Microsoft Australia Security Summit Deploying Applications with ClickOnce Andrew Coates Developer Evangelist Microsoft Australia Andrew Coates Developer Evangelist Microsoft Australia

Microsoft Australia Security Summit Community Things Brisbane.NET User Group 3 rd Tuesday of Month Gold Coast.NET User Group Irregular Community Dinner tonight 7:30 Royal Thai Orchid Little Cribb St, MILTON All Welcome Drinks earlier if you get there beforehand MSDN Connection Surf Board Brisbane.NET User Group 3 rd Tuesday of Month Gold Coast.NET User Group Irregular Community Dinner tonight 7:30 Royal Thai Orchid Little Cribb St, MILTON All Welcome Drinks earlier if you get there beforehand MSDN Connection Surf Board

Microsoft Australia Security Summit Agenda Introduction ClickOnce Basics Security Programming ClickOnce Introduction ClickOnce Basics Security Programming ClickOnce

Microsoft Australia Security Summit Introduction Deployment Problems Client applications can be fragile Will the installation of one application break another application? Traditional DLL-conflict problem Installing client applications is hard and expensive Must affect every client For both the initial installation and updates Web-based applications Solved many deployment issues, but there’s a “but" At the expense of a rich client experience Client applications can be fragile Will the installation of one application break another application? Traditional DLL-conflict problem Installing client applications is hard and expensive Must affect every client For both the initial installation and updates Web-based applications Solved many deployment issues, but there’s a “but" At the expense of a rich client experience

Microsoft Australia Security Summit Introduction Version 1.0 of the.NET Framework Addressed the issue of DLL conflict Introduced application isolation Controlled the versioning of shared components Began to address the ease-of-deployment issue Run executable files from URL or UNC HREF executable files Set the stage for ClickOnce Addressed the issue of DLL conflict Introduced application isolation Controlled the versioning of shared components Began to address the ease-of-deployment issue Run executable files from URL or UNC HREF executable files Set the stage for ClickOnce

Microsoft Australia Security Summit Introduction The Best of the Client and the Web WebClickOnce MSI Client Reach “No Touch” Deployment Low System Impact Install and Run per User Rich and Interactive Offline Access Windows Shell Integration Per-Computer and Shared Components Unrestricted Installation

Microsoft Australia Security Summit ClickOnce Basics Development Experience IDE support in Visual Studio 2005 Integrated with core project types Setup is not a post-development task Project Designer Publish pane Security pane Publish Wizard Copies the application to a Web server Server extensions through Microsoft FrontPage® FTP or network file share IDE support in Visual Studio 2005 Integrated with core project types Setup is not a post-development task Project Designer Publish pane Security pane Publish Wizard Copies the application to a Web server Server extensions through Microsoft FrontPage® FTP or network file share

Microsoft Australia Security Summit ClickOnce Basics Development Experience IDE support in Visual Studio 2005 Integrated with core project types Setup is not a post-development task Project Designer Publish pane Security pane Publish Wizard Copies the application to a Web server Server extensions through Microsoft FrontPage® FTP or network file share IDE support in Visual Studio 2005 Integrated with core project types Setup is not a post-development task Project Designer Publish pane Security pane Publish Wizard Copies the application to a Web server Server extensions through Microsoft FrontPage® FTP or network file share

Microsoft Australia Security Summit ClickOnce Basics Declarative Installation Application manifest Authored by the developer Describes the application Example: which assemblies constitute the application Deployment manifest Authored by the administrator Describes the application deployment Example: which version clients should use Application manifest Authored by the developer Describes the application Example: which assemblies constitute the application Deployment manifest Authored by the administrator Describes the application deployment Example: which version clients should use

Microsoft Australia Security Summit Web Page Link to Manifest Deployment Manifest 1.0  Application Manifest 1.1 Application Manifest ClickOnce Basics Update from the Web

Microsoft Australia Security Summit ClickOnce Basics Deployment Options Launched applications Application launches but doesn’t install No Start menu and no Add or Remove Programs Always updates on launch Installed applications Install from the Web, a UNC location, or a CD-ROM Start menu and Add or Remove Programs Variety of update options Launched applications Application launches but doesn’t install No Start menu and no Add or Remove Programs Always updates on launch Installed applications Install from the Web, a UNC location, or a CD-ROM Start menu and Add or Remove Programs Variety of update options

Microsoft Australia Security Summit ClickOnce Basics Deployment Options Launched applications Application launches but doesn’t install No Start menu and no Add or Remove Programs Always updates on launch Installed applications Install from the Web, a UNC location, or a CD-ROM Start menu and Add or Remove Programs Variety of update options Launched applications Application launches but doesn’t install No Start menu and no Add or Remove Programs Always updates on launch Installed applications Install from the Web, a UNC location, or a CD-ROM Start menu and Add or Remove Programs Variety of update options

Microsoft Australia Security Summit ClickOnce Basics Update Architecture Yes No Application Store Installed UpdateCheck? StartupSHIM My Application Deployment Framework Service MIME.application Launched

Microsoft Australia Security Summit ClickOnce Basics Update Options On application startup If an update is found, ask the user to update the application After application startup If an update is found, ask the user to update on the next run Required updates Specified by using the minimum required version Programmatic updating Integrate the update experience into the application On application startup If an update is found, ask the user to update the application After application startup If an update is found, ask the user to update on the next run Required updates Specified by using the minimum required version Programmatic updating Integrate the update experience into the application

Microsoft Australia Security Summit ClickOnce Basics Application Bootstrapper Installs the application prerequisites.NET FX, Microsoft DirectX®, MDAC, and so on Requires administrator rights Extensible architecture Manages reboots Install the ClickOnce application after the prerequisites Use ClickOnce for automatic updates No automatic updating of prerequisite components Installs the application prerequisites.NET FX, Microsoft DirectX®, MDAC, and so on Requires administrator rights Extensible architecture Manages reboots Install the ClickOnce application after the prerequisites Use ClickOnce for automatic updates No automatic updating of prerequisite components

Microsoft Australia Security Summit ClickOnce Basics Application Bootstrapper Installs the application prerequisites.NET FX, Microsoft DirectX®, MDAC, and so on Requires administrator rights Extensible architecture Manages reboots Install the ClickOnce application after the prerequisites Use ClickOnce for automatic updates No automatic updating of prerequisite components Installs the application prerequisites.NET FX, Microsoft DirectX®, MDAC, and so on Requires administrator rights Extensible architecture Manages reboots Install the ClickOnce application after the prerequisites Use ClickOnce for automatic updates No automatic updating of prerequisite components

Microsoft Australia Security Summit ClickOnce Basics The Bootstrapper in Action Setup.exe Dotnetfx.exe Web Server Mdac_typ.exe Custom.msi Bar.application Reboot Client PC Dotnetfx.exe Custom.msi Bar.application MDAC detected! Setup.exe  

Microsoft Australia Security Summit Building, Deploying and Updating a Client Application

Microsoft Australia Security Summit Security Secure Execution Environment (Sandbox) ClickOnce applications run in a sandbox by default Permissions are based on origin Internet, Intranet, or Full Trust Ensures that applications are safe to run Similar to Microsoft Internet Explorer and JavaScript Applications often need higher trust Call unmanaged code Access the file system or the registry Connect to a database Consume Web services ClickOnce applications run in a sandbox by default Permissions are based on origin Internet, Intranet, or Full Trust Ensures that applications are safe to run Similar to Microsoft Internet Explorer and JavaScript Applications often need higher trust Call unmanaged code Access the file system or the registry Connect to a database Consume Web services

Microsoft Australia Security Summit Security Determining Permission Requirements Security pane of Project Designer Use to manually configure permissions Permissions Calculator Calculates the least-required permissions Debug in the sandbox Debug applications with partial trust Exception Assistant Microsoft Intellisense® in the sandbox Filtered based on the security context Security pane of Project Designer Use to manually configure permissions Permissions Calculator Calculates the least-required permissions Debug in the sandbox Debug applications with partial trust Exception Assistant Microsoft Intellisense® in the sandbox Filtered based on the security context

Microsoft Australia Security Summit Security Determining Permission Requirements Security pane of Project Designer Use to manually configure permissions Permissions Calculator Calculates the least-required permissions Debug in the sandbox Debug applications with partial trust Exception Assistant Microsoft Intellisense® in the sandbox Filtered based on the security context Security pane of Project Designer Use to manually configure permissions Permissions Calculator Calculates the least-required permissions Debug in the sandbox Debug applications with partial trust Exception Assistant Microsoft Intellisense® in the sandbox Filtered based on the security context

Microsoft Australia Security Summit Security Trusted Application Deployment Establishes deployment authority One-time distribution Configures the trusted license issuer Trust licenses Issued by an authority Deployed with applications Application-developer tasks Obtain a trust license (.tlic file) Set the deployment ticket property Establishes deployment authority One-time distribution Configures the trusted license issuer Trust licenses Issued by an authority Deployed with applications Application-developer tasks Obtain a trust license (.tlic file) Set the deployment ticket property

Microsoft Australia Security Summit Security User Consent Model Users make trust decisions all the time Installing software from CD-ROMs Useful for targeting random computers Internet or unmanaged Intranet User is the administrator Request the required permissions When the application needs permissions that are higher than the sandbox Administrators can disable prompting through policy Users make trust decisions all the time Installing software from CD-ROMs Useful for targeting random computers Internet or unmanaged Intranet User is the administrator Request the required permissions When the application needs permissions that are higher than the sandbox Administrators can disable prompting through policy

Microsoft Australia Security Summit Security Secure Updates ClickOnce manifests are signed XMLDSIG Publisher key is needed to deploy updates Ensures that updates come from the original author Guarantees a unique application identity Only the original publisher can update Prevents the automatic deployment of viruses ClickOnce manifests are signed XMLDSIG Publisher key is needed to deploy updates Ensures that updates come from the original author Guarantees a unique application identity Only the original publisher can update Prevents the automatic deployment of viruses

Microsoft Australia Security Summit Configuring ClickOnce Security Permissions

Microsoft Australia Security Summit Programming ClickOnce Programming Scenarios Application updating Implement the Update Now menu item Match the client with back-end programs Customize when-to-update logic Limit updates to only early adopters Limit updates based on the server load On-demand download Progressive installation Shell with application plug-ins System.Deployment namespace ApplicationDeployment Application updating Implement the Update Now menu item Match the client with back-end programs Customize when-to-update logic Limit updates to only early adopters Limit updates based on the server load On-demand download Progressive installation Shell with application plug-ins System.Deployment namespace ApplicationDeployment

Microsoft Australia Security Summit Programming ClickOnce Programming Scenarios Application updating Implement the Update Now menu item Match the client with back-end programs Customize when-to-update logic Limit updates to only early adopters Limit updates based on the server load On-demand download Progressive installation Shell with application plug-ins System.Deployment namespace ApplicationDeployment Application updating Implement the Update Now menu item Match the client with back-end programs Customize when-to-update logic Limit updates to only early adopters Limit updates based on the server load On-demand download Progressive installation Shell with application plug-ins System.Deployment namespace ApplicationDeployment

Microsoft Australia Security Summit Programming ClickOnce Application Updating Control when and how the application updates CheckForUpdate GetUpdateCheckInfo Update Synchronous and asynchronous versions of methods Available only for applications that are deployed through ClickOnce Use IsNetworkDeployed Control when and how the application updates CheckForUpdate GetUpdateCheckInfo Update Synchronous and asynchronous versions of methods Available only for applications that are deployed through ClickOnce Use IsNetworkDeployed

Microsoft Australia Security Summit Programming ClickOnce On-Demand Download Group files in the manifest Put related files in the same group Download files as a group Marks files as optional in the manifest Optional files are not downloaded during the installation AreFilesLocal DownloadFiles Takes a group or file name Simultaneously delivery (synchronous or asynchronous) of multiple downloaded files Group files in the manifest Put related files in the same group Download files as a group Marks files as optional in the manifest Optional files are not downloaded during the installation AreFilesLocal DownloadFiles Takes a group or file name Simultaneously delivery (synchronous or asynchronous) of multiple downloaded files

Microsoft Australia Security Summit Implementing User-Initiated Updates

Microsoft Australia Security Summit Summary ClickOnce makes client-application deployment easy and safe Visual Studio bootstrapper facilitates the easy redistribution of prerequisites Visual Studio 2005 provides integrated developer support for ClickOnce ClickOnce APIs support a variety of application-update scenarios ClickOnce makes client-application deployment easy and safe Visual Studio bootstrapper facilitates the easy redistribution of prerequisites Visual Studio 2005 provides integrated developer support for ClickOnce ClickOnce APIs support a variety of application-update scenarios

Microsoft Australia Security Summit Thank you! Please fill in your evaluation forms

Microsoft Australia Security Summit © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Content created by 3 Leaf Solutions.

Microsoft Australia Security Summit