Gartner identified Cloud Computing as the No. 1 strategic technology for 2011. Companies like Microsoft, Google and Amazon are pumping lots of money into it. And more and more companies are moving their online presence and applications to the cloud.

So, what is this “cloud”? And what is all this hype surrounding it.

If you look up Wikipedia, you will find the National Institute of Standards and Technology (NIST)’s definition of what Cloud computing is:

“Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”

Confused? Here is my simplistic definition –

“It is computing power that can be shared over the internet, with several advantages like reliability, scalability, ease of maintenance and most importantly – low cost.”

Anything that you make available over the internet, whether it is a simple website, a complex application or set of services can be hosted in the cloud.

The concept of cloud computing can be best explained with an analogy. Let us assume that you are a tour guide showing people around Melbourne. What you bring to the table is your knowledge of the city of Melbourne, but you are dependent on a transport mechanism (let’s say, a car, van or even bus) to show people around. Obviously, buying your own van or bus requires a lot of upfront cost. And you may have days where there are a lot of people interested in going on a tour and days where you hardly have anyone. And what if your vehicle breaks down when you have a lot of people signed up?

Wouldn’t it be awesome, if you could just pay someone for a vehicle every day? And if you could get a bigger or smaller vehicle depending on the number of people on the tour – and pay accordingly? Maybe even have more than one vehicle if there is big group interested in a tour. And what if you even had a back up to these vehicles in case something goes wrong? This is the kind of scenario in which cloud computing comes to your aid. Companies that offer cloud computing provide the “vans” and “back-up vehicles” for you to run your “tour-guide” business. You take care of your “tour-guide” business, while the cloud company takes care of size of the vehicle or number of vehicles (scaling) and providing backups (availability/reliability), and making sure that the vehicles are maintained in top condition. As a tour operator, you get very good pricing, and the cloud company uses some of the seats in the van to service other customers, thereby increasing their own profitability.

Pricing, reliability and on-demand scalability is what makes cloud a very attractive option.

The analogy provided is a simplistic view of the cloud, and when people talk about the cloud, they generally refer to three specific models – Platform as a service (PaaS), Infrastructure as a service (IaaS) and Software as a service (Saas).

Cloud implementations such as Windows Azure fall into the Platform as a Service model. What Windows Azure provides is a platform in which you can write and deploy applications to. These applications need to follow a set of rules and be designed in a specific way to run in this platform. Conforming to these rules is easy if you use the right tools (such as Visual Studio) and SDK provided by Microsoft. Once you deploy an application that plays by the platform rules, the platform takes care of other things like load balancing, reliability, etc. To keep up with the tour guide analogy, the company providing the van lays down rules saying that only people are allowed into their vans. If you wanted to transport other things such as equipment, you can’t do it.

This is where Infrastructure as a service comes into play. This is the equivalent of the cloud company saying – “I am going to give you a van to run your tours and I don’t care what you do with the van – you run and manage it yourself”. You can then transport anything you want – people, equipment, whatever. But this brings additional responsibility in managing things such as availability and scalability, which you didn’t have to worry with the PaaS model. Amazon EC2 is an example of a very popular IaaS implementation that charges customers a certain amount based on the virtual machine they want. In addition, you also pay for things like storage costs and data transfer cost.

The Software as a Service model, on the other hand, lets cloud companies provide software that can be used for a fee. This is particularly useful if running certain software involves a lot of infrastructure and running costs, which could be prohibitive for smaller companies. But because of the cost savings and scalability this model provides, it is also useful for medium to large size companies. Popular SaaS implementations such as SalesForce, provide users with advantages such as high adoption across multiple devices, lower initial costs, easier upgrades, low maintenance and high scalability. SaaS applications typically have no or very little installation that customers have to do – instead they access these applications as a service across the web.

Explaining SaaS using the tour guide analogy may be difficult, but think of it as the tour guide company providing its services for tour operators or airlines like Qantas to use. The airlines can then focus on their core business of running an airline, while it uses the tour guide company to run local tours.

The Windows Azure Platform

Microsoft has several offerings in the cloud space that is either already out or soon going to be out – Office 365 and Dynamics CRM Online are two such offerings. But the one developers need to be aware of is Windows Azure. Windows Azure is essentially Microsoft’s operating system for the cloud.

Windows Azure provides you the platform to develop and deploy applications that are hosted in Microsoft data centres around the world. The Windows Azure platform consists of the following components:

· Compute Services: This is responsible for running applications, whether they are web applications, services or long running code that needs to reside on the server. These applications are deployed into a concept called Roles. Roles are nothing but an abstraction of an application type running on a set of machines. Web applications run on a Web Role and background tasks and long running operations run on a Worker Role

· Storage Services: All applications need a place to store data. Azure storage provides them the capability to do that in the cloud. Azure storage supports Table Storage, which is a highly scalable way of storing data; and Blobs, which is a way of storing files – large or small. In addition, it provides Queues, which can be used as an asynchronous communication mechanism between different roles. In addition to this, SQL Azure can be used to store relational data in the form of tables. SQL Azure is version of SQL Server that has been modified to run in the cloud.

· Networking: When you start hosting applications in the cloud, you will soon find that you cannot move all your organisation’s applications and services to the cloud. Some of them have dependencies and sufficient reasons from preventing them from leaving the organisation’s data centre. But what if your roles in the cloud need to communicate with these services? Windows Azure Connect provides a way of connecting the two so that they can communicate. Apart from Connect services, Azure also provides the Azure Traffic Manager. The Traffic Manager provides a way of distributing incoming traffic to different hosted services, whether they are hosted in the same data centre or spread across different services around the world. This acts like a load balancer that diverts traffic at a more global scale.

· Caching: Apart from issues like scalability and reliability, performance is usually a very common requirement in most applications and it becomes even more important in the context of the cloud. Caching in Azure is provided using Content Delivery Networks and data caches. Azure’s Content Delivery Networks (CDN) is used to cache blobs at edge networks to speed up network access, and AppService caching can provide caching within Azure to speed up access to data.

· Security: Azure’s Access Control Service or ACS provides an infrastructure for Federation and user authentication using ADFS, Windows Live ID, Google, Facebook, etc.

Although, Azure provides a number of these components, when developers start working with Azure, they initially need to focus on just Azure Compute and Azure Storage.

So, how does one get started?

To get started, you need to download the Windows Azure Tools for Microsoft Visual Studio. This contains the Windows Azure SDK and extends Visual Studio by adding the necessary project templates and tools to run and test Azure applications. The Compute Emulator and Storage Emulator that are part of the download helps you run and test the Azure application locally in your own computer before you deploy it to the cloud. You also need to create an account and configure your subscriptions at http://windows.azure.com so that you can deploy your application to the cloud. The website provides a portal to manage all your azure subscriptions and your Azure services in one place.

So, what are you waiting for? Get cracking and move your first app to the cloud. I promise you, it won’t be your last.

Well, I am going to pick the winner on the 15th – ie. 15/09/2010 – So, if you haven’t replied to me, then be quick

Send mail to Mahesh(dot)Krishnan at Readify(dot)net

http://www.msteched.com/2009/Australia/ARC401

Here is the slide deck to the presentation.

Once, the video for the presentation is up, you should be able to access it from http://www.msteched.com/2010/Australia/WEB305

Here is the slide deck from the presentation I gave -

The link to it in Amazon: http://www.amazon.com/gp/product/0470524650

Expression Blend for Dummies Developers.pptx

I did the presentation using pptPlex, so it looks better if you have that plug-in installed in your Power point.

Recently, I had to interact with a financial institution using WCF for a Customer. The Service that the financial institution exposed was not written in WCF or .NET – not that it matters, but there were a number of specific things that had to be done to get it to work:

• We needed to use transport security (https) that had to be encrypted using a specific X509 certificate
• The body of the message had to be signed using another X509 certificate
• The reply from the service did not have any security credentials attached to it – i.e. the transport was secure, but the message was not signed or encrypted

This may seem pretty straight forward – All you had to do is create a custom binding and specify something like this –

<custombinding>
  <binding name="Custom">
    <security messagesecurityversion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" 
      authenticationmode="MutualCertificate" 
    />
    <httpstransport requireclientcertificate="true" 
      authenticationscheme="Negotiate" 
      usedefaultwebproxy="true" 
      manualaddressing="false" 
    />
  </binding>
</custombinding>

The problem is that you can specify only one certificate in  Client credentials  and both message security as well as transport security will use the same certificate – we want to use two separate ones.

The solution to this is to add a new behavior that takes care of this. But rather than creating the behavior from scratch, an easier alternative is to extend the ClientCredentials class to cater for this additional certificate. So, I decided to use the existing certificate stored in ClientCredentials for message security and to add a separate property to hold the certificate for the Transport as shown in the code below –

 
/// 
/// Class that extends Client Credentials so that the certificate for the
/// Transport layer encryption can be separate
/// 
public class MyCredentials : ClientCredentials
{
  /// <summary>
  /// The X509 Certificate that is to be used for https
  /// </summary>
  public X509Certificate2 TransportCertificate { get; set; }

  public MyCredentials(ClientCredentials existingCredentials)
    : base(existingCredentials)
  {
  }

  protected MyCredentials(MyCredentials other)
    : base(other)
  {
    TransportCertificate = other.TransportCertificate;
  }

  protected override ClientCredentials CloneCore()
  {
    return new MyCredentials(this);
  }

  public override SecurityTokenManager CreateSecurityTokenManager()
  {
    return new MyCredentialsSecurityTokenManager(this);
  }

  public void SetTransportCertificate(string subjectName, StoreLocation storeLocation, StoreName storeName)
  {
    SetTransportCertificate(storeLocation, storeName, X509FindType.FindBySubjectDistinguishedName, subjectName);
  }

  public void SetTransportCertificate(StoreLocation storeLocation, StoreName storeName, X509FindType x509FindType, string subjectName)
  {
    TransportCertificate = FindCertificate(storeLocation, storeName, x509FindType, subjectName);
  }

  private static X509Certificate2 FindCertificate(StoreLocation location, StoreName name,
    X509FindType findType, string findValue)
  {
    X509Store store = new X509Store(name, location);
    try
    {
      store.Open(OpenFlags.ReadOnly);
      X509Certificate2Collection col = store.Certificates.Find(findType, findValue, true);
      return col[0]; // return first certificate found
    }
    finally
    {
      store.Close();
    }
  }

}

As part of the class, I added some helper methods to set the Transport certificate from code and also overrode the CreateSecurityTokenManager method so that I can create my own SecurityTokenManager that figures out which certificate to use for what operation.

But again, rather than create this class from scratch, I just extended the ClientCredentialsSecurityTokenManager class that ClientCredentials uses. In it I overrode the CreateSecurityTokenProvider method so that when a certificate is requested for Transport security, we pass back TransportCertificate that is stored in the MyCredentials object as shown in the code below -

 
internal class MyCredentialsSecurityTokenManager :
    ClientCredentialsSecurityTokenManager
{
    MyCredentials credentials;

    public MyCredentialsSecurityTokenManager(MyCredentials credentials)
        : base(credentials)
    {
        this.credentials = credentials;
    }

    public override SecurityTokenProvider CreateSecurityTokenProvider(
        SecurityTokenRequirement requirement)
    {
        SecurityTokenProvider result = null;

        if (requirement.Properties.ContainsKey(ServiceModelSecurityTokenRequirement.TransportSchemeProperty) &&
            requirement.TokenType == SecurityTokenTypes.X509Certificate)
        {
            result = new X509SecurityTokenProvider(
                this.credentials.TransportCertificate);
        }
        else if (requirement.KeyUsage == SecurityKeyUsage.Signature &&
            requirement.TokenType == SecurityTokenTypes.X509Certificate)
        {
            result = new X509SecurityTokenProvider(
                this.credentials.ClientCertificate.Certificate);
        }
        else
        {
            result = base.CreateSecurityTokenProvider(requirement);
        }

        return result;
    }


}

 

The last step is create the stuff necessary to be able to specify this in your config file. For that I extended the ClientCredentialsElement, so that I can specify the Transport Certificate as a behavior using the code below –

 
class ClientCredentialsExtensionElement : ClientCredentialsElement
{
    ConfigurationPropertyCollection properties;

    public override Type BehaviorType
    {
        get 
        { 
            return typeof(MyCredentials); 
        }
    }

    [ConfigurationProperty("transportCertificate")]
    public X509InitiatorCertificateClientElement TransportCertificate 
    {
        get
        {
            return base["transportCertificate"] 
                as X509InitiatorCertificateClientElement;
        }
    }

    protected override ConfigurationPropertyCollection Properties
    {
        get
        {
            if (this.properties == null)
            {
                ConfigurationPropertyCollection properties = base.Properties;
                properties.Add(new ConfigurationProperty(
                    "transportCertificate",
                    typeof(X509InitiatorCertificateClientElement), 
                    null, null, null, 
                    ConfigurationPropertyOptions.None));
                this.properties = properties;
            }
            return this.properties;
        }
    }

    protected override object CreateBehavior()
    {
        MyCredentials creds = new MyCredentials(
            base.CreateBehavior() as ClientCredentials);

        PropertyInformationCollection properties = 
            ElementInformation.Properties;

        creds.SetTransportCertificate(TransportCertificate.StoreLocation,
                                        TransportCertificate.StoreName, 
                                        TransportCertificate.X509FindType, 
                                        TransportCertificate.FindValue);

        base.ApplyConfiguration(creds);
        return creds;
    }
}

With the changes made, you should be able to replace the clientCredential section in your config file with the clientCredentialsExtension section. Something like this –

<system.serviceModel>
...
 <extensions>
   <behaviorExtensions>
     <add name="clientCredentialsExtension" type="MyNamespace.ClientCredentialsExtensionElement, MyAssemblyName" />
   </behaviorExtensions>

 </extensions>
 <behaviors>
   <endpointBehaviors>
     <behavior name="SecureMessageAndTransportBehavior">

       <clientCredentialsExtension>


         <!--This cert is used for signing the message-->
         <clientCertificate findValue="YourMessageCertName"
                            storeLocation ="LocalMachine"
                            storeName="My"
                            x509FindType="FindBySubjectName"
                            />

         <!--This cert is used for the transport-->
         <transportCertificate findValue="YourTransportCertName"
                            storeLocation ="LocalMachine"
                            storeName="My"
                            x509FindType="FindBySubjectName"
                            />

       </clientCredentialsExtension>

     </behavior>
   </endpointBehaviors>
 </behaviors>

</system.serviceModel>

That’s it – you are all set to go. Just make sure that you set this behavior for your endpoint.

Expression Blend 3 – What’s new?

Expression Blend 3 improves upon the goodness of Blend 2 SP 1 by providing a whole heap of new features and more importantly, the ability to create applications for Silverlight 3. The list of new enhancements is long – Lots of improvements to the way you use the tool, Improvements to how XAML, C# and VB.NET files are edited, Support for importing Adobe Photoshop and Illustrator files, Skinning enhancements, Enhancements for animation, Sample data generation, etc, etc.

Mahesh Krishnan will run through these changes in a fast demo based session (without using Powerpoint!) The session is targeted at both Designers and Developers, so don’t miss out

The venue is the Microsoft office in Melbourne.