I just wrapped up a week at SD West in Santa Clara where I delivered 2 full day tutorials and 4 sessions. This post will lead you to all the sample code for those sessions, enjoy!

Tutorial: .NET Technology Roadmap

• The following link has instructions for machine setup, numerous references to resources, and code samples demonstrated: http://www.dasblonde.net/downloads/TechnologyRoadmap0308.zip

Tutorial: Building an Enterprise SOA with WCF

• Most of the samples for this tutorial come from my book. Download those samples with instructions here: www.thatindigogirl.com. In addition I also demonstrated some newer samples including the following:
• Proxies: http://www.dasblonde.net/downloads/Proxies.zip
• Error Handling: http://www.dasblonde.net/downloads/ErrorHandlers.zip
• Routers: http://www.dasblonde.net/downloads/Routers.zip

Entity Framework, AJAX and REST - A look at Project Astoria

• http://astoria.mslivelabs.com/
• http://quickstarts.asp.net/3-5-extensions/
• http://www.dasblonde.net/downloads/EFDataServicesSample.zip

Exploring Windows CardSpace

• http://www.dasblonde.net/downloads/CardSpaceSamples.zip

Federation with WCF

• Most of the samples for this session come from my book. Download those samples with instructions here: www.thatindigogirl.com.
• An additional sample: http://www.dasblonde.net/downloads/SecurityTokenClaims.zip

Scalability and Throughput Considerations for WCF

• Most of the samples for this session come from my book. Download those samples with instructions here: www.thatindigogirl.com.
• Also see the my proxy samples: http://www.dasblonde.net/downloads/Proxies.zip

I'm in the middle of preparing for a session at SD West next week where I talk about the Microsoft Technology Roadmap - basically an avalanche of technologies in one day. Each time I present this I have to update my resources with newer tools, usually extensions to Visual Studio environment, so that attendees can be successful at running demos.

Here is my latest list of "setup instructions" for the CTPs I use, with links to where the sites are located. I can't guarantee how long these will be the latest, but you should be OK for at least the next month!

Windows XP/SP2 or Windows Server 2003 Setup

This section describes core machine setup for the operating system, .NET 3.0 and SQL Server.

· Enable IIS

· Enable MSMQ

· Install .NET 3.0

http://www.microsoft.com/downloads/details.aspx?FamilyId=10CC340B-F857-4A14-83F5-25634C3BF043&displaylang=en

· Windows SDK Update for Vista (really, for .NET 3.0)

http://www.microsoft.com/downloads/details.aspx?familyid=4377f86d-c913-4b5c-b87e-ef72e5b4e065&displaylang=en

· SQL Server 2000/2005 or SQL Express

o Install any service packs

Windows Vista/SP1 or Windows Server 2008

This section describes core machine setup for the operating system, .NET 3.0 and SQL Server.

· Enable IIS/WAS

· Enable MSMQ

· NOTE: .NET 3.0 is already installed

· Windows SDK for Vista (really, for .NET 3.0)

http://www.microsoft.com/downloads/details.aspx?familyid=4377f86d-c913-4b5c-b87e-ef72e5b4e065&displaylang=en

· SQL Server 2000/2005 or SQL Express

o Install any service packs

Visual Studio 2005 (if you have to)

This section lists tools to install to set up your Visual Studio 2005 environment. For .NET 3.0 and 3.5 development, Visual Studio 2005 is sorely out of date on tools, so anything you install from this list below is likely not to work with newer code samples. You have been warned.

· Visual Studio 2005 Extensions for WCF and WPF – November 2006

http://www.microsoft.com/downloads/details.aspx?FamilyId=F54F5537-CC86-4BF5-AE44-F5A1E805680D&displaylang=en

· Visual Studio 2005 Extensions for WF – November 2006

http://www.microsoft.com/downloads/details.aspx?familyid=5D61409E-1FA3-48CF-8023-E8F38E709BA6&displaylang=en

· Visual Studio 2005 LINQ CTP - May 2006

http://www.microsoft.com/downloads/details.aspx?familyid=1e902c21-340c-4d13-9f04-70eb5e3dceea&displaylang=en

· Visual Studio 2005 ADO.NET vNext CTP – May 2006

http://www.microsoft.com/downloads/details.aspx?FamilyId=B68F6F53-EC87-4122-B1C8-EE24A043BF72&displaylang=en

· Visual Studio 2005 Entity Data Model Designer Prototype CTP – May 2006

http://www.microsoft.com/downloads/details.aspx?FamilyID=74bda7b2-9ca9-4eea-a33f-31942ddc9dbe&displaylang=en

Visual Studio 2008 RTM

This section lists tools to install to set up your Visual Studio 2008 environment. Many tools have been installed, but there are also many extensions for ASP.NET, AJAX, Silverlight and ADO.NET 3.5 features in this list.

· NOTE: Tools for WCF, WPF, WF, AJAX and LINQ are built-in

· Run this so that older projects will bind to older version of AJAX libraries

http://download.microsoft.com/download/7/9/2/79268325-1006-4566-bd26-5581b8971f36/DisableAjaxPolicy.EXE

· AJAX Control Toolkit for .NET 3.5 (includes the rich code sample for AJAX)

http://www.codeplex.com/AtlasControlToolkit/Release/ProjectReleases.aspx?ReleaseId=4941

· ASP.NET 3.5 Extensions Preview – December 2007 CTP

http://www.microsoft.com/downloads/details.aspx?familyid=A9C6BC06-B894-4B11-8300-35BD2F8FC908&displaylang=en

· ADO.NET Entity Framework Beta 3

http://www.microsoft.com/downloads/details.aspx?familyid=15DB9989-1621-444D-9B18-D1A04A21B519&displaylang=en

· Entity Framework Tools Beta 3

http://www.microsoft.com/downloads/details.aspx?FamilyId=D8AE4404-8E05-41FC-94C8-C73D9E238F82&displaylang=en

· Silverlight 1.1 Alpha Refresh – September 2007

http://msdn2.microsoft.com/en-us/silverlight/bb419317.aspx

· Silverlight 1.1 Tools Alpha for VS 2008 – November 2007

http://www.microsoft.com/downloads/details.aspx?familyid=25144c27-6514-4ad4-8bcb-e2e051416e03&displaylang=en

· Expression Blend 2 Preview – December 2007

· http://www.microsoft.com/downloads/details.aspx?familyid=65177E23-C116-475A-9057-5A5071A379F6&displaylang=en

· ASP.NET 3.5 Extensions Preview – ADO.NET Data Services Silverlight Add-On - December 2007

http://www.microsoft.com/downloads/details.aspx?FamilyID=fd9c2a29-7383-4b2e-9ec9-0c6120718d4f&displaylang=en

Thanks to all that attended the full-day tutorial at Dev Connections last Monday - Improve Your SOA: Designing a Secure, Reliable and Scalable System. It was certainly an avalanche of rich topics related to SOA and WCF. At last I have compiled the long list of resources from the day, including references to some getting started resources for those new to WCF.

Getting Started

• See my WCF WebCast Series for an introduction to WCF features: http://www.dasblonde.net/2007/06/24/WCFWebcastSeries.aspx
• I also recommend my book since it has hands-on labs for WCF, but all of the code for my book can be downloaded from my book blog: http://www.thatindigogirl.com

Demos

• Download the book code here for VS 2005: http://www.thatindigogirl.com/LearningWCFCode.aspx
• Download the book code here for VS 2008: http://www.thatindigogirl.com/LearningWCFCodeVS2008.aspx
• Chunking Channel: See WIndows SDK samples
• Router demos:
  • http://www.dasblonde.net/downloads/MessagingIntermediaryVia.zip
  • http://www.dasblonde.net/downloads/MessagingIntermediaryDuplex.zip

Code from the book is organized by subject matter. I specifically illustrates samples from these subdirectories: \Exceptions, \Security, \Security\ClaimsBased, \Instancing, \Concurrency, \Bindings, \QueuedMessages, \Transactions, \ReliableSessions.

If there are other resources you are looking for specifically, please drop me an email and I'll add to this post. Thanks!

I just returned from another fantastic Dev Connections conference in Las Vegas. For the four sessions I delivered, this post lists the code samples and resources I referenced. If you are looking for something specific and can't find it here, shoot me an email. Tutorial resources will be posted separately. Enjoy!

Introduction to C# 3.0

• C# 3.0 Samples
• ADO.NET 3.5 Samples

Exploring Windows CardSpace

• Cardspace Samples

ASP.NET and WCF: Meet Your New Web Service

• See code from my book Learning WCF posted here
• See my webcast series on WCF for MSDN

Architectural Considerations for ASP.NET Applications

• GalleryDemo20 - This sample illustrates different globalization techniques including the use of generated resources for page content, the use of resources to select localized images and dynamically loaded user controls, the use of localized database tables, and caching based on theme, culture and query string params
• CustomResourceProviders - This sample illustrates the use of custom localization expressions and custom resource providers. The code is based on this article: http://msdn2.microsoft.com/en-us/library/aa905797.aspx and updated for VS 2008.
• Extending the Visual Studio IDE for localization - I wrote a follow on article on this for MSDN, it has not yet been published, hopefully soon (backlog) but I will post the code here in an update to this post, after a quick review later this week.
• Distributed Boundaries - This sample was based on the ConnectionOrientedBindings lab from Chapter 3 of my book Learning WCF. All the code for my book is here: http://www.thatindigogirl.com/LearningWCFCode.aspx. This particular sample shows how to use a WCF service behind your ASP.NET applications to introduce a security boundary between NETWORK SERVICE and access to data and other resources. I talked about this in two articles for the server side, long ago:
  • Sandboxing with Impersonation
  • Sandboxing with Enterprise Services
• TransactionsOverHttp - This shows how to flow transactions over WCF web services, but I have many more examples of WCF transactions here: http://www.thatindigogirl.com/LearningWCFCode.aspx
• MessagingIntermediaryVia - Illustrates a pass-through router over HTTP where even reliable messaging headers can pass through both directions.
• MessagingIntermediaryDuplex - Illustrates a duplex router that supports reliable messaging headers two-way out of band over named pipes.

Thank you very much for attending the presentation last night, I enjoyed all the great questions and discussion, and as promised here is a link to the slides, and resources for the presentation.

Get the slides here.

Get the code samples from my .NET Roadshow presentations on security, and this includes the federation samples, here: http://www.dasblonde.net/2007/09/15/NET35RoadshowSampleCode.aspx

Enjoy!

I have working with, writing about and presenting on CardSpace for over 2.5 years now...and in the process refining how I describe to people the benefits of information cards for improving security for end-users. In particular, end-users that are not like us developers...every day people that don't know how to choose which sites are unsafe, which links to click in email, and so on.

Consider the following malicious PayPal email:

You can see that the "Click here to verify your information" link is not really sending you to the PayPal site. I see this because I hover over the link to verify the destination...but most non-developers won't know to do this. For those unsuspecting users the story might play like this:

• They go to the destination site, which might look just like the PayPal site. 
• They try to log in, it fails repeatedly. In the meantime, they enter every combination of username and password they use in various sites...perhaps including their online banking site.
• The malicious site collects these combinations of username and password.
• The user gives up logging in.
• The malicious sites now tries to log in to the real PayPal account, or worse, to some of the major well-known online banking sites.
• If they are lucky, and the user is unlucky, one of those username and password combinations will work at the online banking site, and they can write themselves a check, or otherwise play havoc on the user's bank account.

It is that easy to lift a username and password combination.

So, how do information cards issued by CardSpace (or, any other identity selector) help?

Let's assume that the user has associated a personal card with their PayPal account...if PayPal supported information cards. The same scenario might go like this:

• The user get's the evil email. They click the link and head to the malicious site that looks just like PayPal.
• If the site doesn't support information cards, the user will be suspicious because they always log in with a card.
• If the site shows support for information cards, the user may fall for it and click on the "log in with personal card" link which takes them to CardSpace.
• CardSpace will ask you to confirm the site by reviewing its privacy statement and site identity. This should trigger an indication to the user that this is not the site they think it is, since they would normally only get this the first time they hit the site. If they have logged in to PayPal before with a card, they wouldn't see this screen:

• Assuming this isn't enough to tip off the user, and they continue, the next strange behavior will be that they are asked to select a card to send to the site...but there will not be any list of cards already used at this site.

They should have seen at least one personal card present as shown here:

• Assuming this is still not enough to tip off the user, and they decide to select a card to send...the destination site will receive a security token with the requested claims which may include any personal information that you can enter into a personal card such as name, address, phone number, date of birth, and your card's private personal identifier (PPID). BUT, if the site requests more claims than PayPal, there are still more indicators of the malicious site. The first is that you'll be informed that the site is requesting new claims:

• This should really stop the user in their tracks, but they can preview the data requested and decide if they are comfortable sharing this data as shown here:

• If the malicious site wants any data I never share with PayPal, the user would probably stop here. But, let's say they continue and add the data, or, let's say they already had entered the data for this card so it wasn't necessary to provide it here. For example, I might create a personal card with my home and business details in full...but that doesn't mean I send all those claims to every site. Perhaps only to my online banking site because they require an address and phone number to help prove who I am sending the card. So, if the card already has all the details, the user is still warned that new claims were requested and should be approved:

• The user can (and should) preview the requested data. In fact I think that CardSpace should force the user to preview it the first time. Furthermore the new data requested should be called out in red here...so it is obvious.

• Now, the user is ultimately responsible for approving sending the information to the malicious site after all of these indicators that something is amiss. But, let's say that they proceed and send the information. What happens then?
• The site get's a signed security token with your name, address, phone number, date of birth details. Nothing so risky as a SSN or passport number.
• The same token carries the card PPID, however this PPID will not be the same PPID as that used for PayPal because every site gets its own PPID for the card.

So, what can the malicious site do with all this information? Can they log in to PayPal now?

• No, because they don't have the PPID and presumably PayPal has associated their own PPID with the account, not the same as the one the malicious site received.

What else can go wrong? A malicious party could somehow get their hands on the PPID information. This wouldn't be so easy, since the security token issued by CardSpace is always encrypted when sent...but once it arrives to PayPal site it is open and available for view, and someone could look over your shoulder as you view your card to send to PayPal and see the PPID for PayPal right there. If this happens, there is another security measure available.

Each personal card has a private key associated with it - called a master key. That master key is used to sign the security token sent to the site. Only your exact card installed in CardSpace can sign the token with this private key. Thus, if the site associates the PPID + hash of the master key cert with your account, only tokens signed with the correct private key carrying the correct PPID will be authenticated. A malicious party cannot get the master key unless they export your cards from the machine, and import to their machine. Hopefully the user has a password on their laptop. Hopefully if they export cards and import to another machine, they do it safely and destroy the copy they put temporarily on the USB drive to transfer the cards.

Still, this is MUCH MORE SECURE than the username and password we use today...because now a malicious party has to get physical access to a user's machine or USB drive with exported cards...and figure out the password protection in the latter case since exported cards are encrypted.

Hopefully this helps explain how CardSpace and personal cards HELP sites to protect users...better than username and password to today.

You may have noticed after installing Visual Studio 2008 that if all of your projects in a solution don't compile, you can't debug the one that DOES compile. This causes problems for me when I work with WCF because I may want to update the service code, and later update the client proxy....in the meantime, changes I made such as deleting the existing proxy do not compile anymore...so I can't run the solution.

There are two settings that affect this:

a) All projects are compiled each time you try to run

b) If errors are encountered the environment is set not to run at all

You can address this in one of two ways. You can only compile those projects that you need to, by checking the "Only build startup projects and dependencies on Run" setting as shown here:

Or, you can set the environment so that it runs the old version of any projects that don't compile as shown here:

The latter causes more problems in my opinion, because you may not realize you are running an older version of one or more projects. The former is what I choose to set my environment to, since it allows me to compile only dependencies of the project I'm trying to test at the moment. Thus, I can recreate my service references from scratch, without having to comment out client code that doesn't compile in the interim.

There...annoyance gone.

As some of you may know, several of us at IDesign (Juval, Brian and myself) are in the midst of a two-week .NET 3.5 Roadshow - six cities in two weeks where we collectively cover WCF, WF, WPF, CardSpace, federated and claims-based security concepts, and some key aspects of .NET 3.5 such as new C# 3.0 language features and ADO.NET 3.5 including LINQ and the Entity Framework.

I'm personally covering WCF security, federated and claims-based security, C# 3.0 and ADO.NET 3.5. For those of you attending (or, not) here are links to the code samples I'm presenting:

VS 2005 samples

• WCF Security Fundamentals - these samples come from the \Security directory from my book code
• Federated and Claims-Based Security in WCF - these samples come from the \Security\ClaimsBased directory from my book code
• CardSpace Samples

Download VS 2008 Samples (UPDATED 10/11/07)

This download includes all samples referenced above, in addition to .NET 3.5 samples for C# 3.0 and LINQ, and IDesign's declarative security model including a recent version of our ServiceModelEx library.  

Other relevant resources discussed:

• My WCF webcast series
• CardSpace controls for ASP.NET
• IDesign articles

Any questions? Email me.

-Michele

I have recently made a series of posts describing changes to VS 2008 templates for WCF as compared to VS 2005 + Orcas extensions. See

the post here: http://www.thatindigogirl.com/VS2008Beta2ProjectTemplatesForWCF.aspx