOS or AD name for the machine. I’m not exactly sure why that works.

Having any of the following identity blocks in your client config file will cause WCF to take the first path that successfully creates an SPN needed to perform NT authentication in the AuthenticateAsClient method called from OnInitiateUpgrade():

• <dns value=”serviceHostName”/>
• <dns/>
• <servicePrincipalName value=”domain\hostServiceUserAccount”/>
• <servicePrincipalName/>

Having these <Identity> settings in your client config file adds the appropriate <Identity> settings in the <EndpointReference> used when opening the channel.

Security seems more mysterious when going rogue and writing your own config files. If you go rogue, make sure you use the appropriate <Identity> blocks. With this mystery solved, <security mode=”None”/> is a thing of the past. Now we can keep our services secure in an Intranet environment.

I was privileged to attend the IDesign WCF Master Class last week. It only comes to the USA one time each year, and is presented by the one and only Juval Lowy. The class is held at the training center on the Microsoft Silicon Valley campus in Mountain View, CA. Five very intense days of WCF covering all aspects of WCF from essentials like the ABCs to the most intricate details about advanced topics like concurrency, security, transactions, and the service bus.

What we’ve been told sold about WCF from Microsoft is truly just the tip of the iceberg. Juval presents countless examples that prove WCF is not just about web services. WCF is the evolution of .NET, providing world-class features that no class should ever be without.

Demos, samples, and labs are presented using .NET 3.5 and 4.0 with an emphasis on the new features and functionality in 4.0. Discovery and announcements are the most underrated and unknown new features of WCF 4.0. After seeing Juval’s demos on discovery and announcement, I can’t imagine creating services without them.

More than all of the WCF content, the class gives you a lot to think about regarding architecture, the framework, and engineering principles. Juval’s mastery of .NET is evident in his ServiceModelEx library that extends almost all aspects of WCF and the service bus. His “one line of code” motto makes it possible for all of us to configure our WCF services with ease. The ServiceModelEx library is a good example for all developers to know and understand how to “do .NET” the right way. It exemplifies the best of what .NET and WCF have to offer.

Check out the IDesign website to get the WCF Resource CD (containing many of the examples and demos from the class). Also note the next class dates and sign up for the IDesign newsletter.

Thank you, Mikael Sand (and Bing)!

http://blogical.se/blogs/mikael_sand/archive/2009/08/28/configuring-ws-atomic-transaction-support-in-windows-7-64-bit.aspx

The 2009 Jacksonville Code Camp was a great success. Many thanks to Bayer, Brandy, and everyone else that made it happen. The bar has been set really high for future Jacksonville code camps, and for the rest of Florida too.

My session on Transactional WCF Services went well. Many great questions and compliments after the session. If you attended and have any unanswered questions, please email me.

You can download the session files below. It contains staged versions of all of the transaction modes we discussed. It also contains a tracing solution and tracing result files to view the client and host tracing files in Client/Service mode. Also see my previous post on using the Service Trace Viewer. It also contains a few demo projects that we didn't get to in the one-hour session.

Files/Solutions included in Session Archive:

• PowerPoint slides
• Transaction Promotion Code Snippet
• Testing database backup
• Testing SQL script (query and cleanup between tests)
• IDesign ServiceModelEx Project (used by all included Solutions)
• Code Demo Solutions

Code Demos include:

1.	TransactionScope - Shows how single/multiple resource managers affect which Transaction Manager is chosen to handle the scoped transaction. Also gives first look at transaction promotion detection.
2a.	Mode None - WCF transaction mode with which no transactions are created or flowed from the calling client.
2b.	Mode Service - WCF transaction mode with which no transactions are flowed from the calling client, but a transaction is created for your service operation.
2c.	Mode Client - WCF transaction mode with which a transaction is required to be flowed, and the service will only use the client transaction.
2d.	Mode Client/Service - WCF transaction mode with which a client transaction will be flowed and used by the service, if available. If no client transaction is flowed, a transaction will be provided automatically for the service operation.
3.	Explicit Voting - Shows how explicit voting with a session-mode service is performed using OperationContext.Current.SetTransactionComplete().
4a.	Testing Various Resource Managers - Shows how a client can use a single TransactionScope to call several services (some transactional, some non-transactional), a database stored procedure, and an IDesign volatile resource manager Transactional<int>.
4b.	Testing Services - Provides a host project for a transactional service and a non-transactional service used in 4a.
5a.	Tracing - Same as 2d. modified with the additional app.config settings in the client and host projects to allow for service tracing to .svclog files.
5b.	Tracing Results - Stored results from executing 5a. in case you don't want to load the database and actually run the projects. The .stvproj file can be opened directly in the Service Trace Viewer. On the "Activity" table, click on the activity "Process action 'http://services/gotjeep.net/GpsTrackServiceContract/SubmitTrack'" then click on the "Graph" tab. You will see that the client and host activities where the arrow moves from client to host (send and receive message, respectively) show the OleTxTransaction in "Headers." The next activity in the host reads "The transaction '5bd25b08-848c-409d-9163-6303b9138382:1' was flowed to operation 'SubmitTrack'."

 

Download the session files:
TransactionalWCF.zip (854 KB)

JaxDug is doing something different this year having all sponsorship proceeds benefiting Wolfson’s Children Hospital. In addition to the sponsorship surplus going to Wolfson’s, there will also be a silent auction at the after-party at Sneaker’s Sports Grille.

There is a great session lineup with eight tracks having five hour-long sessions in each track. I’ll be presenting one session on Transactional WCF Services. It’s guaranteed to be a good geeky time, and I hope it will have record attendance this year.

 Register now!