1 Hyderabad Techies Microsoft Developer User Group - Hyderabad Introduction to.NET Services “ Sharing is our Passion “

Introduction to.NET Services Nithin Mohan T K Technology Specialist / Member Microsoft Developer UG – Hyderabad Blog… Mail…

3.NET Services Extending.NET technologies to the cloud Open and accessible REST, SOAP, RSS, Atom Publishing Protocol Class libraries for.NET, Java and Ruby Easy-to-use from.NET Your skills move forward Initial focus on two key developer challenges Application integration Access control in a federated world

4 Service Bus Key developer challenges Want to make it easy and secure for partners to use your application Don’t always know the characteristics or scale of the integration Partners, customers & users have devices and services running behind firewalls Approach Provide a high-scale, highly-available “Service Bus” that supports open Internet protocols

5 Service Bus The Internet Service Bus pattern Service Registry Connectivity (Relay & Direct Connect) Publish/Subscribe “Under the Hood” Bindings Integration with Access Control

6 The Service Bus Pattern Service Registry ApplicationsApplications Federated Identity and Access Control ClientsClients Cloud Services On-PremisesOn-Premises Desktop, RIA, Web StorageStorageBillingBilling …… ComputeCompute Corp Service Your Services Application Messaging Patterns Connectivity Fabric ESB

7 Service Bus Capabilties Service Registry Stable URIs for services Discovery – supports the Atom Publishing Protocol Connectivity Fabric NAT and firewall traversal Mobile and intermittently connected receivers Application Messaging Bi-directional and peer-to- peer communication Publish and subscribe Multicast to receivers through a stable URI Message buffering Web integration, queues and routers

8 Service Registry [http|sb]://solution.servicebus.windows.net/accounts/svc/… Root solution. servicebus.windows. net solution. servicebus.windows. net accounts contoso … … svc Service Registry Root Multi-Tenant The service registry provides a mapping from URIs to services

9 Connectivity Key capabilities Relay Ensure applications connect Direct connect Shortcuts for efficiency Queues and Routers Messages can be stored and forwarded Available via HTTP, REST and ATOM Available in.NET via WCF Bindings

10 Relay One-Way Connection sb://solution.servicebus.windows.net/service/endpoint Sender Receiver Outbound SSL-Secured TCP 828 Connection to Relay Rendezvous Endpoint One-Way Messages through TCP Tunnel

11 Relay sb://solution.servicebus.windows.net/service/endpoint Direct Connections SenderReceiver - Outbound SSL-Secured TCP 828 Connection to Relay - Out-of-Band Protocol to negotiate Direct Connection Upgrade to Direct when possible

12 Publish/Subscribe Builds on the relay and direct connect connectivity capabilities “Connected multicast” for current listeners Or can use queues and routers to get long-lived, “store and forward” message routing

13 Relay sb://solution.servicebus.windows.net/service/endpoint Basic Publish/Subscribe Sender Receiver Outbound SSL-Secured TCP 828 Connection to Relay Rendezvous Endpoint One-Way Messages through TCP Tunnel Receiver

14 Queues Service Bus Sender Receiver sb://solution.servicebus.windows.net/a/b/ HTTP(S) / net.tcp Backend Naming Routing Fabric Frontend Nodes HTTP(S) Dequeue Msg Dequeue Route Manager Queue Policy

15 Routers Service Bus Sender sb://solution.servicebus.windows.net/a/b/ HTTP(S) / net.tcp Backend Naming Routing Fabric Frontend Nodes Msg Route Manager Router Policy Receiver Msg Subscribe

16 Service Bus The Internet Service Bus pattern Service Registry Connectivity (Relay & Direct Connect) Publish/Subscribe “Under the Hood” Bindings Integration with Access Control

17 Rich Set of Connectivity Bindings WCF BindingNew Service Bus Binding BasicHttpBindingBasicHttpRelayBinding WebHttpBindingWebHttpRelayBinding WSHttpBindingWSHttpRelayBinding WS2007HttpBindingWS2007HttpRelayBinding WSHttpContextBindingWSHttpRelayContextBinding WS2007FederationHttpBindingWS2007FederationHttpRelayBinding NetTcpBindingNetTcpRelayBinding NetTcpContextBindingNetTcpRelayContextBinding n/aNetOnewayRelayBinding n/aNetEventRelayBinding

18 Relay RFC2616-Compliance Sender Receiver RFC2616 compliant HTTP stack Only 2 concurrent connections per domain 2 concurrent polling clients starve dual reply-to path

19 Relay HTTP Connection Workaround Sender Receiver Single-threaded polling receiver; multiplexed message batch retrieval; MT local dispatch and fan-out Multiplex messages through volatile message buffer for pickup STA Synchronized reply-to connections

20 Relay Access Control Principles Access Control is governed by Access Control Rules Composes cleanly with SOAP-over-HTTP SOAP 1.1, SOAP 1.2 HTTP clients able to send messages through the relay with minimal extra effort WS-Security header can used for end-to-end application level security - optional Composes cleanly with transport-only message protection Support any SOAP 1.2 Basic Profile 2.0 compliant client

21 Unauthenticated Senders Unauthenticated ‘Send’ option Client do not need to acquire tokens for communicating through the relay Supports plain Basic Profile SOAP requests Opt-In Policy set by listening services Enables services to choose between Relay- based access control and locally-enforced end- to-end access control

22 Service Bus Summary Service Registry Relay and direct connect connectivity Publish/Subscribe Integrated with Access Control services

23 Access Control Key developer challenges Many identity providers, many vendors, many protocols, complex semantics – tricky to get right Application strewn with one-off access logic Hard to get right, not agile, not compliant, many dead ends Approach Automate federation for a wide-range of identity providers and technologies Factor the access control logic from the application into manageable collection of rules Easy-to-use framework that ensures correct token processing

Access Control Interactions Your Access Control Instance (a hosted STS) Your Access Control Instance (a hosted STS) Relying Party (Your App) Relying Party (Your App) 2. Send Claims 4. Send Token (output claims from 3) 5. Send Message w/token 0. Certificate exchange; periodically refreshed Requestor (Your Customer) Requestor (Your Customer) 1. Define access control rules for a customer 6.Claims checked in Relying Party 3. Map input claims to output claims based on access control rules

Hosted Security Token Service Web Portal and API Define and manage Application scopes, access control rules, claim types, signing and encryption keys Access control rules Rules are defined within an application scope Rules can be chained e.g. bob  manager, and manager  allowed Simple model: the output security token is a collection of claims based on the claims in the incoming token

Standards The Access Control Service is fully standards compliant WS-Trust and WS-Federation, SAML A.NET application can easily handle the tokens and claims from the Access Control Service Windows Identity Foundation (aka Geneva Framework) provides a.NET API for doing this Microsoft has been working with vendors such as Sun and Tivoli to make sure everything works correctly on other platforms

27 Target Service AC.W.N STS Client RST/RSTR AC.W.N Credential appliesTo: Target Endpoint AC.W.N Credential appliesTo: Target Endpoint Relay and End-to-End Security Relay P P P P Requires AC.W.N Token AC.W.N Credential appliesTo: Relay Endpoint AC.W.N Credential appliesTo: Relay Endpoint WS-Sec Hdr P P AC.W.N Credential appliesTo: Relay Endpoint AC.W.N Credential appliesTo: Relay Endpoint relayToken WS-Sec Hdr

28 Access Control Summary Flexible, rules-driven access control Rich support for a wide range of identity providers Easy to incorporate into existing applications Works with lots of other environments e.g. Sun’s Java Metro 1.3

29 Call to Action Go to the.NET Services Portal Create some solutions Try out the.NET Services SDKs Go to to get in depth sessionshttp:// Service Bus Access Control

30

31 Visit our website