Yavor Georgiev's Blog

beat-machine: Our pitch at Startup Weekend Redmond

Tue, 21 Feb 2012 15:37:10 -0800

beat-machine:

Our pitch at Startup Weekend Redmond

beat-machine: 3rd place at Startup Weekend Redmond… not bad for...

Tue, 21 Feb 2012 15:28:40 -0800

beat-machine:

3rd place at Startup Weekend Redmond… not bad for a crew of 4

Azure SDK for Node.js 0.5.3 is out

Fri, 17 Feb 2012 13:16:25 -0800

We just pushed out a small February update (0.5.3) to the Azure SDK for Node.js, containing the following fixes:

#81: Start-AzureEmulator errors if there’s a space in the service path: we corrected an issue where the emulator would fail if there was a space in the path to the service
#82: Remove-AzureService prompts for yes/no confirmation: when you want to remove a service, you will now see this prompt to prevent accidental data loss:
```
Confirm
Are you sure you want to remove service "foo"?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help
(default is "Y"):Y
```
#131: Start-AzureEmulator -Launch fails if run twice on the same web role: corrected a problem where our attempt to clean up logs was causing the emulator to crash
#138: Publish-AzureService throws ArgumentNullException when no certificates element provided in .cscfg: this may have affected folks using the Mongo commandlets
#141: Worker role did not allow write access: the user under which Node was running in worker role did not have sufficient permission to write to disk. This may have surfaced as some modules who need to write to disk (such as stylus) failing.

Here is a one-click install of the new bits.

Alongside this, we also released a refresh (0.5.2) of the npm package for Azure, adding support for accessing ServiceBus queues and topics, among other fixes. Read Glenn’s blog post for more details.

One of the most beautiful libraries in the world (Codrington...

Tue, 03 Jan 2012 22:18:53 -0800

One of the most beautiful libraries in the world (Codrington Library at Oxford). UW’s Suzzallo library also made the list.

Node.js/express blog on Azure in 5 minutes

Tue, 13 Dec 2011 14:34:00 -0800

Following up on the announcements and demos shown at today’s Learn Windows Azure event, I decided to put together a very quick demo that gets you going on Azure with a real app as fast as possible.

I decided to modify express’ blog sample to use Azure storage, and also pre-configured all the service/role settings that Azure needs so you can get going as fast as possible.

Here is the 5-minute recipe:

Get your Windows Azure account
Get the Windows Azure SDK for Node.js
Get the sample source code from GitHub. If you are wondering where some of the static content in the sample came from, check out this getting started document.
Get the needed Node packages by running this inside the ExpressBlog\WebRole folder:
```
npm install
```
You should now be able to launch the Windows Azure PowerShell for Node.js shortcut from your start menu. Make sure you run as Administrator. The rest of the steps here should be completed from that shell.
Download your Azure publish settings:
```
Get-AzurePublishSettings
```

Import the settings:

Import-AzurePublishSettings mine.publishsettings

Head to the Azure portal and create a storage account under your subscription. Make note of the account name and access key.
Modify the ExpressBlog\WebRole\Web.cloud.config file where indicated to include the storage settings.
You are now ready to publish. Anywhere inside the ExpressBlog folder, run the following, making sure you use a unique service name:
```
Publish-AzureService -Name uniqueServiceName
```

You’re all done!

Unfortunately things don’t always go according to plan, so in case you get an Internal Server Error or anything else goes wrong after you deploy to the cloud, use this simple trick to debug.

Inside the Web.cloud.config file, enable logging:
Redeploy the service by simply typing:
```
Publish-AzureService
```
Look at the Node.js log file for hints of what may be wrong at http://uniqueServiceName.cloudapp.net/server.js.logs/0.txt

RIA Services SP2 RTW released

Fri, 09 Dec 2011 12:13:00 -0800

We’re happy to announce the final release of WCF RIA Services V1 SP2:

In this release, we add the following new features:

Support for Silverlight 5 (the standalone installer linked above also supports Silverlight 4)
DateTimeOffset support + various bugfixes
Entity Framework Code-First development, using this NuGet package

Known issues include:

Entity Framework 4.1 is required, but version 4.2 isn’t supported yet
Requires Visual Studio 2010 or SP1. Visual Studio 11 isn’t supported yet
Work on supporting Universal Providers for improved Windows Azure deployment is ongoing
If you want to create a Silverlight 4 Business Application Template, first create an instance of the Silverlight 5 template, and then use the Silverlight project properties to retarget it to Silverlight 4. You might see some temporary errors (System.Windows.Markup.XamlParseException) in the designer and error window, but rebuilding will make those disappear.

Street Art Utopia - cool street art and graffiti blog

Fri, 09 Dec 2011 00:00:00 -0800

Street Art Utopia - cool street art and graffiti blog

Amazing ISS time-lapse

Thu, 17 Nov 2011 00:31:00 -0800

Amazing ISS time-lapse

Trying to clone a repo using the GitHub for Mac client at work...

Fri, 04 Nov 2011 12:03:00 -0700

Trying to clone a repo using the GitHub for Mac client at work today was failing due to our proxy server. All my repos would show up, but they would fail when cloning, and trying to synchronize wouldn’t work either. I know I am sitting behind a HTTP proxy at work, but I assumed the GitHub client would just inherit the proxy settings already defined in the OSX preferences. Apparently not… so I hunted around the app to try and find dedicated proxy settings. Again, no luck here, but after looking around forums I discovered you could use the command line to set the proxy:

git config --global http.proxy http://proxy:port

I restarted the GitHub client, and now it would happily clone and sync my repos.

"Active" Federation with Silverlight, WCF, and WIF

Thu, 06 Oct 2011 00:30:00 -0700

In this post I provided a description of the active federation authentication pattern and shared how to implement it with RIA Services. In this post I will show how to do the same but use a regular WCF service instead of a RIA Services DomainService. I am including the diagram from my last post, with some minimal modifications here.

I should clarify why I am putting the word active in quotation marks. The following will only make sense if you understand the difference between passive and active federation, which is outlined in the post linked above. In the passive federation case, the user never enters their credentials in the client app; they are redirected to the STS of the identity provider organization. This way the user is providing their credentials directly to the party they trust, and not to the app, which they may not trust. In the active federation case, they actually provide their credentials to the client app, and trust that the app will not be malicious, and will simply forward those credentials to the STS of the identity provider. The client app is responsible for creating a secure login UI, and also for securely transmitting the credentials to the STS. That is a lot of responsibility, and in traditional active federation scenarios, the client app uses strong encryption to guarantee the secure transfer of credentials. Still, lots of users may be reluctant to type in their credentials into a client app they don’t trust.

In this example I show how to do the active federation flow, and my client app does collect the credentials. I have hand-rolled my login UI, and cannot make any guarantees as to how secure it actually is. For the communication with the server, I simply use HTTPS, instead of more comprehensive message-level security. So my example reaps the convenience of the active flow (no need to redirect the user to a different page, login happens in-app), however may not provide the traditional security guarantees associated with it. Hence “active”.

What I provide here may be perfectly secure for many scenarios but is up to you, the developer, to assess if this particular setup satisfies the requirements of your users and your organization.

Now some specifics of the sample. It’s a simple app that can draw squares on the screen according to a Fibonacci tiling. There are two registered users: fabrikam\yavor and fabrikam\test and the password for both of them is 12345. Both can log into the app, however only the fabrikam\yavor user is in the role Calculators, meaning people who can carry out calculations on the service. This is enforced by the following attribute on the service’s GetSequence method.

[PrincipalPermission(SecurityAction.Demand, Authenticated = true, Role = "Calculators")]
public int[] GetSequence(int max)

The bottom line here is that even though we have a STS with external user authentication, we kept authorization local to our app (we use ASP.NET roles). That’s a choice you can make as a developer - you can also externalize the user roles (or claims) as part of the STS, or keep them local.

There are lots of extra details in the app, which you’ll see by exploring the source.

The code is available here. The solution should be fairly self-contained, so all you need to run it is Visual Studio 2010 and the Windows Identity Foundation Runtime. Here are some additional notes on the structure of the sample:

First, please run the included SetupCertificates.cmd script inside the Scripts folder
The solution will create two applications in your local IIS instance: FibonacciService and IdentityProviderAndSts. Make sure you launch Visual Studio as Administrator, so it has permission to create those. Also make sure you enable HTTPS so both of the applications in the IIS Manager

I want to credit the folks behind the Identity Developer Training Kit, from where I shamelessly stole some code.

Hosting WCF NetTcp services in Azure with a Silverlight client

Mon, 16 May 2011 17:23:00 -0700

UPDATE: Folks from the Windows Azure team have posted an improved solution for how to host NetTcp services in Azure by using a WebRole instead of a WorkerRole, which simplifies the setup quite a bit.

Silverlight 4 added support for WCF’s NetTcpBinding, which is a performant and scalable TCP-based binding. It is also a useful binding when used in Windows Azure because it is not affected by Azure’s random load-balancer when using multiple instances of the service and creates an effectively pinned duplex connection to the cloud. The only disadvantage of the NetTcp binding is that it Silverlight does not support TCP transport security, so all the traffic to the web service is unsecured and can be intercepted by malicious parties. That may or may not be acceptable for your application.

I put together a sample on how to host a NetTcp service in Azure and consume it using a Silverlight client. The first thing to keep in mind here, is that Silverlight has some networking restrictions for security reasons. One of this restrictions is that if you want to speak TCP to a server, the server has to expose a policy file over port 80 explicitly listing the ports that it allows TCP for. Moreover, the ports have to be in the range 4502-4530. In other words if my Silverlight app wants to talk to net.tcp://contoso.cloudapp.net:4502, then I need to expose a policy file at http://contoso.cloudapp.net:80.

Another interesting concern here is that hosting WCF NetTcp services is only allowed in Azure Worker Roles. This is because the Azure Web Role (which is basically an IIS instance) does not have WCF non-HTTP activation enabled.

My sample actually shows two separate approaches on how to implement this. If you already have an external web server where you host static HTML content as well as your Silverlight XAP file, the sample shows an approach using a single Worker Role.

Now if you don’t have an existing webpage, you are probably already considering a Web Role, where you can host the static HTML files and Silverlight XAP file. In that case we can make our life easier by reusing that WebRole to host the clientaccesspolicy.xml file as well. This diagram shows that approach: Web Role + Worker Role.

To run the sample, you need to install the following:

Visual Studio 2010
Windows Azure SDK v1.4
Windows Azure Tools for Microsoft Visual Studio 2010 Platform v1.4

Keep in mind that when you run the sample locally in the development fabric, it will not run correctly, because the the emulator cannot use port 80. Since the policy file has to be hosted on port 80, calls from Silverlight to the service will fail. This gets resolved when you publish the sample to the cloud.

You can get the sample code here.

Active Federation using RIA Services and WIF

Thu, 12 May 2011 21:06:00 -0700

UPDATE: A coworker here at Microsoft has brought up some interesting thoughts regarding this approach, and I’ve added a brief discussion below the second diagram.

Recently I decided to experiment with RIA Services in federated authentication scenarios. For those of you that aren’t familiar with federation, let’s consider the following scenario: my company Contoso builds an expense reporting application that I host in the cloud. One day I get Fabrikam to sign up as a client, and now I have to onboard all Fabrikam employees onto my system. It is true that I could create a login for every employee, but that is impractical because Fabrikam employees have to remember that extra login, and also I would need to keep my list of logins in sync when employees join or leave Fabrikam.

The solution for this is federated authentication, where my app can use a third-party (Fabrikam’s) authentication provider (also known as a Security Token Service or STS) to authenticate users. I won’t try to explain federation from scratch, because Microsoft’s patterns & practices has a great write-up. You can squint and ignore some of the claims stuff as it’s not super relevant to what I’m describing here.

To build an app with federated auth using RIA Services, most folks resort to passive federation, which you might be familiar with from using things like your LiveID login. The passive approach is browser-friendly and uses a combination of cookies, URIs and redirects to log you in to the site you’re trying to access. The downside in the case of Silverlight is that you cannot complete the login inside your app: you have to navigate away from the Silverlight control, type in your credentials into a HTML (or ASPX) page, and then be bounced back by your browser to reload the control. Another downside is that you need to host a HTML page for the user to type in their credentials, in addition to the Silverlight app and the web services, which might not be desirable.

The following diagram has a more detailed explanation of the exact flow that happens during the passive scenario:

From what I’ve seen, most folks use this passive pattern with RIA today. Eugenio Pace’s blog has a few great write-ups and demos that you can try out. Some are a bit dated, but you should be able to find your way around.

What I wanted to try out was the active federation case, in which the Silverlight app talks dirctly to the identity provider. This has the benefit of having the user type their credentials directly into the Silverlight app, without having to leave the page, which results in a more polished and faster user experience. Eventually, as the crypto support in Silverlight improves, it may end up being a more secure solution as well, if we are able to encrypt and sign the tokens that are being exchanged. The following diagram demonstrates the slightly different message flow in the active case. Note that the app itself is doing most of the work, not the browser.

Some interesting considerations emerged in conversation with Robert O’Brien, an architect here at Microsoft. Please consider these before building your own app:

One of the things we gain in this approach over a passive federation approach is the ability to log the user in from inside our UI. That provides for a better user experience, but it also puts the burden on our app to expose a credentials UI and pass the token over to the service. Potentially this could be a security risk for our app. Some folks believe that this goes against the spirit of federated authentication since it takes control away from the identity provider.
The implementation shown here relies on WS-Trust as the protocol for the token. Unfortunately in today’s federated web, it seems like only ADFS and maybe OpenID servers honor that protocol. If you are trying to use WS-Trust and use Facebook/Yahoo/Google (either directly or through Azure’s Access Control Service) as the identity provider, you will find that WS-Trust is probably not supported. So outside the enterprise environment, this approach might not work.

Now some specifics of the sample. It’s a simple master/detail application that allows you to display and edit data. There are two registered users fabrikam\yavor and fabrikam\test and the password for both of them is 12345. If you don’t log in and try to display the data, you will get an error because of the EnableClientAccess attribute.

[RequiresAuthentication]
[EnableClientAccess()]
public class CustomersService : LinqToEntitiesDomainService

All authenticated users can view the data, but only users in the Editor role can make changes to it. Only the user fabrikam\yavor is in that role.

[RequiresRole("Editors")]
public void UpdateCustomer(Customer currentCustomer)

There are lots of extra details in the app, which you’ll see by exploring the source.

The code is available here. Note that you need the following installed on your machine for it to work:

Visual Studio 2010
SQL Server 2008 R2 Express
SQL Server 2008 R2 Management Studio Express
WCF RIA Services V1 SP1/SP2
Windows Identity Foundation Runtime
The AdventureWorks LT 2008R2 database for SQL Server Express 2008 R2

Here are some additional notes on the structure of the sample:

First, please run the included SetupCertificates.cmd script inside the Scripts folder
The solution will create two applications in your local IIS instance: AddressBookFederatedAuth and IdentityProviderAndSts. Make sure you launch Visual Studio as Administrator, so it has permission to create those. Also make sure you enable HTTPS so both of the applications in the IIS Manager
Change the Application pool under which those applications are running to use the Network Service account.
Use SQL Server Management Studio, make sure Network Service is added as a login to your SQL instance. When you add the account, make sure you give him some sane Server Roles (for example sysadmin). Let me know in the comments if you find any of these steps difficult and I can provide more detailed instructions.

I want to credit Eugenio Pace, Kyle McClellan, and the folks behind the Identity Developer Training Kit, from where I shamelessly stole some code.

Debugging SGEN LoaderExceptions errors

Fri, 06 May 2011 16:33:00 -0700

Recently we were contacted by a customer who was building a Release version of their assembly in Visual Studio and encountered the following error:

You could get the same error if you attempt to run the sgen.exe tool on the built assembly:

Microsoft (R) Xml Serialization support utility
[Microsoft (R) .NET Framework, Version 4.0.30319.1]
Copyright (C) Microsoft Corporation. All rights reserved.
Error: Unable to load one or more of the requested types. Retrieve the LoaderExceptions property for more information.

If you would like more help, please type “sgen /?”.

The reason why this happens is that in Release builds, Visual Studio attempts to generate a serialization assembly containing the types in your solution, to improve XmlSerializer serialization performance, should you choose to serialize your types. This can be disabled by going to the Build tab of the project properties and setting “Generate serialization assembly” to “Off”.

However if you legitimately want to take advantage of the serialization assembly, this error can be very frustrating to diagnose. The exception text leads you to believe Fusion is having a problem loading one of the dependent assemblies that your assembly is referencing. That may be the case, and you can easily diagnose that problem by launching the Fusion Log Viewer, then enabling assembly logging, and then rebuilding your project (or rerunning sgen.exe). Scott Hanselman has a good write-up on how to do this.

Sometimes after inspecting the Fusion log, you’ll see that all assemblies were infact loaded correctly, but you’re still getting this error. In recent investigation we found that sometimes sgen.exe will show this error, and it won’t have to do with an assembly loading problem. Here is how to get to the bottom of that case.

In Visual Studio create a dummy Console Application. We won’t actually use this, it’s just a way for us to start sgen.exe in the debugger.
Go to the Debug tab of the project properties and set
- Start external program= C:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\Bin\NETFX 4.0 Tools\sgen.exe
- Command line arguments= /f /a:MyAssembly.dll
- Working directory= C:\FolderContainingMyAssembly
Configure the debugger to break on all exceptions by going to the Debug menu and selecting Exceptions and then checking Thrown next to Common Language Runtime Exceptions
Also ensure that if you go to Tools > Options > Debugging that Enable Just My Code is unchecked.
Then you are ready to press F5. If everything works correctly, Vistual Studio will break at an exception. Right click on sgen.exe anywhere in the Call Stack window and load the symbols from the Microsoft Symbol Servers.
Once the symbols have loaded, press F5 until you get to a ReflectionTypeLoadException. At that point you can select View Details and inspect the LoaderExceptions property yourself. This property will usually reveal the real source of the problem:

Hope this is useful!

The time lapse aside, even capturing individual shots of the...

Tue, 19 Apr 2011 14:57:28 -0700

The time lapse aside, even capturing individual shots of the Milky Way looking like that is amazing. Long exposure + RAW?

RIA Services T4 template to copy comments from server to client

Tue, 05 Apr 2011 15:01:00 -0700

As you know one of the new features in RIA Services V1 SP1 is support for T4 templates. The T4 template is a design-time artifact that can modify the way RIA Services client-side code generation happens. For more information on T4 templates, check out Jeff Handley’s blog post on the subject.

Recently I was experimenting with RIA Services and I discovered that the IntelliSense comments for my entities were very sparse on the client. For example my Customer entity has a CompanyName property and the IntelliSense comment for that was:

Gets or sets the ‘CompanyName’ value.

It was clear that this comment was being generated automatically, which was quite annoying because I had used my entity model on the server to carefully create useful comments for each property.

I hear EF is actually smart enough that it supports defining these comments in the database itself, and they will get copied over when you create the model, but I haven’t tried it myself.

So I set out to write a T4 template to take those comments from the server types generated by EF and copy them over to my Silverlight project.

The first step was to tell Visual Studio to scrape all the types in my server project and generate a XML file containing their comments, by going to the Build tab of project properties and checking this box:

This file is usually used for IntelliSense, but you can open it up and the schema is pretty self-explanatory. Because code comments don’t get compiled into assemblies, this is the only way I know to tell VS to export the comments from my entities.

The next step was to write a simple T4 template using RIA Services extensibility. What this does is that as it is about to generate a type on the client (which happens when you build), it will look up that type name and all its properties in the above XML file, and copy the comments over to the generated file.

[DomainServiceClientCodeGenerator(typeof(CommentsClientCodeGenerator), "C#")]
public class CommentsClientCodeGenerator : CSharpClientCodeGenerator
{
    private XElement comments;

    public CommentsClientCodeGenerator()
    {
        comments = XElement.Load(new FileStream("..\\AddressBook.Web\\bin\\AddressBook.Web.XML", FileMode.Open));
    }

    protected override EntityGenerator EntityGenerator
    {
        get
        {
            return new CommentEntityGenerator(comments);
        }
    }

    public class CommentEntityGenerator : CSharpEntityGenerator
    {
        private XElement comments;

        public CommentEntityGenerator(XElement comments)
        {
            this.comments = comments;
        }

        private string PrintInnerXml(XElement element)
        {
            string[] lines = element.Nodes()
                .Aggregate("", (b, node) => b += node.ToString())
                .Split(new string[] { Environment.NewLine }, StringSplitOptions.RemoveEmptyEntries);
            StringBuilder sb = new StringBuilder();
            foreach(string line in lines)
            {
                sb.AppendLine(line.Trim().Insert(0, "///"));
            }
            return sb.ToString().Trim();
        }

        private XElement FindCommentElementByName(string name)
        {
            return comments
                .Descendants("member")
                .Where(x => String.Compare(x.Attributes("name").FirstOrDefault().Value.ToString(), name, true) == 0)
                .FirstOrDefault();
        }

        protected override void GenerateClassDeclaration()
        {
            XElement element = FindCommentElementByName("T:" + this.Type.FullName);
            if (element != null)
            {
                this.WriteLine(PrintInnerXml(element));
            }
            base.GenerateClassDeclaration();
        }

        protected override void GenerateProperty(PropertyDescriptor propertyDescriptor)
        {
            XElement element = FindCommentElementByName("P:" + propertyDescriptor.ComponentType.FullName + "." + propertyDescriptor.Name);
            if (element != null)
            {
                this.WriteLine(PrintInnerXml(element));
            }
            base.GenerateProperty(propertyDescriptor);
        }
    }
}

That’s all I had to do… as soon as I started building this class (in its own project) inside my solution, the code comments I defined on the server started appearing in my Silverlight client.

The code is available here. Note that you need the following installed on your machine for this to work:

Visual Studio 2010
WCF RIA Services V1 SP1
WCF RIA Services Tookit December 2010
The AdventureWorks LT database for SQL Server Express 2008 R2. You only need this if you want to actually run the sample.

Hope you find this useful!

Презентацията ми за WCF и Silverlight от Дни на Microsoft '11

Mon, 04 Apr 2011 19:20:00 -0700

Ето и презентацията ми за Silverlight и WCF услуги в Windows Azure. Очаквайте и демонстрациите скоро! Отдолу ще намерите презентацията и примерите които показах.

Примери

Презентацията ми за WCF RIA Servces от Дни на Microsoft '11

Mon, 04 Apr 2011 19:15:00 -0700

Благодаря на всички които дойдоха на моята презентация за RIA Services миналата седмица по време на Дни на Microsoft ‘11. Отдолу ще намерите презентацията и примерите които показах.

Примери

Accessing SharePoint UserProfileService from Windows Phone 7

Mon, 07 Mar 2011 12:05:00 -0800

UPDATE: … and it wasn’t long before Matthew McDermott went ahead and implemented ths as an actual sample, which you can get here.

A while back I blogged a workaroundfor accessing some ASMX services from Silverlight 4. The problem was that the guid and char types that those services return are not recognized by Silverlight and you end up with the exception below. One of the important services affected by this is SharePoint’s UserProfileService, which I realize is pretty important to a lot of developers.

System.ServiceModel.Dispatcher.NetDispatcherFaultException was unhandled by user code. The formatter threw an exception while trying to deserialize the message: There was an error while trying to deserialize parameter http://tempuri.org/:HelloWorldResponse. The InnerException message was ‘Error in line 1 position 268. Element ‘http://tempuri.org/:HelloWorldResult’ contains data of the ‘http://microsoft.com/wsdl/types/:guid’data contract. The deserializer has no knowledge of any type that maps to this contract. Add the type corresponding to ‘guid’ to the list of known types - for example, by using the KnownTypeAttribute attribute or by adding it to the list of known types passed to DataContractSerializer.’. Please see InnerException for more details.

(Same goes for http://microsoft.com/wsdl/types/:char)

We have already fixed this issue and you will not need the workaround anymore in the next version of Silverlight.

In implementing the workaround, I used an IClientMessageInspector, which unfortunately is only available starting in Silverlight 4. So all of our developers using Silverlight 3 (and in particular folks writing apps for Windows Phone 7) cannot use the workaround.

Fortunately, there is a way to “fake” an IClientMessageInspector on older versions of Silverlight, and I wrote a sample for that back in the Silverlight 2 days. So combining these two samples together, you can be on your way:

Create a “fake” IClientMessageInspector like in this sample
Use the IClientMessageInspector implementation that treats the guid and char types emitted by ASMX from this sample.

Hopefully this will unblock folks out there, if there is significant interest here I can create a combined sample that shows the whole thing end-to-end.

Some cool shots from the Silverlight Firestarter event.

Mon, 13 Dec 2010 00:00:00 -0800

Some cool shots from the Silverlight Firestarter event.

Silverlight Firestarter demo

Thu, 09 Dec 2010 00:00:00 -0800

In my previous post I linked to the video and slides from my talk. This point contains the code sample, which is available here.

Setting up your machine

Here is what you need on the machine before you get started:

Windows 7
Visual Studio 2010
Silverlight 4 tools for Visual Studio 2010
SQL Server 2008 Express (which I’m pretty sure comes with Visual Studio 2010 by default)
IIS7

Before you proceed, make sure the user account under which SQL Server Express is running is NETWORK SERVICE. If you don’t remember how this was installed, open up Task Manager (make sure you select “Show processes from all users”) and look for the sqlsevr.exe process. If you find that you need to change the user, this topic on MSDN should come in handy.

The other tricky part is installing/configuring IIS. Go to the search box in the Start menu and type “Turn Windows features on or off”, then select top result. In the box shown, make sure the following are checked.

Deploying the basic app

Download the zip file and unzip the content in a folder such as C:\Firestarter. It is actually very important to download this in a location other than your C:\Users\YourUser folder, due to an apparent bug with SQL Server Express.
Open Visual Studio as Administrator and open the solution file. You will be prompted to create a new website in IIS, and you should agree. If this succeeds you should see the solution open with both projects loaded correctly. But we’re not quite done yet.
We need to make sure the account under which IIS is running has access to SQL Express. Go into the IIS Manager (type inetmgr into the Start menu search box) and click on Application Pools. Find the ASP.NET v4.0 application pool and then select Advanced Settings on the right side. Find the Identity row and change that to NetworkService.
We also need to make sure that the NETWORK SERVICE user has access to the location where we put our files. Let’s assume you used C:\Firestarter as I recommended above. Go to the the folder properties, then go to the Security tab. NETWORK SERVICE is part of the Users group on any machine, so we can just make sure that the Users group has read and write permission. If you don’t see the Users group go ahead and add the NETWORK SERVICE account explicitly here and give it read and write permission. Make sure the permissions are inherited all the way down, especially to the App_Data folder and the .mdf files inside that folder. You should double-check that every .mdf file allows the Users group or the NETWORK SERVICE account read and write permission. Otherwise you will get a stream of inexplicable errors as you attempt to follow the rest of this post.

You should now be able to hit F5 in Visual Studio, the application should pop up and you should be able to see the book categories and click on individual books.

At this point you can also try and use the demo to enable the debugging features I cover in the video.

Setting up Windows Authentication

Needless to say, before we can demonstrate this scenario, we need to make sure the machine we are using is joined to a domain.

We need to do the IIS configuration step that I refer to in the video, but I don’t show. We can open IIS Manager and find our web application, then double-click the Authentication icon and make sure Windows Authentication is enabled.

We can then follow the rest of the steps as shown in the video. One exception is that instead of my personal domain credential, you will need to specify your own domain credential in the BookService.svc.cs code behind file. In the download I’ve changed it to domain\user.

Setting up Forms Authentication

Before we can get this to work, we need to first configure our website for access over HTTPS. Like I mention in the video, this authentication scheme requires HTTPS.

Back in IIS Manager we need to enable HTTPS on the Default Web Site bindings list. You can follow this tutorial by ScottGu.
Once the HTTPS binding is created for the parent website, we need to enable the HTTPS protocol for our BookService.Web site. We can do that by going to Advanced Settings and adding https in the list of Enabled Protocols. The values are comma-separated in case you were wondering.
If you end up using a self-signed certificate, realize the IE will display an error page warning you that the cert is not signed. That means that any calls that Silverlight tries to make to that page will be blocked automatically. The easiest way to fix this is to go over to Internet Options > Advanced and in the Security section deselect “Warn about certificate address mismatch”. Don’t forget to restart IE afterwards, and most importantly, don’t forget to reenable this option when you are done playing with the demo.
The last thing we need to realize is that we will be accessing the SL application over HTTP, but internally it will be making calls to HTTPS services. This is cross-scheme access and is normally disabled, even for same-domain calls. To address this we need a special clientaccesspolicy.xml file, which we place at the root of our IIS install, in my case that is C:\inetpub\wwwroot. The file looks like this:
```
   
      
         
            
         
         
            
         
      
   
```

Once all of this is done, we can go ahead and follow the steps in the video. Please look carefully at both Web.config and ServiceReferences.ClientConfig to make sure you comment out all sections that refer to ASP.NET authentication.

That is it, please let me know if you hit any issues in the comments.

Cheers,
-Yavor