|
Sponsored Links
Resources
.NET Research Library
Get .NET related white papers, case studies and webcasts
|
News
News
News
|
Messages: 0
Messages: 0
Messages: 0
Printer friendly
Printer friendly
Printer friendly
Post reply
Post reply
Post reply
XML
XML
XML
|
 |
What's New in WSE 3.0 Article Released
Mark Fussell, Lead Product Manager for Web Service Enhancements has written an article detailing the changes and additions to the WSE toolset for version 3.0. New features include enhanced security, session management, Visual Studio 2005 integration, and MTOM support.
WSE 3.0 is fundamentally a security product for Web services. When the WSE (1.0 and 2.0) project was first conceived, its primary purpose was to show a practical and usable implementation of the emerging WS-* security specifications, such as WS-Security, WS-Trust, and WS-SecureConversation and as a result provide feedback into the standardization process. It was not solely constrained to security also helping drive the other specifications such as WS-Addressing (how to get a message from a sender to its final destination) and WS-Attachments (how to send associated attachments with a message). The WS security specifications have now, to a large extent, solidified and as a result the driving goals for the WSE 3.0 release were not so much to influence emerging specifications (although it does implement more recent specification versions), but more to recognize that Web services have permeated into so many areas of development that it needed to augment the existing Web service support in Visual Studio. Solving and simplifying real-world problems encountered by developers was a primary focus.
The security enhancements primarily involve ease-of-use improvements established through new "turn-key scenario" options.
- UsernameOverTransport In this scenario the security protection is performed at the transport level (for example, SSL certificate) and the client is identified via a supplied username and password that is authenticated against a store such as Active Directory, ADAM, or SQL Server. Known person to Service. Calling from the Internet to Internet or intranet where the applications have limited security infrastructure. Often SSL is used on the first leg. with another turnkey security scenario used inside the firewall, such as Kerberos.
- UsernameOverCertificate In this scenario the security protection is via the server's X.509 certificate and the client is identified via a supplied username and password that is authenticated against a store such as Active Directory, ADAM or SQL Server. Known person to Service. From the Internet to Internet or intranet where the applications are smart clients (e.g. Windows Forms applications) and a Public Key Infrastructure (PKI) infrastructure is maintained. Windows Forms applications and the necessary certificates can be deployed via the Click Once technology.
- AnonymousOverCertificate In this scenario the security protection is via the server's X.509 certificate and the client is unidentified or anonymous; that is, any client with the server's public certificate can communicate securely with the server. Unknown Person to Service. From the Internet to Internet or intranet where the applications are smart clients (e.g. Windows Forms) and a Public Key Infrastructure (PKI) infrastructure is maintained. Since anyone with the server's public certificate can connect to the service, this is limited to either noncritical services or ones where the server's public key is supplied only to a limited set of companies or individuals.
- MutualCertificate In this scenario both parties exchange X.509 certificates that are used to secure the data exchange between them. Business to Business. Across the Internet or within the intranet, between machines or application servers.
- Kerberos (Windows) In this scenario the application is within one or more Windows Domains and Kerberos provides a configurable, security infrastructure. The other benefits of Kerberos are single sign-on and better performance than PKI with X.509 certificates. Kerberos tickets are used for authentication and message protection. Kerberos also supports delegation, which allows a service to execute on behalf of the calling user.
Read What's New in WSE 3.0
|
|
|
| |
|
| New content on TheServerSide.NETNew content on TheServerSide.NETNew content on TheServerSide.NET |
|
|
Language "mashups" will become more prominent, and developers will become polyglots, one programmer suggests.
SearchWinDevelopment.com offers an introduction to the language, performance, testing and data management improvements in VS 2008.
VBCode.com code snippets cover all aspects of application development, from data binding to security to the user interface.
Get up to date on XAML best practices with a variety of articles, tutorials and webcasts. [SearchWinDevelopment.com]
One team's experience with the VSTS DB edition suggests that it can improve workflow for dev teams. It also enhanced Agile efforts.
(June 24, Article)
Microsoft has begun to include DSL tools in the VSTS kit. A new book by Steve Cook and other VSTS team members helps set the stage.
(June 24, Article)
Cartoon: Be it ever so humble there is no place like your home after you get a Microsoft Home Server .
(June 18, Cartoon)
Microsoft's Thom Robbins says new technology to highlight in NET 3.5 includes AJAX, LINQ for both C# and VB, as well as tooling enhancements intended to ease the task of building WPF, WF and WCF apps.
(June 29, Podcast)
Venkat Subramaniam discusses AJAX bottlenecks, the tenets of Agile development and more. He spoke at the Ajax Experience.
(June 25, Tech Talk)
In the second of a two-part series, Michele Leroux Bustamente discusses design decisions related to the claims-based security model. Read the story and walk through the process for creating a set of claims-based utilities to encapsulate claims authorization at the service tier.
(May 24, Article)
Understanding why the Entity Framework exists and learning where it can fit into your projects can get you prepared for the eventual release early next year.
(May 10, Article)
Resource: This learning guide gives you quick access to useful links on Windows Communication Foundation security information.
(April 24, Article)
TSS.NET's Jack Vaughan spoke recently spoke with Microsoft's Brad Abrams to find out what he is seeing in the field and what the chefs in Redmond are cooking. Along the way he discusses patterns of AJAX frameworks.
(April 11, Article)
In a two-part series, Michele Leroux Bustamente explains how claims-based security is supported by WCF, and how you can implement a claims-based security model for your services.
(March 29, Article)
Windows Workflow Foundation is a new technology that many developers will need to get their heads around. In a brief excerpt adapted from Programming Windows Workflow Foundation: Practical WF Techniques and Examples using XAML and C#, K.Scott Allen considers aspects of workflow definition.
(March 22, Chapter Excerpt)
|
|
