Notes from Curt Devlin on Identity, Claims, and Azure Geneva from 4th Boston Azure Meeting Feb 2010

3 Replies

Curt Devlin keynotes 4th Boston Azure User Group meeting

Identity, Claims, Geneva, and Trust in the Cloud

This was Boston Azure meeting #4, Feb 25, 2010

(Curt’s slide deck will be made is now available (PPT 2003 format))

Some notes from Curt’s talk:

  • Azure devs need to care about claims-based-identity and federated identity
  • Geneva is Microsoft’s solution in this space
  • Perfect storm of paradigm shifts
  • Caution: Geneva is not a panacea for “Identity in the Cloud”

“The most important thing Microsoft has done in identity since they came out with ActiveDirectory” – and think about how much we rely on AD for enterprise-class apps – “it’s like air”

First two lines of every program (with nod to Kim Cameron):

  1. Who are you?
  2. What are you allowed to do?
  • The answer to the second generally depends on the answer to the first. “Identity” is an input.

Big architectural problem: the ‘net was built w/o any way of knowing who you are connecting to (http has no identity)

  • RBAC (role-based access control) is not as flexible or powerful as claims
  • Any statement that can be validated can be a claim

Microsoft’s Federated Identity Group very focused on standards. To be serious also about Azure, you need to pay deep attention to the key standards.

Azure is only cloud solution REALLY solving the SSO problem in the cloud – and into your data center. Identity must flow…

Geneva Technology stack:

  • Microsoft Federation Gateway (“ADS 2.0 in the sky”)
  • Windows Identity Foundation (some .NET namespaces)
  • Active Directory Federation Services 2.0
  • Windows CardSpace 2.0

Curt will focus for a while in his talk on Windows Identity Foundation…

Consider three parties – Security Token Service, Your App, End User

  1. Secure Token Service <=> Your App – Initial handshake uses WS-Federation (metadata, X-509 cert)
  2. End User <=> Your App – claims via WS-Policy (which Security Token Service(s) I trust)
  3. End User <=> Security Token Service – verify policy
  4. End User <=> Security Token Service – WS-Trust
  5. End User <=> Your App – lots of interactions – signed tokens, claims

ADF 2.0 – same programming model across web and desktop

RP = relying party – someone that consumes tokens

PingIdentity.com

OpenID cannot help with Man-in-the-middle attacks

“Shred the token” is lingo meaning to decrypt a token.

Coded example showing implementation of Passive Federation.

  • Showed the 8 (!) prerequisites
  • Create full-trust app (Since runtime not fully baked in Azure yet – and certainly not yet in GAC)
  • Add a reference to Microsoft.IdentityModel (which is a stronger programming model than older System.IdentityModel)
  • using Microsoft.IdentityModel.Claims;
  • using System.Threading;
  • Then write like 5 lines of code…
  • Subclasses from IIdentity, IClaimsIdentity, IClaimsPrincipal (same ones used in other .NET apps)
  • WIF ASP.NET Processing Pipeline does a lot of behind-the-scenes work for us
  • IsInRole method is key
  • Then in the ASP.NET app, there is some 10 lines of key code for X-509 cert – which contains the URL (or domain, really) of the web site that the cert applies to – a problem with “localhost” and “stage.foo.com” etc. due to mismatch – this goes in Global.asax – plus several other blocks of code…

Now for the STS (which you don’t need if you have ADFS 2.0)

  • There is a Token Service for ASP.NET visual studio template with Geneva install
  • Many coding steps here (see slides)
  • Use FedUtil (which comes with Geneva and VS 2008, VS 2010) to create a trust between your application and your STS
  • There is a lab to create your own STS

Claims-based systems externalized the work of AuthZ, AuthN to your STS – not stuck in your code.

Geneva supports delegation – embedding one token within another…

(21 people at the meeting)

Curt Devlin to Speak about Identity in the Cloud at Boston Azure Meeting

Leave a reply

Boston Azure meeting to feature Microsoft’s Curt Devlin on Identity in the Cloud

Thursday February 25, 2010 at NERD in Cambridge, MA

The following is an update to the agenda for the upcoming Boston Azure User Group meeting this coming Thursday.

logo for BostonAzure.org

To RSVP for the meeting (helps you breeze through security and helps us have enough pizza on hand), for directions, and more details about the group, please check out http://BostonAzure.org.

To get on the Boston Azure email list, please visit http://bostonazure.org/Announcements/Subscribe.

[6:00-6:30 PM] Boston Azure Theater

The meeting activities begin at 6:00 PM with Boston Azure Theater, which is an informal viewing of some Azure-related video. This month will feature the first half of
Matthew Kerner‘s talk on Windows Azure Monitoring, Logging, and Management APIs from the November 2009 Microsoft PDC conference.

[6:30-7:00 PM] Upcoming Boston Azure Events and Firestarter

Around 6:30, Bill Wilder (that’s me) will first show off an interesting CodeProject contest, then will lead a discussion about the future of the Boston Azure user group and the upcoming All-Day-Saturday-May-8th event.

Curt Devlin will take the stage at 7:00 PM.

Before the meeting, if you want a little more context, you may wish to read Kim Cameron’s essay The Laws of Identity, which is an insightful analysis of challenges around Identity.

[7:00-8:15] Featured speaker: Curt Devlin of Microsoft

Photo of Curt Devlin, Architect at Microsoft

Abstract

The Azure platform presents new challenges for identity management. As developers and architects, we will still have to answer the same two perennial questions: 1) Who are you? 2) And what are you allowed to do? But the traditional on-premise approaches to authentication, authorization and identity lifecycle control are not adequate to meet these new challenges. The Geneva suite of technologies for claims-based identity management can be help because cloud computing can be thought of as a “special case” of federation, with many similar requirements. Together these two paradigms appear to be converging to create the perfect storm of paradigm shifts. However, even WIF, ADFS 2.0 and CardSpace 2.0, will only take us part way to a complete solution in the near term. This session will provide a simple recipe for claims-based identity management in Azure using Geneva, discuss some of the most important reasons why this is necessary, and finally some of the shortcomings we will still have to contend with on the road ahead. The aim is to educate, motivate, and caution.

About Curt Devlin

Curt Devlin is currently an architect in Microsoft DPE (Developer & Platform Evangelism) focusing on distributed solutions across many industries and customer segments. Curt is a Microsoft veteran of many technology wars, with more than 20 years of experience developing solutions on the Windows and .NET. platforms. He is also a dyed-in-the-wool New Englander with avid interests in sailing, skiing and nearly everything else.

Curt blogs as the philosophical architect, plus you can check out his MSDN articles Enterprise Authorization Strategy and SaaS Capacity Planning: Transaction Cost Analysis Revisited.

Curt’s blog post announcing his participation in this meeting: http://blogs.msdn.com/curtd/archive/2010/02/23/an-evening-with-identity-in-the-clouds-and-the-boston-azure-user-group.aspx

Steve Krug on Rocket Surgery Made Easy from Dec 2010 BostonCHI Meeting

3 Replies

Rocket Surgery Made Easy

Steve Krug speaks at BostonCHI

Notes from 08-Dec-2009 meeting

  • Steve’s new book – Rocket Surgery Made Easy – due in bookstores in a couple of weeks – material from this talk will be in his book…
  • Passed a copy of his book around through the audience for quick peek
  • 150 or so people in attendance

Writing process

  1. writing process: collect years of notes
  2. need deadlines to force you to write (and finish)
  3. collect relevant articles for each chapter and post them all on a wall
  4. once you’ve begun to panic, start throwing things overboard
  5. Outline, write, iterate
  6. get help
  7. throw things overboard (save for next book?)
  8. FAQ at the end of every chapter – good idea
  9. Doing usability (vs How to Think About Usability)

Doing Usability

  1. A morning a month – that’s all we ask
  2. Run tests – with whole team – at our site – scheduled monthly and well ahead of time – and debrief immediately after over lunch
    1. maybe do right before iteration planning
    2. company-sponsored lunch
  3. Start earlier than you think makes sense
  4. The sooner you get information, the better use you can make of that information
  5. Don’t wait until the site is “finished” – test it as soon as it is testable
  6. Don’t worry that “you already know about the problems”
  7. If you have nothing built, test other people’s sites
  8. Are you working on the site? –> Yes ==> test now!
  9. Recruit loosely and grade on a curve
  10. Beware implied domain knowledge
  11. Some testing can be done w/o your target audience
  12. Usability testers say many things that are similar to what therapists say – “what did you expect to happen when you did that?”
  13. Keep yourself out of it! It is about the user and what the user being tested is thinking.
  14. Make it a spectator sport
  15. Get everyone to come and watch the test – frequently the observers suddenly just “get it” that they are not their users
  16. Have high quality snacks. Keep the sessions short and compact. Do them on site. Make it easy for everyone to join in, hard to have a good reason to skip it.
  17. Record sessions with Camtasia ($300). Get a good USB desktop microphone ($25). Don’t record user’s face (“useless and distracting”). Use a screen sharing service (like GotoMeeting, $40/month?) to control the UI. High quality audio is important, and should be channeled to the observation room via GotoMeeting or Skype.
  18. Focus ruthlessly on a small number of the most important problems
  19. Serious because everyone will come across them, or serious because for those who do encounter them will be seriously impeded.
  20. Don’t feel you need to come up with the “perfect” fix
  21. Ask everyone in the observation room to write down the three most important issues they observed. These are raised at the debriefing session over lunch.
  22. When fixing problems, always do the least you can do ™
  23. Prioritize the list, then work your way down the list until you run out of time/resources
  24. Sometimes a tweak is better than a redesign – don’t get suckered into a redesign – the perfect is the enemy of the good!
  25. Focus on the smallest change we think we can make to address the problem we observed
  26. Q&A
  27. Remote Testing?
  28. Remote testing is handy – saves travel time, recruiting pool grows, … do over skype or GotoMeeting.
  29. How to get it off the ground? Try a group usability test of competitor’s site – everyone can get behind that. Do one and hope people get enthused about it. Make the cost of swinging by to watch the testing really small.
  30. Be very cautious about asking users how to fix the problems they’ve encountered. “Users are not designers.” “Hopefully you know a lot more than they do about design.” Listen to them, but be careful that they’re ideas are not well thought out. The purpose of testing is to “inform your design intelligence”.

January 2010 Boston Azure User Group Meeting Notes

Leave a reply

This was the third meeting of the Boston Azure User Group! (You can get on the group mailing list here.)

We watched a clip from the first day of PDC where Ray Ozzie and others talk Azure in the keynote …

Discussed idea of an Azure Firestarter event – possibly for May 8, 2010 – and this seems to flow nicely from our scheduled April meeting where Jason Haley is scheduled to talk about getting started programming in Azure, such as with the Azure SDK.

Ben Day spoke on Windows Azure storage. Some quick notes / points from his talk:

  • Relational databases have a schema – all rows in a table have same columns, structure is defined before pouring in any data, data is not repeated (third-normal form breaks out data to appear only once – no redundancy)
  • … database will manage transactions across tables
  • … though mixed with replication can provide performance challenges
  • This changes for Azure Table Storage!
  • … though Azure Table Storage can scale way better – horizontally (“out”) whereas traditional SQL RDBMs tend to scale best vertically (“up”) – to larger boxes – which is more limiting and tends to be more expensive.
  • Do we need to rethink what needs to be transactional? Can we use a simplified transactional model – such as just within one table – or one instance of one table…
  • … compensating transactions are another approach
  • Securely storing data
    • Encrypt (compute is cheap)
    • If you encrypt a key, it won’t work for indexing
    • Search is harder if you encrypt
  • String columns have a 64KB size limit for Table Storage – so reference larger objects in a Blob
  • Unit testability
    • Abstract away you r persistent store, such as with Repository pattern – so you can unit test
    • Encapsulate business logic, such as with Service Layer and Domain Model patterns
    • Extract logic from UI using MVP (Model View Presenter)
    • Use Mock objects
  • Ben will come back to finish the story!

Around 23 attended.

Since Software is a Business, Architects need to be More than Technologists

Gave talk at Architect Factory, Part Deux today titled Since Software is a Business, Architects need to be More than Technologists. The slide deck can be downloaded here. The most prominent concept/slide follows:

Technology Skills

Technology + Communications + Business-Awareness = Influential Architect

The overall event was excellent. It was organized primarily by Bryan Tuttle of CodeRight, a Consulting/Training company. Many thanks to Bryan for a job well done!

December 2010 Boston Azure User Group Meeting Notes

Leave a reply

Second meeting of Boston Azure User Group

Guest speakers were Michael Stiefel and Mark Eisenberg

Meeting was held December 3, 2009 at the Microsoft NERD

We opened with Boston Azure Theater, kicking off a few minutes after 6:00.  For around 45 minutes we watched a video of Microsoft Director Manuvir Das’ PDC talk A Lap Around the Windows Azure Platform.

From there, Microsoft’s Mark Eisenberg walked us through a summary of key Windows Azure announcements made at (or right before) the Microsoft PDC in November. The deck Mark used is available BAUG_PDCHighlights. There was a lot of interest in the announcement details and in the pricing model.

Our keynote speaker, Michael Stiefel, followed with a detailed look into the project “Dallas” announcement, showcasing the Dallas “Data as a Service” platform, working through sample apps, a custom mashup – with code, demonstrating the straight-forward programming model (ATOM feeds), and showing use of the data directly within Excel. Michael wrapped up by reviewing the business model – and discussing the interesting possibilities (publishers can publish – and others can consume – data so much more easily than today since Microsoft will have eliminated the “contract friction” we’d have if every consumer had to strike a deal with every publisher).

Silverlight exceeds 50% penetration

5 Replies

According to RIAStats, a version of Silverlight is now detected on more than half of the browsers sampled! This is a telling milestone as installations of Silverlight continue to grow – drawing inexorably closer to that of Adobe Flash which currently enjoys installations on around 97% of browsers.

If you look at the graphic, and you consider the “not detected” section, it reads 49.99%, which means that the sum of those detected is better than half.

silverlight-exceeds-50-percent

At PDC 2009 in November, Scott Guthrie announced that Silverlight penetration was up to around 45%, up from around 30% in the summer. These RIAStats numbers feel in line with that.

Of course, I know this doesn’t “prove” Silverlight is really on more than 50% of browsers, as RIAStats are not a perfect reflection of the web as a whole, but it seems an interesting milestone nonetheless.

Silverlight has been in the wild for 863 days: Silverlight was released for real (RTW, or “released to web”) on 05-Sep-2007, followed thirteen months later by Silverlight 2 RTW 14-Oct-2008, then less than nine months later we saw Silverlight 3 on 09-July-2009. Silverlight 4 is in beta – maybe Microsoft will announce its release at MIX10 in mid-March? If they do, that would be on a similar release rhythm as from Silverlight 2 to Silverlight 3.

Silverlight’s installed base will also get another boost from the 2010 Winter Olympics next month as well. (And Silverlight 2 shipped shortly after the 2008 Summer Olympics.)

It is interesting to note that another tracking site – StatOwl.com – not only shows the penetration lower – and doesn’t agree on any of the numbers – but also doesn’t even agree on relative installed base across versions [EDIT: after Comment from Travis Collins, added in Silverlight 4 = 0.04 for RIAStats]:

RIAStats StatOwl
Silverlight 1 0.62 1.39
Silverlight 2 1.91 9.73
Silverlight 3 47.44 23.85
Silverlight 4 (beta) 0.04 (<1 pixel) not shown, or 0%
Undetected (reported) 49.99 65.03%

I’m not sure why they don’t agree – perhaps differences in sample sizes, sampling methodology, or due to different audiences being sampled.

Also, if you check the math yourself, you’ll see the values shown don’t tie down perfectly for RIAStats (though they do for StatOwl); if you add up the individual Silverlight versions along with the Undetected, you won’t get exactly 100%. Some sort of rounding errors I assume. [EDIT: See explanation in Comment from Travis Collins, RIAStats creator.] But I also assume that the Undetected = 49.99% is most likely right (at least not wrong due to a rounding error, since it is harder to round wrong there).

EDIT 01-Feb-2010: Found an interesting, relevant post on Cool facts about Silverlight penetration / mindshare from UXPassion.com.

NEJUG ~ JSR-299 – 08-Oct-2009

Leave a reply

Very rough notes on JSR-299 by Gavin King from NEJUG Meeting of 08-Oct-2009

Profiles

  1. Will enable deployment with subset of JEE feature set – so can leave out parts you don’t use – thinner footprint, less complexity?

Theme = Loose Coupling

  1. decouple server and client via well-defined types and “qualifiers” (beyond Interfaces)
  2. decouple lifecycle of collaborating components via
    1. server-side lifecycle management by Container
    2. allow stateful components to interact like services via message-passing
  3. decouple orthogonal concerns via Interceptors
  4. decouple msg producer from consumer via Events

Theme = Strong Typing

  1. eliminate lookup using string-based names
    1. enables smarter auto-complete, more power in compiler type checking

What’s unique?

  1. implementations of a type may vary at deployment time – without need for central list of available implementations
    1. no need to explicityl list beans (e.g., Spring) or use Java-based DSL (Guice)

What kinds of things can be injected and how?

  1. Most java classes
  2. EJB session beans
  3. Objects returned by producer methods
  4. Java EE resources (e.g., JMS topics/queues)
  5. Persistence contexts (JPE EntityManager)
  6. Web service references
  7. Remote EJB references
  8. anything else can be supported through SPI (flexible extensibility via metamodel)
  9. Can define business-sensible attributes to specify injection types (e.g., InformalGreeting extends Greeting class, then have an @Informal attribute)
  10. Can use injected object in a JSF or JSP page – e.g., container will instantiate the right objects (construct as needed, etc.) and pass it is such as in: <h:commandButton value=”Say Hello” action=”#{printer.greet}”/>
  11. Beans may need to be stateful – this is supported too – handled as lifecycle attributes such as @RequestScoped for per-request or

Scopes and Contexts

  1. Extensible context model
  2. Dependent scope, @Dependent
  3. Built-in scopes
    1. @ApplicationScoped, @RequestScoped, for servlet we have @SessionScoped [e.g., Login state object may store username in a member variable], for JSF requests @ConversationScoped
  4. Custom scopes – third party frameworks can support via SPI
  5. KEY POINT: Client does NOT know anything about the lifecycle of the session-scoped object
  6. Conversation context is scoped INSIDE OF (DOES IT NEED TO BE WITHIN, or is it just defined as more granular a SCOPE than) a session – can have more than one Concersation that don’t know about each other – supports multiple tabs, wizards, AJAX and other multi-step sub-tasks
  7. Better abstracts some concepts – a set of mappings can be defined such that a class can loosely reference (my term), say, a value from another object (like the user’s first name, from the Login object), and the container will take care of all the heavy lifting and just insert that value – nicely separates lookup logic so your business logic code can stay cleaner and refer to (as in example above) their “first name”, not the Login object directly

Interceptors

  1. ANOTHER APPROACH FOR WHAT ASPECTS ARE USED FOR TODAY
    1. Perceived to be more flexible, more generally useful (there are very few uses for Aspects now – nothing new in 5-10 years!)
  2. Should be decoupled from implementation via semantic annotations
  3. Should be deployment-specific – e.g., can turn off my transaction support during testing
  4. Ordering of interceptors matters – so do this centrally so you can manage/understand it – don’t bing interceptors directly to components

Stereotypes

  1. Reuse patters – not just Interceptor bindings!
  2. Capture roles of components using stereotypes
  3. A Stereotype packages up:
    1. a default scope
    2. a set of interceptor bindings
    3. the ability to specify that beans have names by defaults
    4. (more)
  4. Uses @Stereotype annotation

Events

  1. Can be injected – as in void Login(@Observes LoggedIn loggedin)…

Proposed final draft of JSR-299: http://www.jcp.org/en/jsr/detail?id=299

Seam Framework reference implementation: http://seamframework.org/WebBeans

JBoss doc: http://docs.jboss.org/webbeans/reference/current/en-US/html/

Blog: http://in.relation.to/Bloggers/Everyone/Tag/Web+Beans

—-

Value of more Type Safety in a world where Dynamic Languages are gaining traction

Debugging might be more challenging

Performance issues?

Complexity / tooling issues?

How is this different / better / worse than Spring?

Cure for Phantom Mouse Clicks on Acer Netbook Laptop Tablet from Microsoft PDC

7 Replies

If you attended the Microsoft PDC in 2009, you received what appeared to be an Acer Netbook, but in fact is technically an Acer Laptop (that’s what Acer support insists), though apparently is also a considered a Tablet – the Acer Aspire 1420P Convertible Tablet PC. But a Convertible Tablet at that… 

Talk about an identity crisis. Maybe we should just call it, more simply, the PDC Netabletible Convertilizer? 

If yours has trouble with “phantom mouse clicks” – where you are typing away, and it seems that somehow the left mouse button was just clicked, but you know you didn’t click it – that can be fixed with the simple act of installing the Synaptics driver for this machine that, weirdly, will not ever show up in Windows Update.  But since this is a pretty useful update, consider doing it the old fashioned way. 

Or at least it worked for me. Though belated, this blog post may save someone the challenge of finding the cure, which I thought more difficult than it oughta be. 

The PDC Netabletible Convertilizer may not be the only one out there with this problem.

As an aside, my PDC Netabletible Convertilizer also became more usable once I recalibrated the touch screen. (How does one do that? Type into the search field in the Start menu “calibrate touch” for a link to the right part of Control Panel to make this happen…)

October 2009 Boston Azure User Group Meeting Notes

Leave a reply

Meeting #1 of Boston Azure User Group!

Keynote speaker: Brian Lambert of Microsoft

Meeting was held Thursday October 22, 2009 at Microsoft NERD in Cambridge, MA

Mike Werner (Microsoft evangelist for Azure in the Northeast) introduced the user group at this innaugural meeting, plugged the upcoming Microsoft PDC, then introduced Bill Wilder, the guy who started the Boston Azure User Group.

Bill Wilder provided an overview of the group (powerpoint slides):

  • All meetings will have Windows Azure focus
  • Any technology or business concept – cloud models, Microsoft dev technologies, tools, and so forth – is fair game, but must be presented with appropriate Azure slant: they need to be related back to Azure or else they are not appropriate for Boston Azure User Group meetings

Brian Lambert spoke on how to build applications for Windows Azure.

Bill’s raw notes from Brian’s talk:

  • Can call unmanaged DLLs through Full Trust
  • “Fabric Controller worries about the “shape” of your app”

Worker Roles

  • Background processing – utility computing
  • May communicate with outside services
  • Not externally visible to client
  • Queues ~ how we communicate to a Worker Role ~ since both Worker Roles and Web Roles can talk to storage (like Queues), this is a good medium

There are public and private containers in blog storage. Public is the only accessible to clients (w/o keys that is).

Partitioned for scale

Blobs = ? “cloud files”

  • Up to 50 GB / blob + 8k of metadata

Azure Dev Workflow:

  • Add some Web Role(s)
  • Add 0+ Worker roles
  • Add Service  Configuration
  • Add Service Package
  • Upload to Windows Azure Management Portal
  • Deploy to Windows Azure Fabric Controller
  • Provision / Run the roles and storage needs; monitors the health

Sticky Storage ?

….

Azure Tools + Azure SDK

….

For “dev” + “test” + “etc.” – may want to use REAL azure accounts – not just the “other account” you have in your main production account

….

Need to handle the “at least one worker role will work on it” contract – your application needs to be designed for this…

“poison message” – due to bug or oversight or bad data, a message from the queue will NEVER be successfully handled. App needs to handle this currently.

Queue timeouts can have different values – could be, say, different for different message types.

….

Worker Role => a class that inherits from WorkerRoleMain (what was this class name??)

Fabric occassionally calls GetHealthStatus() which returns a RoleStatus. If you tell the Fabric you are Unhealthy, the Fabric may slay you? Maybe your NIC card is flakey, so your performance to external web services is too slow?

….

Public container for blob – for actual image (full size) linked to from the thumb.

“Fiddler is your friend when you’re working … watch your requests.”

Dev Fabric + Cloud Storage is an excellent mode to run in for effective debugging – can watch the message traffic with Fiddler.

“There is no debugging in the cloud. There’s logging.”

RoleManager can also write to “local storage” [[more interesting access / features coming soon!]] – then can go to Portal and use “configuration” button to update your config file to “copy logs” (did they move it?)

===========

can even bring web site up with http://localhost:8020 

WorkerRole is very simple to just run it in a process

Use Test Running to fire up a WorkerRole

  • Tight dev cycle
  • Can also now run a performance profile

Tricks: log in “real fabric”, write to console in “dev fabric”