Introducing NET Framework 35 v1[1]

8/6/2019 Introducing NET Framework 35 v1[1]

1/61

Introducing the .NET Framework 3.5

David Chappell, Chappell & Associates

September 2007


2/61

INTRODUCING THE .NET FRAMEWORK 3.5

Copyright Microsoft Corporation 2007. All rights reserved.

2


3/61


Contents

CONTENTS ...................................................................................................................................................3

DESCRIBING THE .NET FRAMEWORK 3.5 ......................................................................................................5

THE CHALLENGESOF BUILDING MODERN APPLICATIONS................................................................................................... 6ADDRESSINGTHE CHALLENGES: SPOTLIGHTINGTHE .NET FRAMEWORK 3.5 ..........................................................................8

ASP.NET AJAX: Support for Responsive BrowserApplications ........................................................................8Language-Integrated Query: Consistent Access to DiverseData ................................................................................... 9Windows Communication Foundation: Support for Service-Oriented Applications ....................................................... 10

Windows Workflow Foundation: Support for Workflow-Based Applications ...........................................................12Windows Presentation Foundation: A Unified Approach toDiverse User Interfaces ....................................................13Windows CardSpace: Consistent User Control of DigitalIdentities ...........................................................................17

SUMMARIZINGTHE EVOLUTION: THE .NET FRAMEWORK 3.5 ANDITS PREDECESSORS............................................................20

APPLYING THE .NET FRAMEWORK 3.5: A SCENARIO .................................................................................22

UNDERSTANDING THE .NET FRAMEWORK 3.5: THE TECHNOLOGIES ......................................................24

ASP.NET AJAX ................................................................................................................................. ...... .....25LANGUAGE-INTEGRATED QUERY.............................................................................................................................. 26WINDOWS COMMUNICATION FOUNDATION .................................................................................................................. 29

Services and Clients .........................................................29Support for REST and RSS/ATOM ...................................32Communication Options ................................................... 34Security, Reliability, and Transactions ..............................35Tool Support..................................................................... 36Windows Communication Foundation and Other Microsoft

Technologies ....................................................................37WINDOWS WORKFLOW FOUNDATION........................................................................................................................37Workflows ........................................................................ 39The Base Activity Library ..................................................40Tools for Windows Workflow Foundation: The WorkflowDesigner ...........................................................................41

3


4/61


The Runtime Engine and Runtime Services .....................43Workflow-Enabled Services ..............................................43Windows Workflow Foundation and Other Microsoft

Technologies ....................................................................44WINDOWS PRESENTATION FOUNDATION..................................................................................................................... 45

The Capabilities of Windows Presentation Foundation ....46Applying Windows Presentation Foundation ....................48Tools for Windows Presentation Foundation ....................50Windows Presentation Foundation and Other MicrosoftTechnologies ....................................................................51

WINDOWS CARDSPACE........................................................................................................................................ 52

Windows CardSpace and the Identity Metasystem ...........53

Fighting Phishing ..............................................................58Windows CardSpace and Other Microsoft Technologies . .59

CONCLUSION .................................................................................................................................................60

ABOUT THE AUTHOR .....................................................................................................................................60

4


5/61


Describing the .NET Framework 3.5

The goal in application development is always the same:create the best possible software in the least amount oftime. Yet the bar is continually raised, as demands fromcustomers increase. To meet these demands, theplatforms developers build on and the tools they use mustget better and betterthey must evolve.

The .NET Framework provides a clear example of this.

First released in 2002, version 2.0 of the Frameworkappeared three years later. The .NET Framework 3.0,released in 2006, was a major update that added anumber of new technologies, while the latest version,the .NET Framework 3.5, includes more useful additions.Alongside this evolution, Microsofts flagship tool forcreating .NET applications has also moved forward. Thelatest release, Visual Studio 2008, offers a range of

improvements for creating .NET applications. Every stepin this path has been aimed at providing a better andmore productive environment for the people who createWindows software.

This overview provides a big-picture view of the .NETFramework 3.5. While a basic knowledge of the .NETFramework is assumed, this description focuses on thetechnologies added in the .NET Framework 3.0 and 3.5.

The goal is to make clear what this widely usedfoundation for Windows applications provides today.

5


6/61


The Challenges of Building Modern Applications

Creating a modern application is not a simple taskthe

requirements are substantial. Traditional concerns suchas creating effective business logic and allowing accessvia a Web browser are still important, but theyre nolonger enough. Modern applications present a range ofnew challenges, including the following:

Users increasingly expect Web browser interfaces toact like installed Windows applications. Loading anew page whenever something has changed is no

longer sufficientits just too slow. Whats needed isbettersupport for responsive browser applications.

Data remains central to most applications. How thatdata can be represented, however, has expandedconsiderably. Relational data is still important, as ismapping between objects and relations. Yet theamount of data represented using XML continues to

increase, a trend thats not likely to change. Andeven though its not always viewed in this way, arunning programs objects also contain data. Atechnology that allowed consistent access todiverse data would help developers createapplications in less time and with fewer errors.

Applications commonly communicate with otherapplications, both inside and outside the

organization. Modern applications also must often fitinto a service-oriented architecture (SOA), exposingsome of their functionality as interoperable servicesaccessible by other software. Achieving these goalsrequires support for service-oriented applications.

6


7/61


Organizations are increasingly taking a process-oriented view of what they do. Since mostapplications automate some part of a business

process, it can be useful to make the steps in thisprocess explicit in the code. An effective way to dothis is by using workflow technology, an approachthat requires support for workflow-basedapplications.

The requirements for a modern user interface havegrown significantly. Providing real business valuecan commonly require working with various kinds ofdocuments, using two- and three-dimensionalgraphics, displaying video, and more. Meeting theseneeds requires a unified approach to diverse userinterfaces.

The people who use an application commonly need away to convey information about who they are.Many different technologies for defining and using a

digital identity are in use, and problems such asphishing are common. Given this, a modernapplication and the people who use it can benefitfrom consistent user control of digital identities.

Given that todays applications commonly need to tacklesome or all of these challenges, the platform thoseapplications are built on should also address all of them.The goal of the .NET Framework 3.5 is to do this for

Windows software.

7


8/61


Addressing the Challenges: Spotlighting the .NET

Framework 3.5

The .NET Framework 3.5 contains a number oftechnologies that can help developers solve the problems

just described. Some were part of the .NET Framework3.0, while others are new with the 3.5 release. Thissection introduces the most important of thesetechnologies.

ASP.NET AJAX: Support for Responsive

Browser ApplicationsWeb browsers are the most popular user interface fornew applications. Still, theyve traditionally suffered from asignificant limitation: Each new request from a userrequires a round-trip to the Web server, commonlyresulting in loading a new page. A more intelligentandfasterapproach would be to access data in thebackground whenever possible, then update only those

parts of the page that change. Users would see muchmore responsive applications, since they would spendless time waiting for new pages to be loaded.

This is exactly whats done by the AJAX approach tobuilding Web applications. Rather than load a new pagefor each user request, the browser asynchronouslyrequests data in advance. The code that makes thisrequest is typically written in JavaScript, and the data is

often (although not always) formatted in XML. Thesethree characteristicsAsynchronous JavaScript and XMLare the source of nameAJAX.

8


9/61


Even though the core technologies that underlie AJAXfirst appeared in the 1999 release of Internet Explorer 5,this approach took several years to become popular.

Today, however, AJAX is becoming the dominant stylefor new Web browser applications. Accordingly, the .NETFramework 3.5 now incorporates a technology calledASP.NET AJAX. An extension to the original ASP.NET,the goal is to make it easier for developers to createAJAX applications.

Language-Integrated Query: Consistent Access

to Diverse DataMost applications work with data in some way. That datacan be represented in a variety of ways, including astables in a relational database, in XML documents, and inobjects held in memory. Accessing each of these kinds ofdata has traditionally required using a different approach.Its common to use SQL to work with relational data, forexample, XQuery for XML data, and custom code for in-

memory data. Yet since the intent is the sameaccessing informationwhy not provide a commonapproach for all of these cases?

This is the goal of Language-Integrated Query (LINQ), atechnology thats new with the .NET Framework 3.5.Rather than requiring specialized languages and aseparate approach for each kind of data, LINQ adds a setof extensions to C# and VB that allow common access to

diverse information. This technology covers a large area,including object/relational mapping and more. The goal isto make life simpler and more efficient for anybody whocreates or maintains .NET Framework applications thatwork with data.

9


10/61


Windows Communication Foundation: Support

for Service-Oriented Applications

From the beginning, the .NET Framework has providedplenty of approaches to communication. Those choicesinclude the following:

ASP.NET Web Services (commonly known as ASMX),providing interoperable SOAP-basedcommunication.

.NET Remoting, focusing on communication

between .NET applications.

Enterprise Services, offering support for scalable,transactional applications.

System.Messaging, supporting queued messaging viaMicrosoft Message Queuing (MSMQ).

Web Services Enhancements (WSE), an extension toASP.NET Web Services that provides support formore recent specifications such as WS-Security.

All of these technologies have had a role to play. Yet whyhave several different solutions to address what isessentially the same problem? Why not instead create asingle foundation for application communication?

This is exactly whats done by Windows CommunicationFoundation (WCF). Rather than requiring developers touse a different technology with a different applicationprogramming interface for each kind of communication,WCF provides a common approach using a common API.Originally released as part of the .NET Framework 3.0,WCF is now Microsofts recommended approach for

10


11/61


communication. Most applications that might have usedone of the technologies just listed should instead useWCF for communication.

As the figure below shows, the basic model of WCF issimple: A client accesses some service, invokingoperations as required. WCF doesnt mandate anyparticular host, and so developers are free to use thiscommunication technology inside any host process.

WCF provides strong support for interoperablecommunication via SOAP, an essential part of modern

computing. This includes support for several of the WS-*specifications, including WS-Security, WS-ReliableMessaging, and WS-AtomicTransaction. WCFdoesnt require SOAP, however, and so otherapproaches can also be used, including an optimizedbinary protocol, queued messaging using MSMQ, and asimpler REST-based approach built directly on HTTP.

Communication between applications, whether within an

organization or across organizations, is a fundamentalpart of modern software. The .NET Framework 3.5addresses this challenge via the service-orientedapproach of WCF.

11


12/61


Windows Workflow Foundation: Support for

Workflow-Based Applications

A workflow is a simple idea: its just a series of stepsperformed in some order. One might even argue thatevery application implements a workflow, since everyapplication executes some process. Yet the traditionalapproach to creating an application using C# or VisualBasic or some other programming language is to makethe steps in this process implicit in the code. This certainlyworks, but it also embeds the process itself deeply into aprograms logic, making that process more difficult tocreate and to change.

Using workflow technology to implement process logiccan be an effective way to address this problem. Ratherthan intertwining the logic in ordinary code, each step inthe process is explicitly defined, then executed by aworkflow engine. The result is a clean implementation ofthe process itself. With Windows Workflow Foundation

(WF), Microsoft provides a common workflow technologyfor Windows, giving any workflow-based application acommon foundation to build on. Since its release in the.NET Framework 3.0, WF has been used both in softwareprovided by Microsoft, such as Windows SharePointServices, and in applications created by otherorganizations.

But how can a single technology meet the diverse set of

requirements presented by different workflowapplications? The answer adopted by WF is to take avery general view of workflow. As the figure below shows,a WF workflow is just a group of activities that areexecuted by the WF engine in some order. Each activity

12


13/61


is actually a class, and it can contain any work that theworkflows creator deems necessary. Activities canpotentially be reused across different workflows, making it

easier to create automated solutions to new problems.

By providing a common workflow technology forWindows, WF makes this useful paradigm for buildingsoftware generally available to developers. As a process-oriented view of software continues to gain in popularity,the use of workflow will likely grow as well.

Windows Presentation Foundation: A UnifiedApproach to Diverse User Interfaces

The user interface is an important part of nearly everyapplication. Yet what users expect from those interfaceshas advanced significantly. Traditional menu-driven GUIsare still required, of course, but applications may alsoneed to display video, run animations, use two- andthree-dimensional graphics, and work with various kindsof documents. And all of this must be possible whetherthe application is accessed from a standalone desktopclient or via a Web browser.

13


14/61


Traditionally, all of these aspects of the user interfacehave been provided in different ways on Windows. Forexample, a developer can use Windows Forms, part of

the .NET Framework, to build a Windows GUI. Creating aWeb browser interface requires using HTML and perhapsJava applets or JavaScript code. Displaying video mightrely on Windows Media Player or something else, whiledocument formats might be defined by Microsoft Word orPDF or in another way. The challenge for developers isclear: building a coherent user interface for different kindsof clients using diverse technologies isnt simple.

A primary goal of Windows Presentation Foundation(WPF), originally released with the .NET Framework 3.0,is to address this challenge. By offering a consistenttechnical underpinning for all of these user interfaceaspects, WPF makes life simpler for developers. Bytaking a more modern approach, including support forvideo, animation, two- and three-dimensional graphics,and various kinds of documents, WPF can let users work

with information in new ways. And by providing acommon foundation for desktop clients and browserclients, WPF makes it easier to build applications thataddress both.

The example interface shown below, containing images,live graphics, three-dimensional views, and more,illustrates some of what WPF provides. Rather thanrequiring developers with skills in diverse technologies,user interfaces like this one can now be created in a moreconsistent way.

14


15/61


One challenge that has long faced the creators of user

interfaces stems from the different roles required forbuilding effective interfaces. Software developers areneeded to create the logic behind the interface, buttheyre rarely the best people to define the interfaces lookand feel. Designers, specialists in human/machineinteraction, are typically a much better choice for this role.Yet older technologies such as Windows Forms arefocused entirely on the developer. Theres no truly

effective way for developers and designers to collaborate.To address this problem, WPF relies on the eXtensibleApplication Markup Language (XAML). An XML-basedlanguage, XAML allows specifying a user interfacedeclaratively rather than in code. This makes it much

15


16/61


easier for tools to generate and work with an interfacespecification based on the visual representation createdby a designer. In fact, Microsoft provides Expression

Blend to do exactly this. Designers can use this tool (andothers provided by third parties) to create the look of aninterface, then have a XAML definition of that interfacegenerated for them. The developer reads this definitioninto Visual Studio, then creates the logic the interfacerequires.

When a developer creates a standalone WPF application,one that runs directly on Windows, she has access toeverything WPF provides. To create a client that runsinside a Web browser, however, a developer can build a

XAML browser application, commonly referred to as anXBAP. Built on the same foundation as a standaloneWPF application, an XBAP allows presenting the samestyle of user interface within a downloadable browserapplication. The same code can potentially be used forboth kinds of applications, which means that developers

no longer need different skill sets for desktop and browserclients. As is typical for this kind of rich Internetapplication, an XBAP downloaded from the Internet runsin a secure sandbox, which limits what the application cando. Still, a large subset of the user interface functionalityavailable to a standalone WPF application can also beused in an XBAP.

Both WPF standalone applications and XBAPs can takeadvantage of WPFs modern graphics support, includingthe ability to use hardware acceleration, support forvector graphics, and more. By making it easier to create3D graphics, WPF makes available a range of datavisualization options that arent possible with Windows

16


17/61


Forms or other earlier technologies. WPF also providesthe foundation for the XML Paper Specification (XPS),which defines a standard format for viewing, distributing,

and printing fixed-format documents.

User interfaces are a complex and important part ofmodern applications. Through WPF, the .NET Framework3.5 presents a more complete and consistent solution tothe challenges these interfaces present. The goal is to letpeople who create user interfacesboth developers anddesignersdo their jobs more effectively.

Windows CardSpace: Consistent User Control

of Digital Identities

Think about how people represent themselves today onthe Internet. In the majority of cases, a persons digitalidentity is expressed as a simple username. Combinedwith a password, this identity is used to access emailaccounts, Internet merchants, and even on-line banksand other financial institutions. Yet despite theirpopularity, usernames and passwords have severaldrawbacks. Here are the two most important:

People have a hard time remembering all of theusernames and passwords theyve chosen fordifferent sites. Many people use the same values fordifferent sites, easing the memory problem butincreasing the security risk.

Usernames, passwords, and other personalinformation can be stolen by phishers. By sendingdeceptive emails, phishers entice their victim to loginto a Web site that looks just like, say, the site ofthe victims bank. The site is actually controlled by

17


18/61


the phisher, however, and so once the victim entershis username and password, the phisher can usethis information to masquerade as the user at the

real site.

Reducing the severity of these problems requires a newapproach to managing digital identities. WindowsCardSpace, originally released with the .NET Framework3.0, is an important part of that approach. To help peoplekeep track of their digital identities, CardSpace representseach identity as a distinct information card. If a Web siteaccepts CardSpace logins, a user attempting to log intothat site will see a CardSpace selection screen like theone below. By choosing a card, the user also chooses adigital identity that will be used to access this site.Different cards can contain different information, allowinga user to control exactly what each site learns about her.

18


19/61


The identities represented by these cards are created byone or more identity providers. Any organization can offer

an identity provider, and CardSpace itself also includes aself-issued identity provider that runs on client machines.With this provider, users can create their own identitiesthat dont rely on passwords for authentication. Web sitescan accept these self-issued CardSpace identities ratherthan relying on the usual password-based approach,reducing the problems that passwords bring.

Windows CardSpace is actually part of a larger identitymetasystem. Based entirely on open, public protocols,this metasystem defines a way to use different digitalidentity technologies consistently across diverseplatforms (including operating systems other thanWindows) and diverse applications (including Web

19


20/61


browsers other than Internet Explorer). By providing acommon way to select identities and more for Windows,CardSpace fills a key role in the metasystem. And by

addressing the fundamental problem of identity,CardSpace also plays an important part in the .NETFramework 3.5.

Summarizing the Evolution: The .NET Framework 3.5

and its Predecessors

The .NET Framework 3.5 is the latest step in theevolution of Microsofts flagship development platform,with each step building on what came before. This mostrecent release is a superset of the .NET Framework 3.0,and it brings no breaking changes. Similarly, the .NETFramework 3.0 was a superset of the 2.0 release, and italso contained no breaking changes. To help make thestages in this evolution clear, the figure below showswhats been added in the 30 and 3.5 releases.

Everything in the .NET Framework depends, as it alwayshas, on the Common Language Runtime (CLR). A large

20


21/61


group of classes, known as the .NET Framework classlibrary, is built on top of the CLR. This library hasexpanded with each release, as the figure shows. The

.NET Framework 2.0 provided the fundamentals of amodern development environment, including the baseclass library, ASP.NET, ADO.NET, and much more.The .NET Framework 3.0 didnt change any of this, but itdid add four important new technologies: WCF, WF,WPF, and Windows CardSpace.

The changes in the .NET Framework 3.5 affect severalparts of the 3.0 release. ASP.NET gets AJAX support,while LINQ is available for use with ADO.NET and inother ways. Various additions were made to the baseclass library, such as addition of a type supporting setsunordered collections of unique elementsand improvedencryption support. WCF, WF, and WPF each getenhancements as well, as described later in thisoverview. The set of operating systems on which theFramework runs was also updated: The .NET Framework

3.5 runs only on Windows Server 2008, Windows Server2003, Windows Vista, and Windows XP.

Because each release adds to its predecessor, the needto retest applications built for earlier releases isminimized. Also, because all three of these versions canrun simultaneously, its still possible to run applications onolder versions of the Framework if desired. Visual Studio2008 even allows creating projects that target a particularversion of the Framework. An application built in this waywill use only the binaries for that version, and thedeveloper will see only those aspects of Visual Studioand the Framework itself that work in this older world. Adeveloper who chooses to build a new application

21


22/61


targeting the .NET Framework 2.0, for example, canmake his world look just as if only this older version of theFramework were available.

Applying the .NET Framework 3.5: A Scenario

One way to understand how a group of technologies worktogether is to look at an example of how they can beused. Imagine, for example, an application that letscustomers and agents submit insurance applications. If itwere implemented using the .NET Framework 3.5, this

application might look something like the figure below.

The applications business logic, shown in the upper leftof the diagram, is implemented using a WF workflow.

22


23/61


Handling an application for insurance is a multi-stepprocess, including evaluating the application against thisorganizations underwriting rules, perhaps checking the

applicants credit, and maybe even getting a managersapproval. The workflow implements each of these stepsas an activity, relying on other software as needed. Toaccess stored data, the activities in this workflow use aLINQ option for issuing SQL queries.

This insurance company provides a call center, allowingits customers to apply for insurance over the phone. Theclient software used by the people staffing that call center,shown in the upper right of the diagram, is implementedas a standalone WPF application. This clientcommunicates with the applications business logic viaWCF, using a binary protocol optimized for WCF-WCFcommunication. As the figure shows, the call centerworkers rely on Windows CardSpace to select the identitythey will use when logging into this application.

Customers can also apply for insurance via the Web. Toallow this, the application uses ASP.NET AJAX tocommunicate with Web browsers, providing a responsiveuser interface for customers. As shown in the lower leftcorner of the diagram, a customer accessing thisapplication via a Web browser can use CardSpace toselect the identity he wishes to present.

Insurance agents who access this application over the

Internet may well need a more functional interface thanwhat customers see. Accordingly, they can rely on anXBAP rather than an AJAX interface. As shown in thelower center of the diagram, this gives those agents alarge share of the user interface functionality provided by

23


24/61


the WPF desktop application used in the call center. Bothare built on the same foundation, and so the applicationsdevelopers can reuse the same code in the two types of

clients. And as with the other kinds of clients, agents canuse CardSpace to select the identity they wish to presentto the application.

Finally, its likely that this application will need to accessand be accessed by other applications. If approving acustomer requires a credit check, for example, this willmost likely be done through a call to an external service.Or perhaps the application accepts requests directly fromother software, exposing services that these externalapplications can invoke. For cases like these, shown inthe lower right of the figure, the application relies on WCFto communicate using standard Web services. Whatevertechnology these applications are built on, WCFs supportfor SOAP makes interacting with them straightforward.

This scenario illustrates how some of the .NET

Framework 3.5s components might be used in a typicalapplication. Quite a few options have been omitted, andso dont view this simple example as a completeillustration of what this technology family provides.Instead, the goal is to give a clear idea of how the variousparts of the .NET Framework can be used together toaddress real business problems.

Understanding the .NET Framework 3.5: The

Technologies

To get a better feel for what the .NET Framework 3.5provides, its useful to dig a little deeper into its

24


25/61


components. This section provides a short tutorial oneach of the technologies spotlighted earlier.

ASP.NET AJAX

ASP.NET is one of the todays most popular technologiesfor creating Web-based applications. AJAX is becoming adominant approach for designing those applications.These two realities imply that ASP.NET AJAX will be oneof the most widely used parts of the .NET Framework 3.5.The figure below illustrates the two main components ofthis technology.

As the figure shows, an ASP.NET application can use theASP.NET 2.0 AJAX Extensions. These provide a set of

server-side controls for interacting with code in a Webbrowser. The most important of these controls isUpdatePanel, which allows updating only part of a user-visible page rather than replacing the whole thing. TheASP.NET 2.0 AJAX Extensions also provide Webservices that browser code can invoke to accessinformation provided by the application.

For clients, ASP.NET AJAX provides the Microsoft AJAXLibrary. This library implements a framework for creatingclient scripts, and it runs in Internet Explorer, Firefox,Opera, and Safari. As in all AJAX implementations, thisclient code can use an object provided by the Webbrowser called XMLHttpRequest. By calling a method in

25


26/61


this object, a script can request data via HTTP from anapplication built using ASP.NET or another technology,such as PHP. This request can be made asynchronously,

allowing data to be retrieved without forcing the user toblock while waiting for a response. The data it returns canthen be accessed as XML using the Document ObjectModel (DOM). Along with XML, ASP.NET AJAX alsoallows exchanging data represented using the JavaScriptObject Notation (JSON).

The AJAX style of Web application was a good idea whenthe notion first surfaced in 1999. While weve had to waitseveral years for this approach to find its way into themainstream, AJAX applications are now becoming thenorm. Microsofts decision to include ASP.NET AJAX inthe .NET Framework 3.5 is certain to help speed adoptionof this useful approach.

Language-Integrated Query

Creating a common approach for accessing diverse dataisnt an easy task. Making that approach comprehensibleto developersnot bogging them down in morecomplexityis even harder. To address this, LINQ relieson a common and quite familiar syntax for working withdata.

Heres a simple LINQ query, expressed in C#, that readsdata:

var exampleQuery =from s in Studentswhere s.Gender == "M"select s.Name

26


27/61


This query returns the names of all male students as a listof strings stored in the variable exampleQuery. To print

out that list, a program might do this:

foreach (string name in exampleQuery) {Console.WriteLine(name);

}

The syntax of the query is reminiscent of SQL, todaysstandard language for accessing relational data. Thismakes sense, since SQL is a widely used language, one

that many developers know. Yet its important tounderstand that even though it looks somewhat like SQL,the LINQ query shown above isnt an embedded SQLstatement. Instead, its pure C#, part of the languageitself. This means that the query can use other programvariables, be accessed in a debugger, and more. Thename of this technology is Language-Integrated Queryfor a reason: the statements for querying diverse kinds of

data are integrated directly into the programminglanguage.

And despite its similarity to SQL, this example query isntlimited to accessing only relational data. In fact, the .NETFramework 3.5 includes several different LINQ variations,all of which use the same basic syntax for queries. Thosevariations include the following:

LINQ to ADO.NET: Provides object/relational (O/R)mapping. This aspect of LINQ includes two options.The first, LINQ to SQL, translates a query like theone above into a SQL query, then issues it againsttables in a SQL Server database. The second

27


28/61


option, LINQ to DataSet, executes a query like theone shown above on the contents of a DataSetreturned by ADO.NET

LINQ to Objects: Allows querying collections of in-memory data structures, such as object hierarchies.The query above could also be issued against thiskind of datadespite its similarity to SQL, its notlimited to accessing only data in tables.

LINQ to XML: Allows querying XML data. Thisapproach uses a slightly different syntax, reflecting

the unique needs of mapping between the world ofXML and a programming language, but the basicstructure of a LINQ query remains the same.

Like SQL, LINQ also defines other operators for queries.They include things such as OrderBy, which determineshow results are ordered; GroupBy, which organizesselected data into groups; and arithmetic operators suchas Sum. And once again, these can be used generallyacross the LINQ varietiestheyre not just for the LINQ toSQL option.

LINQs creators aimed at several targets, includingproviding O/R mapping for .NET applications, allowing acommon syntax for working with different kinds of data,integrating that syntax directly into the programminglanguage, and more. As with everything else described in

this introduction, the goal is to make life better fordevelopers working with Visual Studio 2008 and the .NETFramework 3.5.

28


29/61


Windows Communication Foundation

The change to service-oriented communication marks a

shift in how applications interact. Explicitly designed tosupport service-oriented applications, WCF reflects thisshift. This section describes the most important aspectsof WCF, including services and clients, communicationoptions, and support for security, reliable communication,and transactions.

Services and Clients

The fundamental idea of WCF is simple: a serviceexposes an interface that can be accessed by a client.That interface can be defined using the Web ServicesDescription Language (WSDL), then turned into code, orit can be defined directly in a language such as C# orVisual Basic. For a simple interface exposing aninsurance application service, the latter approach mightlook something like this:

[ServiceContract]interface IInsurance{[OperationContract]int Submit(int policyType, string

ApplicantName);

[OperationContract]

bool CheckStatus(int applicationNumber);

[OperationContract]bool Cancel(int applicationNumber);

}

29


30/61


The definition of this C# interface is marked with theServiceContract attribute. This attribute indicates that

WCF can expose methods in this interface as remotely-callable operations. Which of the interfaces methods areexposed depends on which are marked with theOperationContract attribute. In this simple example,

every method is marked with this attribute, and so all ofthem will be exposed to remote callers. This isntrequired, howeverits legal to applyOperationContract to only some of an interfaces

methods. Whichever choice is made, some class in theapplication must implement this interface, providing actualcode for the methods the interface defines. Once this isdone, WCF automatically makes the methods markedwith OperationContract accessible to clients of this

service.

The figure below gives a slightly more detailed view ofhow a service is actually exposed to its clients. Ratherthan access an interface directly, a client insteadconnects to a specific endpoint. A service can exposemultiple endpoints, potentially allowing different clients toaccess it in different ways.

30


31/61


As the figure shows, each endpoint specifies three things:

An address indicating where this endpoint can befound. As shown in the figure, the address isexpressed as a URL.

A bindingdefining how the endpoints operations can

be invoked. Each binding defines several things,including what protocol should be used to invoke theoperations, what kind of security should be used,and more. WCF includes a set of pre-definedbindings, such as the BasicHttpBinding shown here,for the most common cases, and its also possible todefine custom bindings. Because a single servicecan expose multiple endpoints, each with a different

binding, it can simultaneously allow access todifferent kinds of clients over different protocols andwith different security options.

31


32/61


A contractdescribing the operations that can beinvoked via this endpoint. The contract can beidentified using just the name of the interface that

defines these operations, which here is IInsurance.

The basics of WCF are simple. As with mostcommunication technologies, the details can get complexthere are many optionsbut creating ordinary WCFapplications isnt hard.

Support for REST and RSS/ATOM

In its original release in the .NET Framework 3.0, WCFsWeb services support was focused on SOAP. Anotherapproach to Web services can be better in some cases,however. Known as Representational State Transfer(REST), its built directly on the technology of the Webitself. Rather than defining a new protocol, as did thecreators of SOAP, REST relies on the built-in operationsin HTTP: GET, POST, and others. And rather thanidentify the information to be accessed with parameters

defined in XML, as SOAP typically does, REST assumesthat everything is identified with a URL.

To support this approach, WCF in the .NET Framework3.5 adds a new binding, WebHttpBinding, that sendsinformation directly over HTTP. It also adds two newattributes, as this example shows:

[ServiceContract]

interface IAccount{

[OperationContract][WebGet]int GetBalance(string account);

32


33/61


[OperationContract][WebInvoke]

int UpdateBalance(string account, intamount);}

This simple interface exposes a RESTful service forreading and updating a bank balance. To indicate that acall to GetBalance should be conveyed directly via anHTTP GET, this operation is marked with the WebGet

attribute. Similarly, because the UpdateBalance operationis marked with the WebInvoke attribute, it will beconveyed via an HTTP POST. (Its also possible tospecify that an operation marked with this attribute shoulduse some other HTTP operation, such as PUT orDELETE.) Rather than using SOAP and the WS-*protocols, this simpler RESTful style adheres to thetraditional fundamentals of Web-based communication.Because each approach makes sense in some situations,

WCF in the .NET Framework 3.5 supports both.

The ability to send the XML formats defined by RSS andATOM has also become more important since WCF firstappeared. Accordingly, the .NET Framework 3.5 versionof WCF provides built-in support for these two formats.Information structured using either one can be sent overany WCF binding, although the new WebHttpBinding is

likely to be the most common choice. Using WCF-supplied formatters, a .NET Framework 3.5 applicationcan create or consume an RSS or ATOM feed, making itstraightforward to work with this increasingly importantkind of content.

33


34/61


Communication Options

Different kinds of applications built by different kinds of

developers need different ways to communicate. Thesimplest approach for most developers is remoteprocedure call (RPC), which lets a client invoke remoteoperations much like local ones. Given the interfaceshown earlier, for example, a client could invoke anyoperation in the usual synchronous way, waiting patientlyuntil a response comes back. This option is easy fordevelopers, and its the right choice in somecircumstances.

WCF also provides several other options, however. Theyinclude the following:

Calls that have no response. Marked with the attributeOneWay, this kind of communication can be useful

for sending events or other one-way interactions.

Asynchronous message-based communication, using

direct sends and receives over MSMQ.

Explicit manipulation of SOAP messages, including theability to insert elements directly in the SOAPheader.

WCF also allows a developer to control various localaspects of how a service behaves. Using theServiceBehavior attribute, for example, she can set

whether the service is single or multi-threaded, whether anew instance of the service is created for each call, andother options.

34


35/61


Security, Reliability, and Transactions

Basic communicationthe ability to move data between

systemsis useful, but its rarely enough. Mostapplications need more. For example, the great majorityof distributed applications need some kind of security.Providing security can be complex, given the range ofdifferent approaches and diversity of technologies in usetoday. To let developers create secure distributedapplications without forcing them to understand all of thedetails, WCF relies primarily on bindings for security. Forexample, the BasicHttpBinding shown earlier can be

configured to use HTTPS rather than plain HTTP, andother bindings provide more security options.WsHttpBinding, for instance, supports WS-Security,allowing interoperable SOAP-based authentication, dataintegrity, and data confidentiality. A developer can alsocreate a custom binding that provides the exact securityservices his application needs.

Making sure that communication is reliable is alsoessential for many applications. The traditional Webservices approach, sending SOAP over HTTP, issufficient in some cases, and its whats done when theBasicHttpBinding is used. There are plenty of situations,however, where this widely-used choice isnt enough.Messages that go through one or more SOAPintermediaries, for instance, cant rely on this simpleapproach for end-to-end reliability. For these cases, WCFimplements WS-ReliableMessaging. By choosing abinding that supports this option, such as WsHttpBinding,a developer can automatically get interoperable reliablemessage transfer.

35


36/61


Distributed transactions can also be important in someapplications. WCF builds on System.Transactions,originally released in the .NET Framework 2.0, to allow

creating transactional software. A method can use theOperationBehavior attribute to indicate that it requires

a transaction and to define how that transaction behaves.To allow distributed transactions that are interoperableacross vendor boundaries, WCF relies on the WS-AtomicTransaction specification. Using the technologydefined in this multi-vendor agreement, WCF applicationscan participate in transactions that span diverse

technologies.

Tool Support

Good tools make every developers life better.Accordingly, the version of WCF included in the .NETFramework 3.5 has support in Visual Studio 2008 forthings such as the following:

Project types to help developers get started creating WCFapplications. These include projects for building:

A Website or Web application that hosts a WCFservice;

A library implementation of a WCF service;

A WCF application that exposes syndication feedsusing RSS or ATOM;

A WCF service designed for use by an AJAX client.This service is automatically configured to useWebHttpBinding with the JavaScript Object Notation

36


37/61


(JSON), one of the encoding choices this bindingprovides.

A WCF Autohost that can automatically host a library-based WCF service.

The Service Configuration Editor, a tool that makescreating and modifying WCF configuration files easier.

Windows Communication Foundation and Other

Microsoft Technologies

As mentioned earlier, WCF supersedes several earlierMicrosoft technologies for creating distributedapplications. Most applications that would have been builtusing ASP.NET Web Services, .NET Remoting,Enterprise Services, or WSE will instead be built on WCF.WCF applications can interoperate with ASP.NET WebServices applicationsboth support standard SOAPaswell as applications built on Enterprise Services, MSMQ,and version 3.0 of WSE. And even though new .NET

Framework 3.5 applications wont commonly use them,all of the technologies that WCF supersedes are still partof this version of the Framework, and theyll all besupported as usual. Applications built using earlierversions of these technologies will continue to runnormally; installing and using the .NET Framework 3.5wont break existing code.

Windows Workflow Foundation

A process-oriented design, driven by a workflow, can bethe right approach for a significant fraction of Windowssoftware. The purpose of WF is to let developers createand execute these workflow-based applications. The

37


38/61


diagram below shows the components WF provides to dothis.

As described earlier, every workflow is built from somenumber of activities. Workflows and activities are justclasses, so both can be created directly in code. WF also

provides the Workflow Designer, a Visual Studio-hostedgraphical tool for constructing workflows. However aworkflow is created, its activities can be drawn from theBase Activity Library (BAL) provided with WF or from anyother source.

Once a workflow has been defined, its eventuallyexecuted by the WF runtime engine. This engine relies ona group of runtime services for persisting the workflows

state, tracking the workflows execution, and more. All ofthese thingsthe runtime services, the runtime engine,and the workflow itselfare contained within some hostprocess. This process can be any Windows process,

38


39/61


ranging from a simple console or WPF applicationrunning on a desktop to a scalable server process.

Understanding WF requires knowing at least a little aboutall of its components. The following sections take a brieflook at each one.

Workflows

Stripped to its essentials, a workflow is nothing more thana group of activities. WF provides built-in support for twostyles of workflow:

Sequential workflows, which execute activities in adefined order. Like a traditional flow chart, asequential workflow can contain branches, loops,and other control structures. By default, however,activities execute in sequence, one after another.

State machine workflows, which implement atraditional finite state machine. Like any state

machine, which activity executes at a particular timeis determined by the combination of the current stateand whatever event has been received.

The sequential option is useful for well-defined workflows,such as those used in purely software-based processes.Theyre relatively simple to create and understand, andthey initially feel more natural to most developers. Statemachine workflows are a better choice when the path of

execution is less predictable. A good example of this is aworkflow that involves interactions with people, any ofwhom can cancel the workflow at any point. Addressingthis situation with a sequential workflow is possible, butevery step could be a branch: Do this if the workflow isnt

39


40/61


cancelled, do something else if it is cancelled. Modelingthis kind of behavior using a state machine is significantlysimpler, since a request to cancel the workflow is just

another event that can be received and handled at anypoint.

Support for state machine workflows is one example ofhow WF attempts to provide support for human as well assystem workflow. Another example of this is WFs supportfor changing a running workflow. People can becapricious, and its not uncommon for someone involvedin a workflow to wish to add a step, delete a step, ormake some other change in the process while itsunderway. To accommodate this in a controlled way, WFallows the developer who creates a workflow to specifywhether and how that workflow can be modified while itsexecuting.

The Base Activity Library

Developers are free to create custom activities. In fact,

Microsofts goal is to foster the growth of a WF ecosystemfull of reusable activities. Still, starting with a common setof fundamental activities makes life simpler for everyone.Providing this common set is the role of the Base ActivityLibrary (BAL).

A workflow isnt required to use anything from the BAL.Still, many developers will find that the BAL makes their

lives simpler, especially at first. Among the activitiescontained in the BAL are the following:

IfElse: executes the activities contained in two or morepossible paths based on whether a condition is met.

40


41/61


While: repeatedly executes one or more activities aslong as a condition is true.

Sequence: executes a group of activities one at a timein a defined order.

Parallel: executes two or more groups of activities inparallel.

Code: executes a defined chunk of code.

Listen: waits for a specific event, then executes one ormore activities when that event is received.

InvokeWebService: calls a Web service usingASP.NET Web Services.

State: represents a state in a workflows state machine.

EventDriven: defines a transition containing one ormore activities that should be executed when aspecific event is received while in a particular state.

Policy: allows executing business rules using a WF-supplied rules engine.

Rather than define a particular language for specifyingworkflows, WF instead takes the more general approachof using activities. The BAL provides one language, butanybody using WF is free to define his own as well.

Tools for Windows Workflow Foundation: TheWorkflow Designer

One of the advantages of creating applications usingworkflows is the ability to define the workflow graphically.WFs Workflow Designer allows this, as shown below. By

41


42/61


default, the activities in the BAL appear in the Toolbox,letting a developer drag and drop them onto the toolsdesign surface to create a workflow.

Some developers prefer to write codethey dont likegraphical designers. WF allows this approach, too (andsometimes requires it: activities are generally built directlyin code). Its also possible to combine the twoapproaches, creating a workflow using both the WorkflowDesigner and direct coding. The goal is to let developersuse the approach thats most productive for them. And toallow broad er tool support, workflows can also beexpressed in XAML, the same language used by WPF. Infact, workflows created using the Workflow Designerdefault to a XAML definition.

42


43/61


The Runtime Engine and Runtime Services

As described earlier, the WF runtime engine has the job

of executing the activities in a workflow. As part of doingthis, it relies on a group of runtime services. WF includesstandard implementations of these services, butambitious developers can replace them if desired. Theseservices support a few different things, but two stand outas most interesting:

Persistence: A workflow thats blocked waiting forsome event can use this service to have its in-

memory state automatically persisted to disk. Whenthe event occurs, the service will automaticallyreload the workflows state and restart execution.This is especially useful for workflows that involvepeople, since hours, days, or more might elapsewhile waiting for a response.

Tracking: The activities in a workflow cleanlydemarcate the execution of the process they

implement. WFs tracking service allows a developerto cause information about the workflows executionto be automatically written to a database. Forexample, a developer might wish to track when aworkflow starts and ends, when each of its activitiesstarts and ends, and other information.

Workflow-Enabled Services

WF and WCF make an obvious combination. Workflowswill commonly need to invoke services, and implementinga service with a workflow can often be a good idea. Theinitial release of WF in the .NET Framework 3.0 didntmake combining these two technologies especially easy,

43


44/61


but the situation has improved significantly in the .NETFramework 3.5. In this version, its straightforward to useWF and WCF together to create workflow-enabled

services.

This combination depends on two new WF activities:

Send: Sends a request using WCF, then waits for aresponse. A developer specifies the operation thatshould be invoked and the endpoint at which thatoperation can be found.

Receive: Receives an incoming request via WCF, thensends a response. The developer specifies just thename of the operation that accepts this incomingrequest.

These two activities can be dragged and dropped into aWF workflow like any others, then configured as needed.The intent is to allow combining WF and WCF in usefulways.

Windows Workflow Foundation and Other


Introducing new approaches inevitably influences whatalready exists. With WF, this influence has been felt moststrongly by Windows SharePoint Services, the MicrosoftOffice 2007 system, and BizTalk Server.

To let developers more easily create workflowapplications for document collaboration and other kinds ofinformation sharing, Windows SharePoint Services,version 3 hosts the WF runtime. Office SharePoint Server2007, part of the Office 2007 system, builds on the WF

44


45/61


support in Windows SharePoint Services. Among otherthings, adding this server allows displaying InfoPathforms directly in Office 2007 client applications and using

a set of pre-defined workflows for common scenariossuch as approving a document.

Anyone familiar with BizTalk Server has certainly noticedby now the similarity between this products orchestrationcapabilities and what WF provides. In fact, the next majorrelease following BizTalk Server 2006 R2 is scheduled toreplace the products existing orchestration function withWF, providing tools to help migrate existingorchestrations to WF workflows.

Because its the standard workflow technology forWindows, WF will also show up in other Microsoftproducts and technologies. WF has also found a home ina number of applications created by independentsoftware vendors (ISVs) and enterprises. While not everyWindows application should be built as a workflow, WF

can make a developers life much easier for those thatare.

Windows Presentation Foundation

Both service-oriented communication and workflow-based logic are important in modern applications. Yetusers often care most about what they see: the userinterface. The goal of WPF is to address the challenges

of creating user interfaces for modern applications. Asdescribed next, WPF provides a range of capabilities todo this.

45


46/61


The Capabilities of Windows Presentation

Foundation

A developer is free to create a WPF applicationsinterface entirely in C#, Visual Basic, or some other CLR-based language. As described earlier, however, WPFalso allows specifying an interface using the XML-basedXAML. Elements and attributes in XAML map directly tothe classes and properties that WPF provides. Forexample, heres a simple button defined in XAML:


47/61


templates to groups of controls, which makes it easier forapplications to have a uniform look.

WPF supports much more than these basic user interfacefunctions, including the following:

Documents: A WPF application can display XPSdocuments using XAMLs FixedDocument tag. Anapplication can also display flow documents usingthe FlowDocument tag. A flow document canbehave like a traditional on-screen document,allowing the user to scroll through its contents. By

setting various attributes on this tag, however, adeveloper can make the document more adaptive toits surroundings. A document can display a page ata time, for example, freeing its reader from the needto scroll back and forth. The goal is to allow on-screen documents to be as readable as possible.

Graphics: WPF includes support for creating two-dimensional and three-dimensional vector graphics.For 2D work, WPF provides standard abstractionssuch as shapes, brushes, and pens, while 3Dgraphics allowing defining a model that can beassigned lighting and camera position information.Unlike earlier technologies such as Windows Forms,which relies on GDI+ for graphics, WPF graphicsarent cabined off using a separate set of conceptsthat developers must understand. Instead, the

XAML elements used for graphics can be combinednaturally with those used for anything else in a userinterface.

47


48/61


Images: Using XAMLs Image tag, a WPF applicationcan display images in various formats, includingJPEG, GIF, and others.

Media: A WPF application can use the MediaElementtag to display video and audio in various formats,including WMV, AVI, and MPEG.

Animation: WPF provides built-in support for animatingmost parts of a user interface. A circle can grow andshrink, for example, or a button can smoothlychange size. Applications can also define

storyboards containing timelines, allowingcoordinated sequences of animations to occur.

Data Binding: Because many WPF applications displaydata, its useful to have automatic support formapping data to user interface elements. WPFprovides this kind of data binding for informationcontained in objects and other sources.

Applying Windows Presentation Foundation

WPF provides a large set of user interface functionality,allowing developers and designers to create moreappealing user interfaces. Yet no matter how lovely aclient application looks, some organizations might resistusing it because of deployment issues. If rolling out a newversion of the client requires physically touching everydesktop machine that this application is installed on, the

cost of upgrades can be significant. One common way toavoid this problem today is to create browser-basedclients, perhaps using AJAX, rather than native Windowsclients. Yet even with AJAX, native Windows clients canoften present better, more responsive user interfaces

48


49/61


than browsers. To address the challenge of deployingthese clients, standalone WPF applications can bedeployed using ClickOnce. A technology that first

appeared in the .NET Framework 2.0, ClickOnce letsInternet Explorer users select an application via the Web,then have it automatically installed on their local machine.Once installed, the application can also be automaticallyupdated when a new version is made available. The goalis to combine the simplicity and inexpensive deploymentof a Web client with the power and functionality of astandalone WPF application.

Especially when theyre deployed using ClickOnce,standalone WPF applications are a good choice in manysituations. Alternatively, a user can download an XBAPdirectly into her browser. This application can thenpresent the user with a WPF-based user interface. Toprotect the user from malicious developers, all XBAPsdownloaded from the Internet run in a partially trustedsandbox. Based on the code access security provided by

the .NET Framework, this sandbox limits what XBAPscan do. Yet despite the restrictions imposed by thesandbox, an XBAP can still use a large fraction of WPFfunctionality, including 2D and 3D graphics, animations,on-screen documents, images, video, and more.

As described earlier, WPF lets applications displayadaptive documents using XAMLs FlowDocumentelement. Documents whose appearance changes basedon how theyre displayed arent always the best solution,though. Fixed-format documents, which always look thesame on a screen and a printer, are sometimes a betterchoice. WPFs XPS documents address this problem.Defined using a subset of XAML, XPS documents can be

49


50/61


read on any system that provides an XPS reader. Theyalso provide a new print format for Windows, allowingcomplex graphics to be printed with more fidelity.

Tools for Windows Presentation Foundation

Its possible to create any WPF user interface directly incode and/or XAML using a basic text editor. Most peoplewould prefer to work with better tools, however, and soVisual Studio 2008 provides the WPF designer. Usingthis tool, a developer can graphically create the userinterface she wishes to see, then let the tool generate the

code for this interface.

Yet developers often arent the best people to define userinterfaces. Designers are usually much better at this kindof work, since they specialize in communicating withpeople. Most designers dont write code, though, and sothe WPF designer isnt an effective tool for this group. Tolet designers work effectively in the WPF world, Microsofthas instead created Expression Blend. The figure below

shows how these tools relate to one another.

50


51/61


As the figure illustrates, a designer can use ExpressionBlend to define the look and feel of an interface, specifyanimations, and more, then let the tool generate a XAML

version of what hes created. A developer can import thisXAML into Visual Studio and add code for things such ashandling events. Because both Visual Studio andExpression Blend use the same build system, its possiblefor developers and designers to work on a projectiteratively, each using the tool theyre comfortable with.The goal is to help people from the divergent disciplinesof design and software engineering work together

effectively.

Windows Presentation Foundation and Other


Like other .NET Framework 3.5 components, WPF has arelationship with other Microsoft technologies. The mostimportant of these are the following:

Windows Forms: The .NET Frameworks originalapproach for creating application GUIs, WindowsForms is used in many current applications. Evenwith the advent of WPF, Windows Forms is still theright choice for creating some new software, such asline-of-business (LOB) applications. To let thesetechnologies be used together, WPF applicationscan host Windows Forms controls, while WPFcontrols can be hosted in Windows Forms

applications. For example, a Windows Formsapplication might host a WPF control that providesthree-dimensional data visualization, or a WPFapplication might use the DataGridView controlprovided in Windows Forms. While there are some

51


52/61


limitations, creating applications that use bothtechnologies is certainly possible.

Silverlight: While XBAPs allow creating WPF-basedinterfaces that run in browsers, theyre limited toWindows systems that have the .NET Frameworkinstalled. Rich internet applications (RIAs) typicallyneed to be accessible from any kind of client. Tomeet this need, Microsoft provides Silverlight. Thisfreely downloadable technology provides a subset offull WPF functionality, including 2D graphics,animation, and video, and it runs in a variety ofbrowsers on Windows, Macintosh, and (throughNovell) Linux systems.

ASP.NET and ASP.NET AJAX: Windows applicationscan use WPF (or perhaps Windows Forms) for theiruser interface, while multi-platform RIAs can useSilverlight. One more option is to provide astandards-based Web interface using only what the

browser providesno download is necessary. Thisis exactly whats done by ASP.NET and ASP.NETAJAX. This kind of interface isnt as good atproviding some features of an RIA, such as video,but especially with AJAX, it can still offer aresponsive and effective user experience.

Windows CardSpace

Whether its via a Web browser or some other kind ofclient, users routinely access applications across anetwork. Since these applications commonly require theirusers to identify themselves in some way, theinescapable corollary is that people are regularly forced to

52


53/61


acquire and present identity information to remotesoftware. One very common example of this is accessingInternet applications via a browser.

As described earlier, people most often rely onusernames and passwords to express these digitalidentities today, with all of the problems this entails.Windows CardSpace, part of the larger identitymetasystem, offers an alternative approach to addressingthese problems. To get a deeper understanding of howCardSpace does this, the place to start is with the basicconcepts of the identity metasystem.

Windows CardSpace and the Identity

Metasystem

When a user accesses an application, whether from aWeb browser or an application-specific client orsomething else, she commonly presents some kind ofdigital identity. Digital identities come in many varieties,but virtually all of them are represented on the network bya security token. While a simple security token can be justa username and password, a more complex token mightinclude an X.509 certificate or an XML document.However theyre represented, security tokens are todaystypical mechanism for representing digital identities onthe network.

While its tempting to believe that well all one day adopt a

common security token format, the reality is that diverseapproaches will continue to be used. Just as we todaycarry multiple identity cards in our walletdrivers license,credit card, airline frequent flyer card, and morewellalways have diverse digital identities represented by

53


54/61


diverse kinds of security tokens. No single identity systemcan provide a universal answer, and so multiple securitytokens will always be necessary.

Yet users still need some way to work consistently withtheir diverse digital identities. Even though no singleidentity system will suffice, its possible to create asystem of identity systemsan identity metasystemthatallows using a myriad of digital identities in a consistentway. Working with others, Microsoft has led the processof defining this metasystem. Based on open Webservices technologies, such as WS-Security and WS-Trust, this metasystem defines how digital identities canbe acquired and used, regardless of the type of securitytoken they depend on.

The process of issuing, acquiring, and using digitalidentities can be thought of as requiring three distinctroles. Those roles are the following:

User: More formally known as the subject, the user isthe entity that has a digital identity.

Identity provider: An identity provider supplies a digitalidentity for a user. For the digital identity you use atwork, for example, the identity provider is youremployer, and your security token is likely issued bya system such as Active Directory. For the digitalidentity you use with Amazon, the identity provider is

effectively you, since you define your own usernameand password. Digital identities created by differentidentity providers can carry different information andprovide different levels of assurance that theinformation they contain is accurate.

54


55/61


Relying party: A relying party is an application that insome way relies on a digital identity. A relying partywill frequently use an identity (that is, the information

contained in this identitys security token) toauthenticate a user, then make an authorizationdecision, such as allowing this user to access someinformation. A relying party might also use theidentity to get a credit card number, to verify that thesame user is accessing it at different times, or forother purposes. Typical examples of relying partiesinclude Internet Web sites, such as banks, online

merchants, and auction sites, and any applicationthat accepts requests via Web services.

These three kinds of entities interact in the identitymetasystem. The figure below illustrates theseinteractions, along with where CardSpace fits in.

55


56/61


The process begins when a user accesses a relying partyvia a CardSpace-aware application. To learn what type ofsecurity tokens this relying party will request, theapplication must get the relying partys policy (step 1). Fora browser accessing a Web site, which is the mostcommon case today, the sites policy is expressed inHTML and sent back as part of a Web page. Forapplications accessed via Web services, however, theapplication instead uses the industry-standard protocoldefined by WS-MetadataExchange to ask the relyingparty for its policy. In this case, the policy is expressedusing WS-SecurityPolicy, another industry standard.However the policy information is acquired, it alwaysindicates what kind of security tokens this relying party

56


57/61


will accept and what information those tokens mustcontain.

Once CardSpace knows what kind of security tokens therelying party needs, it displays the identity screen shownearlier. Each digital identity available to this user isrepresented as an information card on this screen. Cardsissued by an external relying party are referred to asmanagedcards, while those issued by CardSpaces self-issued provider are known as self-issued cards. Bothkinds of cards can be shown on this screen, and the usercan potentially select one of either type. To make thisdecision easier, the screen indicates which identitiesmeet the requirements of the relying party by graying outcards that dont qualify. The user then selects one ofthese as the digital identity he wants to use (step 2).

A card doesnt contain an actual security token, however.Instead, it holds the information necessary to locate aparticular identity provider and request a security token

for this user. (In fact, each card is originally created bysome identity provider.) CardSpace uses the contents ofthe card selected by the user to request a security tokenfrom the identity provider that issued that card (step 3).This request is made using WS-Trust, another industry-standard protocol, and the user authenticates himself tothe identity provider using Kerberos, an X.509 certificateand digital signature, or another mechanism. The token isreturned in an encrypted form, which also contains atimestamp to prevent this token from being stolen off thewire and reused in the future.

Once the requested security token is returned, its sent tothe relying party (step 4). How the relying party uses the

57


58/61


information in the token can vary. If the token contains anX.509 certificate, for example, and is accompanied by adigital signature, the relying party will likely use the token

to authenticate the user. Theres no requirement thattokens be used for authentication or for any othersecurity-related purpose, however. A token might carryinformation such as proof of a users age, eligibility for adiscount at an Internet shopping site, or anything else.Authentication is one important use for security tokens,but its not the only option.

Its important to note that CardSpace need not be awareof the format or technology used for the security token.Rather than trying to create a new single source for digitalidentities or a standard format for security tokens, thegoal of the metasystem is to provide a coherent way touse any digital identity based on any kind of securitytoken. By providing a Windows implementation of keyparts of the metasystem, CardSpace plays an importantrole in making this general approach to digital identity a

reality.

Fighting Phishing

Identity providers are often distinct from the user, such aswhen an identity is assigned by an employer. Yet thereare plenty of situations where the identity provider isactually the user herself. If CardSpace isnt used, forinstance, accessing many Web sites requires giving a

username and password, both of which are defined bythe user. Once the user has created this identity, she canlater supply the username and password, then check herbank balance, buy a book, or do whatever else this siteallows.

58


59/61


Yet because they depend on passwords, these simpleself-issued identities are targets for attackers, asdescribed earlier. To help reduce these attacks,

CardSpace provides an alternative way to create a self-issued identity. This self-issued identity provider runslocally on the users Windows system. Rather than relyingon a username and password, the security tokenscreated by the self-issued identity provider are definedusing the Security Assertion Markup Language (SAML),an OASIS-defined standard. These tokens rely on publickey technology rather than passwords to prove the users

identity, and if a relying party accepts them, they can playthe same role as the traditional username and password.The advantage is that there is no longer a password forphishers to steal. Reducing the use of passwords canmake phishing a much less serious problem.

Windows CardSpace and Other Microsoft

Technologies

CardSpace is related to several other Microsofttechnologies, including the following:

WCF: Because it relies on Web services standardssuch as WS-Security and WS-Trust, CardSpaceuses WCF for communication. In fact, the creator ofa WCF application can cause that application to useCardSpace just by specifying a particular binding.

Active Directory: Although its not currently possible,Active Directory will eventually be able to act as anidentity provider in the metasystem. Once this ispossible, expect to see Windows CardSpace usedinside enterprises as well as on the Internet.

59


60/61


Windows Live ID: Microsofts Live ID identity system iscapable today of acting as a managed identityprovider for Windows CardSpace. Note that

CardSpace isnt a replacement for Live ID (formerlyknown as Passport), since the two address quitedifferent problems.

Conclusion

The .NET Framework 3.5 is the latest incarnation of themainstream Windows programming environment. Built on

and extending its predecessors, its goal is to support thecreation of modern applications. By building its varioustechnologies on a common foundation, Microsoft isstriving to make the whole greater than the sum of theparts, letting developers create applications that use thevarious parts of the .NET Framework 3.5 in a coherentway.

From its first release in 2002, the .NET Framework has

matured into the dominant platform for new Windowsapplications. Used widely today by enterprises, ISVs, andMicrosoft itself, the Framework has proved its value.Together with Visual Studio 2008, the .NET Framework3.5 represents Microsofts current state of the art inapplication development.

About the Author

David Chappell is Principal of Chappell & Associates(www.davidchappell.com) in San Francisco, California.Through his speaking, writing, and consulting, he helps IT

60


61/61


professionals around the world understand, use, andmake better decisions about enterprise software.

Introducing NET Framework 35 v1[1]

Documents

Transcript of Introducing NET Framework 35 v1[1]