Scott Berkun on Politics

According to Scott Berkun, Politics is the skill of managing people and organizations.

• Politics is not a dirty word.
• All leaders have political and power constraints.
• The ratio of power to responsibility is constant.
• Politics is a kind of problem solving.

Any political or management action that takes place, no matter how stupid or evil it seems, is always one of a limited number of possible choices managers have. The alternatives might be even worse for the project than the choice that was made. Without understanding something of the constraints, judgment will always be based more on venting frustration than on the reality of the situation.

Serializing and Encoding in WCF

Whereas serialization defines how .NET objects map to XML Infosets, the encoding defines how the XML Infoset is written out to a stream of bytes.

The serializer is considered part of the service contract because it directly impacts your code. The encoding isn't considered part of the service contract, but rather a configuration detail since it doesn't impact your code—you control the encoding by configuring the endpoint's binding.

The separation of serialization from encoding makes it possible to build your applications on a consistent data model (the XML Infoset) while providing flexibility in representation (the encoding).

Windows Communication Foundation supports three serializers: XmlSerializer, DataContractSerializer, and NetDataContractSerializer. DataContractSerializer is the default.

WCF currently supports the following encodings: text, binary, Message Transmission Optimization Mechanism (MTOM), and your own custom encodings.

From Service Station: Serialization in Windows Communication Foundation by Aaron Skonnard.

Security in WCF

Credentials

None, UserName, Windows, Certificate, and IssuedToken.

Default Security in Standard Bindings

basicHttpBinding supports the WS-I basic profile. This particular binding doesn't provide CIA by default like most of the others. The most popular way to secure this binding is by simply running over HTTPS.

wsHttpBinding uses message security by default, with WS-Security and WS-SecureConversation. The default client credential type is Windows. One of the most common security tweaks to use on this binding is to switch it to use TransportWithMessageCredential.

netTcpBinding encodes each SOAP envelope using a proprietary binary encoding of the XML Infoset instead of the traditional angle bracket encoding. By default this binding uses transport security with Windows credentials, and is very efficient. The default binding uses transport security with negotiated authentication. If you want raw speed for Web services on a Windows-based intranet, you should seriously consider using this binding.

Discovering Client Identity

By far the simplest way to discover a client's identity is to leverage Thread.CurrentPrincipal. You can see which groups the user belongs to by calling WindowsPrincipal.IsInRole. For security reasons you really should specify the fully qualified group name, which includes the domain or machine on which the group is defined.

WCF doesn't always set Thread.CurrentPrincipal. It does that only if PrincipalPermissionAttribute is used or if the configuration says it should. Instead of relying on Thread.CurrentPrincipal, you should use ServiceSecurityContext.Current.WindowsIdentity to get the client's identity if one is available.

If the client is using an issued token credential to authenticate, you'll need to use ServiceSecurityContext.AuthorizationContext to pick up those details. If the client is authenticating with a certificate not mapped to a Windows account, ServiceSecurityContext.Current.PrimaryIdentity can be used.

Transparency is important when you're building a secure system. If the security features you build into the system aren't relatively transparent, users will be put off and will generally try to avoid using them.

From Security Briefs: Security in Windows Communication Foundation by Keith Brown.

WCF Addressing

You can specify an absolute address for each endpoint or you can supply the ServiceHost with a base address and then specify relative paths for each endpoint. Specifying absolute addresses is a little easier to understand, but the base address technique typically makes things easier to manage.

The base address technique is mostly a convenience to reduce the number of places you’ll have to make changes when modifying the locations of your endpoints. Windows Communication Foundation also uses the base HTTP address by default to expose metadata when GET retrieval has been enabled (via the serviceMetadata behavior). You can, however, change the retrieval location using the behavior’s httpGetUrl property.

It’s also possible to specify the base addresses in the configuration file along with the endpoints themselves by listing the base addresses within the host element for each service.

IIS Addressing Considerations

When hosting in IIS, you simply map a .svc endpoint to your service class, configure the service endpoints and behaviors in web.config, and let WCF manage the process of creating and configuring the ServiceHost instance at runtime.

In this hosting scenario, the base HTTP address is determined by the IIS virtual directory housing the service along with the name of the .svc file. If you want to change the base address for your endpoints, you’ll need to move the service to a different IIS virtual directory.

Not only does IIS control the base address, it forces all of your endpoints to actually use the same base address (unlike self-hosting). As a result, it really only makes sense to use relative addresses when hosting in IIS.

Suppose you have a file named calc.svc and you place it in a virtual directory that corresponds to http://localhost:8080/calcservice. The base address for this service will be http://localhost:8080/calcservice/calc.svc. If a relative addresss "secure" is provided, then its address is http://localhost:8080/calcservice/calc.svc/secure. You have to remember that calc.svc is part of the base address so it has to work this way.

Logical vs. Physical Addresses

WCF refers to the logical address as "Address" or "Endpoint Address" and the physical address as "ListenUri".

From Service Station: WCF Addressing In Depth by Aaron Skonnard.