User Impersonation in WCF

In some integration scenarios, impersonation is required, where a WCF service is required to assume the caller’s identity. Though this usually happens for a single call, the impersonation token could be retained for future use by the WCF servce. The reason impersonation is most relevant to integration scenarios is because all WCF service code running under the priviledges of the caller ensures that only resources and data available to the caller are made available.

I found this to be partcularly useful while integrating middle layers of various heterogeneous systems. I did not have to add additional integration code to ensure that application-level authorization was being implemented because I could be assured that the impersonated thread would be denied access if relevant permissions to resources have not been authorized in the target system.

Inline code to support impersonation in WCF is as shown below:

[OperationBehavior(Impersonation = ImpersonationOption.Required)]
public int AddNumbers(int i, int j)
{
    return (i + j);
}

To implement impersonation on all Operations, a behavior could be configured as shown below: 

<behaviors>
    <serviceBehaviors>
        <behavior name=“ServiceBehavior“>
            <serviceAuthorization principalPermissionMode=“UseWindowsGroups“
                                  impersonateCallerForAllOperations=“true“>
            </serviceAuthorization>
        </behavior>
    </serviceBehaviors>
</behaviors>

Summary of default WCF Bindings

A binding in WCF is one of the most important concepts behind the WCF architecture itself. Developers can create their own bindings if the below default WCF bindings do not suit a purpose by extending CustomBinding.

First a definition of what a binding controls. A WCF binding controls the following:

1. Transport (HTTP, MSMQ, Named Pipes, TCP)
2. Channel (one-way, duplex, request-reply)
3. Encoding (XML, binary, MTOM, JSON)
4. Supported WS-* protocols

I found the below matrix extremely helpful when determining which implementation of default binding to use when determining a solution architecture.

Binding	Configuration	Security	Default Session	Transactions	Duplex
basicHttpBinding	Basic Profile 1.1	None	No	-	-
wsHttpBinding	WS	Message	Optional	Yes	-
wsDualHttpBinding	WS	Message	Yes	Yes	Yes
wsFederationHttpBinding	WS-Federation	Message	Yes	Yes	No
netTcpBinding	.NET	Transport	Optional	Yes	Yes
netNamedPipeBinding	.NET	Transport	Yes	Yes	Yes
netMsmqBinding	.NET	Transport	Yes	Yes	No
netPeerTcpBinding	Peer	Transport	-	-	Yes
msmqIntegrationBinding	MSMQ	Transport	Yes	Yes	-

The above information has been condensed from Microsoft MSDN for ease of reference.

Deep Zoom Technology – Microsoft and Adobe

I was absolutely blown away with a demonstration of Vertigo’s work on SilverLight Deep Zoom at Microsoft TechEd 2008. Vertigo won the Microsoft Partner of the Year award for Web Development for 2008. Their work on the Hard Rock Memorabilia website is testament to their awesome creativity and the clever use of the SilverLight Deep Zoom technology. 

Even the Barack Obama campaign is using Deep Zoom technology in the most creative of ways. 

Adobe’s Flash evangelist Lee Brimelow was quick to point out that the Deep Zoom feature was not a new concept in Flash. Zoomarama  takes Deep Zoom one step further with allowing you to create free, personal albums leveraging Adobe’s technology.

I cannot wait to get started with leveraging Deep Zoom at work. There are almost half a dozen web-based projects I can think of where I could have leveraged this technology to wow our customers.

Iterating through SharePoint 2007 Site Collection entities

I found that a simple yet good introduction to the SharePoint 2007 SDK was by playing with the iterative code below that lists nested sites and nested lists within a site collection. A colleague of mine who has just started looking at the SharePoint 2007 object model found this a good quickstart because the code gave him an avenue to start stepping in to the various SharePoint SDK objects and looking at their members. I hope you could find some use for it too.

 

using System;

using System.Collections.Generic;

using System.Text;

using Microsoft.SharePoint;

 

namespace TestSP

{

    class Program

    {

        static void Main(string[] args)

        {

            using (SPSite siteCollection = new SPSite(“http://test:41606″))

            {

                foreach (SPWeb site in siteCollection.AllWebs)

                {

                    foreach (SPList currentList in site.Lists)

                    {

                        SPQuery query = new SPQuery();

                        SPListItemCollection items = currentList.GetItems(query);

 

                        foreach (SPListItem item in items)

                        {

                            Console.WriteLine(“Item from site ‘{0}’ and list ‘{1}’ is named ‘{2}’”, 
                                                                              site.Title,

                                                                              currentList.Title,

                                                                              item.Name);

                        }

                    }

                }

            }

 

            Console.ReadLine();

        }

    }

}

 

  
Output

Installing PerformancePoint Server 2007 on a domain controller VPC

Last month I was attempting to install PerformancePoint Server Planning and Monitoring 2007 on a development virtual machine that I had promoted to a Domain Controller and the pre-requisite check kept failing with the below ambiguous message ”Failed Windows Server 2003 SP1 (non domain-controller)”. My OS was Windows Server 2003 SP2 and I just could not make sense of what was happening. As a consequence of failing this pre-requisite check, the ”Next” button was grayed out and I was stuck.

 

The easiest way to hack this pre-requisite check was by running the relevant MSI’s from command prompt with the SKIPREQCHECK argument set to true.

PerformancePoint Planning Server 2007
D:\> MSIEXEC /i PPLSrv.msi SKIPREQCHECK=1

PerformancePoint Monitoring Server 2007
D:\> MSIEXEC /i PSCSrv.msi SKIPREQCHECK=1

Launching the MSI this way ensures that the “Next” button is highlighted. I experienced no further issues with the setup on the VPC. Though Microsoft do not recommend installing the product on a Domain Controller, I needed to do it this way so I had a single, consolidated development VPC.