Hernan de Lahitte's blog

Acceptance Tests & Specflow

HernanDL — Tue, 15 May 2012 02:32:00 GMT

An interesting post from the CQRS project was posted about the use of Specflow and the project Acceptance tests.

Here you will find the captured experience for creating the tests scenarios and the two approaches used for implementing the specs written with Specflow.

I will add further details on this experience in a future post while we get closer to the final version of the project.

Stay tunned!

CQRS Journey V1 is live

HernanDL — Wed, 09 May 2012 17:25:00 GMT

For the last two month I've been working with the CQRS Journey team helping with the spec definitions and acceptance tests using Specflow which was a very interesting experience.

As you can see, this is basically a project from the Patterns & Practices group that shows an experience about an implementation of CQRS pattern into a reference implementation application.

You can find more fresh news and further details about this project in its blog.

In a future post I will highlight some of the experience and details of how we implemented the Acceptance Tests using Specflow within this project.

Stay tuned!

Web Service Software Factory 2010 Open Source CTP

HernanDL — Wed, 26 Oct 2011 11:01:00 GMT

As a follow up of the WSSF Modeling Edition there is a new "flavor" of this tool where the main news is the versioning plan. The basic idea is to release the source code to the comunity in an "open source" model so any user may be free to update and add new features.

As part of this move, there are some additions and fixes that you will get in this open source release (CTP as the time of this post).

GAX free (no more dependency with GAX)
WCF Security Code Analysis added from WSSF v2 and updated to FxCop version from VS2010
Bug fixes
No more WSSF solution template (the WSSF menu options will show up on any compliant project and will let add models and WCF/ASMX templates)
Translator recipe removed. Writing translators is up to the user or it might be added using MEF extensibility.

You can download it and get some other build steps from here.

Stay tuned for the "official announcement" in Don's blog.

WCF Data Services and Custom Authorization

HernanDL — Thu, 16 Jun 2011 10:33:00 GMT

In the last post about Decoding Messages in WCF Data Services I showed a code sample about how to decode an incoming WCF Message in a Data Service. In this case I will show how we can use this decoded message inside a ServiceAuthorizationManager derived class to perform some authorization depending on the content (i.e. grant access to some entities according to the logged on user).

The following configuration set an authorization manager using Windows Authentication.

<system.serviceModel>

<endpoint contract="System.Data.Services.IRequestHandler"

binding="webHttpBinding"

bindingConfiguration="WebHttpWindowsAuth">

</service>

</services>

<serviceSecurityAudit serviceAuthorizationAuditLevel="Failure"

auditLogLocation="Application"

messageAuthenticationAuditLevel="Failure"/>

</behavior>

</serviceBehaviors>

<binding name="WebHttpWindowsAuth"

maxBufferSize="65536"

maxBufferPoolSize="2147483647"

maxReceivedMessageSize="2147483647"

transferMode="StreamedResponse">

<readerQuotas maxDepth="2147483647"

maxStringContentLength="2147483647"

maxArrayLength="2147483647"

maxBytesPerRead="2147483647"

maxNameTableCharCount="2147483647" />

</security>

</binding>

</webHttpBinding>

</bindings>

</system.serviceModel>

</configuration>

As you can see, we can also set the audit feature to let WCF log any security issue on the message. Regarding the binding, we set the required webHttpBinding to use the max settings for message size assuming that we may need to send large messages (beware of DOS attacks). We also set the security setting for using Windows authentication.

Now we can implement the “CheckAccess(OperationContext operationContext, ref Message message)” overload of our ServiceAuthorizationManager dervived class (MyServiceAuthorization in config above) and decode the message so we can so something usefull with its content.

public override bool CheckAccess(OperationContext operationContext, ref Message message)

{

if (IsGet())

return true;

if (!CanDecodeMessage(ref message))

return false;

if (IsUserAllowed())

return true;

return false;

}

As you can see, we want to allow read access so we bail out for GET verbs using the IsGet() function described below. After that, if we cannot decode the message we simply deny access. Otherwise we perform our custom authorization and we are done.

private static bool IsGet()

{

return RequestMethod().Equals("GET", StringComparison.OrdinalIgnoreCase);

}

private static bool IsDelete()

{

return RequestMethod().Equals("DELETE", StringComparison.OrdinalIgnoreCase);

}

private static string RequestMethod()

{

object propertyValue;

if (OperationContext.Current.IncomingMessageProperties.TryGetValue(HttpRequestMessageProperty.Name, out propertyValue))

{

HttpRequestMessageProperty rqMessageProperty = HttpRequestMessageProperty)propertyValue;

return rqMessageProperty.Method;

}

return string.Empty;

}

private static bool CanDecodeMessage(ref Message message)

{

string decodedMsg = DecodeMessage(ref message);

if (decodedMsg == null)

{

return IsDelete();

}

return IsMultipart(decodedMsg);

}

Notice that “DecodeMessage(ref message)” is described in a previous post.

Now an interesting section is how we detect is the incoming message is actually a multipart message which is typically used in SaveBatch operations.

Here we have the inspection of the multipart message and we can also extract a specific entity and check for access. Notice that we use the Atom10ItemFormatter class along with some other syndication classes to make it easier the parsing operation which is a simplification of the object materialization mechanism used by Data Services.

private static bool IsMultipart(string decodedMsg)

{

bool isMultipart = false;

foreach (Match m in xmlContentFromMime.Matches(decodedMsg))

{

isMultipart |= HaveEntity(m.Value);

}

if (false == isMultipart)

{

isMultipart |= deleteContentFromMime.Matches(decodedMsg).OfType<Match>().

Where(m => m.Value != DataServicesMetadataNamespace).Count() > 0;

}

return isMultipart;

}

private static bool HaveEntity(string rawData)

{

Atom10ItemFormatter atomFormatter;

if(XmlUtility.TryParse<Atom10ItemFormatter>(rawData, out atomFormatter))

{

ThrowOnSensitiveEntity(atomFormatter);

XmlSyndicationContent content = atomFormatter.Item.Content as XmlSyndicationContent;

return (content != null);

}

return false;

}

private static void ThrowOnSensitiveEntity (Atom10ItemFormatter atomFormatter)

{

if (atomFormatter.Item.Categories.

FirstOrDefault(c => c.Name.Equals(typeof(MySensitiveEntity).FullName, StringComparison.OrdinalIgnoreCase)) != null)

{

throw new SecurityException(Properties.Resources.AccessDenied);

}

We use a couple of regular expressions to parse the xml sections in the multipart and also to detect when we have a DELETE section.

private const string DataServicesMetadataNamespace = "http://schemas.microsoft.com/ado/2007/08/dataservices/metadata";

private static Regex xmlContentFromMime = new Regex(@"<\?xml[^>]+>\s*<\s*(\w+).*?<\s*/\s*\1>", RegexOptions.Singleline | RegexOptions.Compiled);

private static Regex deleteContentFromMime = new Regex("http://([\\w+?\\.\\w+])+([a-zA-Z0-9\\~\\!\\@\\#\\$\\%\\^\\&\\*\$\$_\\-\\=\\+\\\\\\/\\?\\.\\:\\;\\'\\,]*)?", RegexOptions.Singleline | RegexOptions.Compiled);

Finally after decoding the message, we can perform our validation. For that, we can use the result of the message decoding and parsing with the auxiliary classes shown above and also do some mapping with the incoming user identity.

Here is a sample of how we can get the incoming identity and perform some authorization with a pre-configured group or groups (AuthorizedGroup) that we can read from configuration or some external repository.

private bool IsUserAllowed ()

{

var groups = GetWindowsGroups();

return groups.Contains(AuthorizedGroup, StringComparer.OrdinalIgnoreCase);

}

private static IEnumerable<string> GetWindowsGroups()

{

OperationContext operationContext = OperationContext.Current;

return operationContext == null ? new List<string>() : GetWindowsGroups(operationContext.ServiceSecurityContext.WindowsIdentity);

}

private static IEnumerable<string> GetWindowsGroups(WindowsIdentity identity)

{

return identity.Groups != null ? identity.Groups.Translate(typeof(NTAccount)).

Select<IdentityReference, string>(i => i.Value) : new string[0];

}

An interesting part of this implementation is that it can be completely decoupled from the actual service implementation so we can very easily switch between different authorization strategies with a simple config change.

Decoding messages in WCF Data Services

HernanDL — Wed, 15 Jun 2011 16:33:00 GMT

Recently I had to solve an interesting problem while working with WCF Data Services and how to decode an incoming WCF message so I can do something useful with its content.

Let’s say that you have an already configured Data Service and you intercept the message using some sort extension/interceptors in WCF.

Here is an example of such function:

private static string DecodeMessage(ref Message message)

{

if (message.IsEmpty)

return null;

using (MessageBuffer buffer = message.CreateBufferedCopy(Int32.MaxValue))

{

Message copy = buffer.CreateMessage();

using (MemoryStream ms = new MemoryStream())

{

copy.Properties.Encoder.WriteMessage(copy, ms);

ms.Flush();

message = buffer.CreateMessage();

return Encoding.UTF8.GetString(ms.ToArray());

}

As you can notice, after some basic message validation, we create a copy of the message to avoid changing the state of the original message which is typically passed by reference. Then we write all the content to MemoryStream which is handy for read/write operations.

The key here is to use the encoder specified in the message properties which may be MTOM for this kind of streamed message but it might be different according to the configured binding. After writing all the message content to memory, we may read from memory and create a string so we can easily inspect the actual message. If we know that we will always deal with XML content, we can use an XmlReader or the like to manipulate the content without the string conversion which may pay a performance penalty on large messages.

In the above code, we return the content as string because we may get an XML or Text formatted message so we can process accordingly.

In the next post I will show how we can use this code for inspecting a message to perform a custom authorization with ServiceAuthorizationManager.

Stay tuned!

Channel 9 presentation with the Composite Services Guidance

HernanDL — Mon, 11 Apr 2011 23:34:00 GMT

Take a look at this presentation if you want to get a good idea of what is this project directly from Dmitri, the "father" of the creature.

And new videos for Service Routing and Inventory Centralizartion patterns.

New Videos for Composite Services Guidance - CTP2

HernanDL — Thu, 31 Mar 2011 10:27:00 GMT

You can get the latest videos for Composite Services Guidance CTP2 that show many features of this project.

Videos Download

Video 1: Repair and Resubmit

Video 2: Analytic Tracing

Video 3: Custom Probe Function

Video 4: Termination Notification

Video 5: Service Routing

Video 6: Inventory Centralizatioin

Video 7: Inventory Centralization Part 2 - Inventory Endpoint

Inventory Centralization Patterns with Composite Services CTP2

HernanDL — Wed, 16 Mar 2011 11:59:00 GMT

Recently my friend and coworker Dmitri Ossipov started his blog with great posts about some of the details and many useful links to well know and documented SOA patterns that this CTP includes.

Check this out for details on how the CTP implements on of the most public patterns, the Inventory Centralization Patterns, in this case for Schema, Policy and Contracts.

Patterns & Practices: Composite Services CTP2 is Public

HernanDL — Wed, 09 Mar 2011 12:20:00 GMT

Finally the last CTP and pre-release version for the Composite Services is out. There were quite a lot of changes since CTP1. We added many new samples and many enhancements to the repository (DB) which is now called Inventory in sync with SOA Patterns. Here is a brief list of the main changes according to the included documentations.

Changes and additions in this release

This CTP release contains reusable source code and samples to illustrate implementation for the following patterns and scenarios:

Repair and Resubmit – this pattern is implemented in ESB Toolkit 2.0 as part of Exception Management Framework (EMF). This code drop provides code sample how to implement this pattern for Windows AppFabric workflow service, using Exceptions Web Service and workflow activities to create fault message, which will be created in EMF database.

Analytic Tracing – this code drop contains reusable code and samples for implementing ETW tracing: event collector service and database that store collected events. This capability may be used for scenarios that need flexibility on how collected events are decoded and processed via extensibility points you can configure and implement: plugins and event decoders with leveraging ETW tracing capabilities provided by the event collector service.

Inventory Centralization – this code drop contains service catalog database, web services and samples to show how to implement Metadata Centralization, Schema Centralization and Policy Centralization patterns.

Service Virtualization – we included sample for implementing this pattern using WCF routing service( which is part of .NET framework) and service metadata centralization capabilities to define routing service metadata in service catalog.

Termination Notification – we included sample for implementing this pattern using sample WCF service and policy centralization capabilities provided by this CTP release.

You will also find many new videos that will be uploaded to the home page any time soon.

Stay tunned for new posts regarding implemetation details and advanced customizations for custom policy exporters/importers and monitoring.

UPDATE: Check further details on Dmitri's great blog here: Composite Services CTP2 Released and Applying Inventory Centralization Patterns with Composite Services CTP2

Charla Hijos Digitales

HernanDL — Tue, 09 Nov 2010 04:37:00 GMT

Para bajar la presentacion, haga click aqui.

Tambien se encuentra el video de la charla aqui.

SOA-based Composite Service Guidance CTP1

HernanDL — Fri, 29 Oct 2010 17:18:00 GMT

If you work with services and you are familiar with SOA Patterns you may take a look at the new project from patterns & practices for composing services.

As described on the home page this P&P project provides guidance for building enterprise SOA-based composite service applications. It provides design and implementation patterns for service discovery, composition and integration through written guidance, reference implementations and re-usable source code.

There are many features included tin this package and I will try to post some of them in series of quick notes to show how you can apply some of them in your applications. As part of the upcoming posts, you may find areas like WS-Policy and how to implement your own policies using native WCF API, or some advanced tracing capabilities provided by ETW infrastructure.

You can download the bits, documentation and also some briefing videos that shows an onverview of the main features here. I would suggest to see the videos if you what to take a quick glimse and then grab the bits and give it a shot.

Stay tunned for more details on this.

Extending Web Service Software Factory 2010

HernanDL — Tue, 01 Jun 2010 10:56:00 GMT

If you want to extend the service factory now you can use the new MEF extensibility features which basically means that you don;t need to crack open the factory designer and you can simply create your own VSIX extension and add custom features to the binary version of the factory.

This link show the basic steps to create your own extension.

Now the key setting to attach your extension to the factory is this:

Locate the "Adding a Shortcut Menu Command" section and replace the attribute [DslDefinitionModelCommandExtension] with these two attributes:

[Export(typeof(ICommandExtension))]

[ExportMetadata("ServiceContractDslExtensionFilter", null)]

Now if you want to extend the DataContract designer simply change "ServiceContractDslExtensionFilter" with "DataContractDslExtensionFilter". The rest is the same as describerd in tyhe above article.

As you can see, you can extend menu commands, validation rules, mouse gestures and the model as well.

The new Import WSDL 2010 for WSSF 2010

HernanDL — Fri, 28 May 2010 10:09:00 GMT

The new Beta version for Import WSDL 2010 is out. This is a contrib project for the Web Service Software Factory 2010 (WSSF 2010) new version.

The best feature is that this is a VS extension (vsix) that will integrate using the Managed Extensibility Framework (MEF) so you can extend WSSF binary version with no source changes.

You can also get the vsix from VS Gallery.

In my next post aI will show how can you add your own extensions to WSSF binary version.

BizTalk ESB Toolkit 2.1 Beta

HernanDL — Thu, 27 May 2010 10:53:00 GMT

The BizTalk ESB Toolkit 2.1 Beta version is out. In case you are giving a try to BizTalk 2010 Beta, then you might want to take a look at this toolkit for implemanting an ESB.

Here are some of the new features:

Supports Windows Server 2008 /2008 R2, SQL server 2008/2008 R2, BizTalk Server 2010 Beta
Added support for Visual Studio 2010 Visualization and Modeling SDK for the Itinerary designer.
Support both .NET Framework version 4 and .NET Framework 3.5.
Supports the use of itineraries developed in Microsoft BizTalk ESB Toolkit 2.0.
Minor enhancements:

The Itinerary designer now supports copying and pasting itinerary shapes along with their configured properties.
A new itinerary project template, BizTalk ESB Itinerary designer, provides an easy option to create itinerary projects under BizTalk Projects.
Opening a new project in the Itinerary designer sets the export mode to Strict by default.
Added a new itinerary model property, Require encryption certificate, in the Itinerary designer to enable and disable encryption certificate while validating the itinerary.

Known Issues:

In-place setup upgrade from ESB Toolkit 2.0 to ESB Toolkit 2.1 is not supported. We do support solutions built on ESB toolkit 2.0 to run on ESB toolkit 2.1
Itinerary Designer Extensions is not registered by setup.

Workaround: Install by clicking Start> All Programs> Microsoft BizTalk Server 2010 ESB toolkit > Install Itinerary Designer Extensions

TAP customers can download the Beta build from the connect site.

Web Service Software Factory 2010 RTM

HernanDL — Wed, 26 May 2010 11:05:00 GMT

The final version of the service factory 2010 is out.

You can download it from here:

Binaries (vsix): http://visualstudiogallery.msdn.microsoft.com/en-us/8c6ea683-acf2-4881-bb05-3c3252992bfe

Source: http://servicefactory.codeplex.com/releases/view/44037

Hands on,. docs, etc: http://servicefactory.codeplex.com/

Don't forguet to also install GAX 2010 and VS2010 SDK (and Visualization & Modeling SDK in case of source installation).