Q: There is a Windows Workflow Foundation (WF)workflow service which contains only one pair of Receive and SendReply. Data will be sent through the Receive activity and how do I get the workflow service to return the GUID of the workflow instance in SendReply activity.

A: Write a custom activity to retrieve it (See below). Bind that to a variable and bind that variable to the SendReply.Content

    public sealed class GetWorkflowInstanceId : CodeActivity<Guid>
    {
        protected override Guid Execute(CodeActivityContext context)
        {
            return context.WorkflowInstanceId;
        }
    }

Kirk has got a great series on Sharepoint for the developers on his blog here. There is a whole wealth of information there and I am book-marking it here for my own reference as well. Great work, Kirk ! You rock !

1. SharePoint Developer Series Part 1: Introducing VSeWSS 1.3
2. Consuming SharePoint Lists via AJAX
3. SharePoint for Developers Part 3 – Expression Blend and Silverlight / Channel9
4. SharePoint for Developers Part 4 – Consuming SharePoint Web Services from Silverlight
5. SharePoint for Developers Part 5 – Columns, Content Types, and Lists
6. SharePoint for Developers Part 6 – Custom web services / Channel9
7. Getting XML Data From a SharePoint List – The Easy Way

And knowing him, he would probably have a lot more to follow as well. Dont walk. Run.

Both references are good reads and would propbably be a good debate topic for many but lets not do the religious cult thing:

• At This Point, I’d Prefer Java Developers Over .NET Developers
• ... and the ensuing: The Good, The Bad And The Ugly In The .NET World

Abstraction, Componentization, Reusability, etc. They have all changed the world the developers live and breathe in, havent they ? No, I dont want to sauter transistors on a motherboard anymore. Give me a PC anytime. Give me solutions.

My personal opinion is that there is no end and you cannot find a answer that fits all. Question one has to ask is:

• Are you looking for a brick builder/manufacturer
• ... Or are you just interested in building a wall/house ?

Make no mistake, I think there is a market for both. However, chances are, no one single good person will fit both bills. 

I remember back in 2005/2006 when I was still touring the APAC circuits such as Sydney (Australia) and Kuala Lumpur (Malaysia) doing training and consulting gigs for customers, partners about Windows Workflow Foundation (WF) and Windows Communication Foundation (WCF, previously - Indigo) and some of the initial Windows Workflow questions came up regarding the use of Parallel Activities. It came as a surprise to many people that parallel activities are not independently asynchronous.

I explained that a WF instance gets only one instance from the runtime. There are reasons for this single-threaded execution model so each activity have to work with this single thread efficiently. There are ways to spin off differents thread when real parallelism activities are reqquired but because documentation was scare at that time, I had some trouble articulating how to do so.

I just read "Multithreaded Parallelism in Windows Workflow Foundation" on MSDN and while it is a definite deep technical article, if you can grok it, you will understand how "MultiThreaded Parallelism" can be done in WF using both the (rather hard-to-use) "Call External Method Activity (CEMA)" and the "Handle External Event Activity (HEMA)". Not only that, the authors (whom actually implemented such a system for their own use) also shared how to pair those 2 activities up using correlation and how to create wrappers aoround them so that it can be reused and therefore "not require talented software developer use of call-external-method and handle-external-event activities along with the CLR thread-pool"

A gem of a read.

I know I havent been posting deep technical stuff that I used to do. Contrary to what people think my current role entails, keeping abreast of the technology landscape is what I am supposed to do and what I enjoy and so when colleagues joked with me when was the last time I booted up Visual Studio, for example, I enjoyed seeing their shocked faces when I told them: "oh - just last night. why you asked ?" .

I dont dwell deep like I used to but I still code up decent projects which I implement within my own developmental testing environment (yes, I have one running latest versions of Active Directory, SharePoint, Exchange and all the other goodies), driving the houshold crazy when I think of new and different ways to document expenses, publish a Book or CD library, home automation projects using all sorts of different technologies (yes, that includes Ruby-on-Rails) or in my new Windows Mobile 6 Device. Of course, I admit I dont post topics deep like I used to. It is not so much the content but more so, the limiting factor of time.

Recently, I was involved in some internal technical discussions with regards to the issue of scale comparisions between Windows Communication Foundation (WCF, previously - Indigo) and ASMX. Below are some discussions:

If you have a web service that is going to be IO bound, you would definitely want it to be scalable and almost every resource in the world tells you to implement ASP.NET asynchronous pattern (BeginSomething/EndSomething, etc) on it so to go easy on the thread pool. ASP.NET uses an IAsyncHttpHandler to handle the request, which means the worker threads are not blocked while the IO-bound operation executes somewhere else. Sounds good so far.

If you make a WCF version of it with webHttpBinding (which actually means you can invoked it AJAX-style) following the same async pattern for the methods, you may find that each invocation of the WCF service eats up two threads – one for its ASP.NET HttpModule.ProcessRequest and the other for the actual IO. Ouch! You may think that this means your WCF implementation may end up eating all threads reserved for ASP.NET, which would indeed scale down the server

Is this true OR are we missing the complete picture ?

While the scenarios explained above are reasonable observations, it doesnt paint the complete picture. WCF does perform better scalability than ASMX.

• Threading:
  For ASMX, when a request comes in, it would be queued up immediately for async ASMX. So the thread is released for that request and a new thread will pick up the work item later.

For WCF, when a request comes in, we queue it up in WCF and let an IO thread handle the request. At the same time, the request thread-pool thread is held to wait for the request to complete.

Yes, WCF uses more threads than async ASMX. But there is a reason for this. Using asynchronous ASMX is dangerous and not really a good practice (and I have hinted at this many times in the many Web Service/ASMX presentations I have done over the past few years). While it does well at what it is supposed to do, it does trick the developer into a "false sense of security". Essentially, if you dont know how the ASP.NET blackbox works, you may find yourself thrown against the car wall when you take a hidden, unsuspecting corner at high speeds. It does not provide enough throttling for client loads. Basically the server takes all items and queue them up for later processing. The server does not have a good throttling mechanism to control the number of work items. To everyone else, it seems that the server is quite friendly to all clients. However, if the number of clients is unbounded, this is really bad. First of all, the server working set would grow unlimited due to unlimited requests queued up. Secondly, many client requests would become obsolete when it’s picked up by the server from the queue. The latter accounts for a a good set of problematic scenarios I have come across in my past consulting gigs with regards to high-load and high-transactional ASMX asynchronous implementations before I joined the borg.

Think of it as a side of the brain (that tells you that you are about to be full) not functioning properly when you sit down at a buffet table. You eat and eat and eat without knowning when to stop and then your ingestion/digestion system starts kicking in, you actually hit the wall. Hard. Literally.

• Server Throughput
  When you measure scalability, the most important measurement is the server throughput. That is, how many requests the server can handle per time unit? For async ASMX, it would be pretty fast at the initial phase. However, like the ingestion/digestion analogy I was referring to above - Once the server is in a steady phase (as when CPU is fully loaded), the throughput will go down because the server capacity has reached. You can compare the data between async ASMX and sync ASMX over the long run to see what I mean.

Also you would see higher memory usage of the async approach.

• ASP.NET Throttling
  That said, ASP.NET does have a throttling mechanism that is used for sync ASMX, which is the threadpool thread limit. The number of threads used to handle requests are bounded (http://support.microsoft.com/kb/821268). WCF uses this fact to throttle incoming requests. You can always change the configuration settings to increase number of threads to be used to allow more work items to be queued up.

The max number of threads follows the following formula:
MaxWorkerThreads x #CPU – MinFreeThreads
This is 12 by default on a single-proc machine.

• Two-level Throttling for WCF
  WCF leverages the ASP.NET threadpool throttling to throttle client requests. At the same time, WCF has its own item queue throttling. The former is throttled by the setting mentioned in the immediate above point, while the latter is controlled by WCF throttling settings (maxConcurrentCalls etc). ASP.NET can automatically adjust threads based on CPU loads so that you would always get full load of the server.

In this way, you may experience client failures because the requests are rejected at ASP.NET layer beforehand. So you can increase the ASP.NET throttling to get better experience. But eventually you would still be bounded by the physical server capacity, no matter whether you use async ASMX, sync ASMX, or WCF as mentioned above.

There is improvement work done in .NET 3.0 SP1 and of course, .NET 3.5 (beta 2 here), with the use of prioritized item queues. Do expect even-better WCF performance even in some of the common scenarios. Fine tuning minWorkerThreads will even give us even better results.

Thanks to Wenlong for helping out with the guidance and explanation. The complete scenario and the design principles for it will be published in greater detail in a MSDN whitepaper later. Do watch out for it.

MSFT Corp has always talked about its ecosystem with regards to its developers and partners as one of its key value propositions which it offers through its platform to its customers.

Sometimes it is humbling to have customere call on you because its other systems can only work with yours and no one else. I have totally lost track of our ISV partners who are building great vertical solutions on top of our horizontal application stack, such as Microsoft Office SharePoint Server (MOSS) and others and that list is growing as I write this.

This is another take on it, albeit from another interesting perspective.

Good things do come in small packages - not that I am.

Many people have asked how we can retrieve and process a token sent by a subject or a Security Token Service. Just to showcase the non-intrusiveness of Microsoft Cardspace, in that we can easily incorporate a Cardspace "Sign-in with Cardspace" into your website today such as this or this, I have shown snippets of how we can do so via phphere.

As an another example of non-intrusiveness, I have also got a simple working sample that you can use to integrate into your ASP.NET 2.0 page today.

Of course, this is a hack job and there are no try catch and the xml parsing code is hastily done. To summarize, I wont win the elegance award here  ... but you can get it to work on .NET 2.0 (or maybe even 1.1) ...

Of course, this is a hack job and there are no try catch and the xml parsing code is hastily done. To summarize, I wont win the elegance award here  ... but you can get it to work on .NET 2.0 (or maybe even 1.1) ...

    [BEGIN]
    'This will get you your encrypted token
    Dim str As Stream
    str = Request.InputStream
    Dim sr As New StreamReader(str)
    Dim s As String = sr.ReadToEnd
    s = Server.HtmlDecode(Server.UrlDecode(s))

    'the stream will be ASCII encoded
    Dim u8 As System.Text.UTF8Encoding = New System.Text.UTF8Encoding

    Dim fs As New FileStream("C:\temp\CardspaceXMLToken.xml", FileMode.Create)
    'Remove the "xmlToken="
    Dim i As Integer = s.IndexOf("<")
    s = s.Substring(i)
    fs.Write(u8.GetBytes(s), 0, u8.GetBytes(s).Length)
    fs.Flush()
    fs.Close()
    '--------------------------------
    'The will decrypt that request token and return a Signed Security SAML Token
    Dim encryptedDoc As New XmlDocument()
    encryptedDoc.Load("C:\temp\CardspaceXMLToken.xml")

    'Check for <EncryptedData> element
    If encryptedDoc.GetElementsByTagName _
    ("EncryptedData", " http://www.w3.org/2001/04/xmlenc#").Count = 0 Then Return

    Dim encryptedD As XmlElement = CType(encryptedDoc.GetElementsByTagName _
    ("EncryptedData", " http://www.w3.org/2001/04/xmlenc#")(0 ), XmlElement)

    'Check for @Algorithm attribute and make sure its http://www.w3.org/2001/04/xmlenc#aes256-cbc
    If encryptedD.ChildNodes(0).Attributes("Algorithm") Is Nothing Or _
    encryptedD.ChildNodes(0).Attributes("Algorithm").Value <> _
    " http://www.w3.org/2001/04/xmlenc#aes256-cbc " Then Return

    Dim a As New RijndaelManaged

    'Check for <KeyInfo> element
    If encryptedD.ChildNodes(1).Name <> "KeyInfo" Then Return

    'Check for <EncryptionMethod> element
    Dim encryptedM As XmlElement = CType(encryptedDoc.GetElementsByTagName _
    ("EncryptionMethod", " http://www.w3.org/2001/04/xmlenc#")(1 ), XmlElement)

    'Check for @Algorithm attribute and make sure its http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p
    If encryptedM.Attributes("Algorithm") Is Nothing Or _
    encryptedM.Attributes("Algorithm").Value <> _
    " http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p " Then Return

    'Check for <CipherData\CipherValue>
    If encryptedD.GetElementsByTagName("CipherValue", _
    " http://www.w3.org/2001/04/xmlenc#").Count = 0 Then Return

    'Retrieving the Encrypted Symmetric Key and the Security Token
    Dim e_SymmKey As String = encryptedDoc.GetElementsByTagName _
    ("CipherValue", " http://www.w3.org/2001/04/xmlenc#")(0).InnerText
    Dim e_SecurityToken As String = encryptedDoc.GetElementsByTagName _
    ("CipherValue", " http://www.w3.org/2001/04/xmlenc#")(1).InnerText

    Dim rsaCsp As New RSACryptoServiceProvider
    Dim privatecert As New X509Certificates.X509Certificate2
    privatecert.Import("Softwaremaker.NET.SSL.pfx", "Softwaremaker_NET_SSL_pfx_password",     X509Certificates.X509KeyStorageFlags.Exportable)
    rsaCsp.FromXmlString(privatecert.PrivateKey.ToXmlString(True))

    'Now we have the Symmetric Key
    Dim DecryptedStrAsByt() As Byte = _
    rsaCsp.Decrypt(System.Convert.FromBase64String(e_SymmKey), True)

    'Moving on to use the Symmetric Key to decrypt Token
    Dim rijndaelM As New RijndaelManaged
    rijndaelM.Mode = CipherMode.CBC

    Dim swmDecryptor As ICryptoTransform
    swmDecryptor = rijndaelM.CreateDecryptor(DecryptedStrAsByt, Nothing)

    'Define memory stream which will be used to hold encrypted data.
    Dim cipherTextBytes As Byte()
    cipherTextBytes = System.Convert.FromBase64String(e_SecurityToken)

    Dim memoryStream As MemoryStream
    memoryStream = New MemoryStream(cipherTextBytes)

    ' Define memory stream which will be used to hold encrypted data.
    Dim cryptoStream As CryptoStream
    cryptoStream = New CryptoStream(memoryStream, swmDecryptor, CryptoStreamMode.Read)

    ' Since at this point we don't know what the size of decrypted data
    ' will be, allocate the buffer long enough to hold ciphertext;
    ' plaintext is never longer than ciphertext.
    Dim plainTextBytes As Byte()
    ReDim plainTextBytes(cipherTextBytes.Length)

    ' Start decrypting.
    Dim decryptedByteCount As Integer
    decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length)

    ' Close both streams.
    memoryStream.Close()
    cryptoStream.Close()

    ' Convert decrypted data into a string.
    ' Let us assume that the original plaintext string was UTF8-encoded.
    Dim plainTextToken As String
    plainTextToken = System.Text.Encoding.UTF8.GetString(plainTextBytes, 16, _
                                        decryptedByteCount - 16)

    return plainTextToken
    [END]
    '--------------------------------

Of course, you would have to verify the signed token yourself BUT this decryption process is definitely a step in the right direction

If you have benefitted from these sample snippets, maybe you can pay-it-forward by implementing and then sharing the signature-verification codes with me here? I am too lazy ... .

Ar - Arguments...It does make us move forward at times.

Richard Grimes has managed to kick up a storm again with his article here, again. While, I would not go very far in saying a kernel Operating System should be written in managed-code. God knows I will not use one if it is and you shouldnt to. As far as I can tell, .NET was not created for writing operating systems?  It sits on top of the operating system and thats that

It is, however, very important to note, the investments MSFT Corp have on managed code. Instead of giving you the usual bullets and docs. How about this ?

Lines of Managed Code

• Microsoft Visual Studio 2005: 7.5 million lines
• Microsoft SQL Server 2005: 3 million lines
• Microsoft BizTalk Server: 2 million lines
• Microsoft Visual Studio Team System: 1.7 million lines
• Windows Presentation Foundation (WPF): 900K lines
• Windows Sharepoint Services: 750K lines
• Expression Interactive Designer: 250K lines
• Microsoft Sharepoint Portal Server: 200K lines
• Microsoft Content Management Server: 100K lines

And lets not forget that Microsoft CRM is the first Enterprise Business Solutions that is written on managed code from Microsoft. Read: Dogfood

And YES - Windows Communication Foundation (WCF, previously - Indigo) is written in C# as well.

Case Closed. <EOM>

Sounds like SPAM ? It is not.

This is a 100% ASP.NET 2.0 based CMS solution -- best of all it is free -- check out this blog post for some sites built with it.

All the info you need is here. Let me know your thoughts if you are using it. I will be embarking on it very soon.

What an awesome Translator !!!

Where was this a year ago when I had to port something from C# to VB.NET ?

The next enhancement should have something that translates business requirements to code. I would definitely buy that.

I remember while I was chatting about one of the article I was working on for MSDN with some folks from MSFT Corp during lunch at PDC 2005 and I said that most of my code snippets are written in Visual Basic and for once ever, no-one sniggered and laughed. That moment was priceless.

This was because we just came off a fantastic talk on Visual Basic 9: Future Directions in Language Innovations. In fact, someone echoed how cool Visual Basic 9 IS now. I dont know how long was it when "Cool" and "Visual Basic" got along together until today. WOW ! What can I say ? It is standing proud.

There is a piece here that gives a brief overview on Visual Basic 9. What do I love most ? Its built-in deep XML Support. I cannot wait. Give it to me now !!!

It was a great day.

The WinFX Runtime Components Beta 1 is available here, and the WinFX SDK is available here.  Also, check out the new Windows Vista Developer Center at http://msdn.microsoft.com/windowsvista.

With this release comes with the official names for many of the technologies that they've been talking with our developers about for several years. In particular, Windows Longhorn is now Windows Vista, Avalon is now the Windows Presentation Foundation, and Indigo is the Windows Communication Foundation.

“Former” code name	Official name
Longhorn	Vista
Avalon	Windows Presentation Foundation
Indigo	Windows Communication Foundation
Metro	XML Paper Specification (XPS)
Least-privileged User Access	User Account Protection
WAP	WinFX Runtime Components

Please take a look at the new MSDN site serving as the single content point for current ASP.NET customers to easily make the move to ASP.NET 2.0.

Upgrade Center: http://msdn.microsoft.com/asp.net/migration/upgrade/default.aspx

Also, check out the new whitepaper that details the lessons learned, best practices, and valuable techniques that will help developers upgrade their apps.

New Upgrade Paper: http://msdn.microsoft.com/asp.net/default.aspx?pull=/library/en-us/dnaspp/html/upgradingaspnet.asp

For general migration (ASP, competitive, etc.) content, you can always refer to the migration center at: http://msdn.microsoft.com/asp.net/migration/

The much anticipated download of a fully installed & configured Visual Studio 2005 Team System Beta 2 VPC is now available for download to MSDN Universal Subscribers. This is the same VPC that was distributed at TechEd USA and TechEd EMEA and represents a clean install of Windows Server 2003 w/ Visual Studio 2005 Team System Beta 2.

VPC Contents:

• Microsoft Windows Server 2003 Standard Edition
• Microsoft Visual Studio 2005 Team Suite Beta 2 (expires May 1, 2006)
• Microsoft Visual Studio 2005 Team Foundation Server Beta 2
• Microsoft .NET Framework 2.0 Redistributable Package Beta 2
• Microsoft SQL Server 2005 Community Technology Preview
• Microsoft Office 2003 Standard Edition
• Microsoft Live Communication Server 2003

This VPC does not contain any sample projects or sample data.

Minimum System Requirements:

• PC with 2.0 gigahertz or faster processor
• 1.5 GB RAM minimum
• 10 GB available hard disk space
• Super VGA (800 x 600) or higher video
• DVD-ROM drive
• Microsoft Virtual PC 2004 SP1 software

If you have some trouble locating this developer-Godsend --- I have done some snopping already and it is here:

Developer Tools > Visual Studio 2005 > Visual Studio 2005 Beta 2 > English > Visual Studio 2005 Team System Beta 2 VPC

I will be delivering Indigo Ascend in Asia Pacific in the coming months on behalf of the Indigo and Ascend team in MSFT Corp, Redmond, US.

It will start in Sydney, Australia later this month, then move upwards (northwards) to my own local backyard, Singapore. There are a few more countries Microsoft and I are interested to look at bringing this event as well.

This will be a good time for me to meet up with real customers from the enterprises who are using Microsoft distributed technologies or are planning to look into using it in the future. Drop me an email here if you would like to engage me for a discussion.

If you are reading this blog post and you work for an ISV or an enterprise that does a fair bit of distributed computing technology and you are interested in attending this Indigo Ascend in Singapore (I think we are a little bit late in nominations for Australia), do drop me a mail here and I will see what I can do to hook you up for this 3 day event.

If you are from anywhere else besides Australia or Singapore (in APAC) and would love to attend an event like this, do drop me an email as well and I will see what I can do to bring Indigo Ascend to your country.

I have been invited to deliver a few Ascends before such as Visual Studio 2005 and such. However, I have always turned it down because I dont consider myself to be a "professional" trainer since I have always been on the field working on real projects with real problems in distributed technologies for some time (and not some simulated fanciful classroom labs scenarios) ...

... BUT...

Indigo is an Ascend which I am proud and excited to deliver because it is a future facet of Windows Server 2003 that I have spent quite some time on and I believe it is something that real customers need in the field to solve real-world problems today.

There is really nothing quite like it out there at the moment or in the immediate future outside of Microsoft. It is really one of Microsoft's innovation at its best.

I have recently flashed some performance graphs between Java 1.5 and the .NET counterparts version 1.1 and 2.0 Beta2. This is where I got the statistics from.

You will see the outright disparity in performance gains when .NET 2.0 Beta2 is put through the same tests with its poorer 1.1 brother and its distant cousin Java 1.5.

...And we are still talking about .NET 2.0 BETA 2 ... Let us see what happens when we get to November 7 2005

With cheap web hosting, you can save more on domain name registration and spend more on the web design as well as the seo services, particularly when you work at home.

First Survey of U.S. Corporate Application Server and Scripting Deployments Reveals Microsoft® Ahead of Competing Web Platforms.

Not really a surprise to me but good to know nonetheless.

With reference to my earlier post here, more details on the conference (SDA.NET 2005) are now publicly available here. This is a paid event and it is rarity in Singapore as technological conferences are usually presented free. BUT I am sure attendees can find a lot of value here as top notch speakers from all over the world will be flying over here to share their industry experience and knowledge.

Who are these speakers, you ask ? There is the famous Ingo Rammer and Clemens Vasters and of course, moi .

I will be making 2 presentations in the VIP Tracks, namely

Some of the folks in the Spore DotNet Usergroup got together one night to run a practical project. The idea behind the link is to build a bridge to access Visual SourceSafe over the internet. It was built successfully with the help of SCCBridge.

Incidentally, SCCBridge relies heavily on SOAP and DIME for its purpose and it is therefore no surprise that Web Services Enhancements (WSE) 2.0 was heavily involved in use here.

"Both the server and the client are written in C# in Microsoft Visual Studio .NET. In the project is used library SharpZipLib created by Mike Krueger (for more info see http://www.icsharpcode.net/ ). The algorithm for text files comparing was taken from The Code Porject site, and was written by Shankar Pratap."

This has been floating around for some time BUT MSFT Corp has released an official statement here

Since XQuery is expected to reach W3C recommendation onlyin 2006, it won't be shipped in the upcoming .NET Framework 2.0

I guess people like me will have to live with XSLT and XPATH for now.

I have came across many questions regarding the generation of self-signed X.509 PKI Digital Certificates using makecert.exe. Please use the makecert.exe that comes with the Platform SDK *Feb 2003* and NOT the one that came with the .NET SDK.

With the help of Hervey, these are the steps:

1. makecert -cy authority -r -n "CN=demos1.Softwaremaker.NET" -sr localmachine -ss "Trust"
2. makecert -cy end -n "CN=demos1.Softwaremaker.NET SERVER" -sky exchange -sk "demos1.Softwaremaker.NET Server" -ss "My" -sr localmachine -in "demos1.Softwaremaker.NET" -ir localmachine -is "Trust"
3. makecert -cy end -n "CN=demos1.Softwaremaker.NET CLIENT" -sky exchange -sk "demos1.Softwaremaker.NET Client" -ss "My" -sr localmachine -in "demos1.Softwaremaker.NET" -ir localmachine -is "Trust"

The -sk option specifies a key name, you can use any value that *SHOULD* relate to the name of the certificate. The -sk exchange option ensures that the certificate can be used to encrypt

Note that after the Step 1, a certificate is created in the "Enterprise Trust" folder in *both* the Local Machine as well as the Current User store. If you delete this certificate to recreate this scenario, then you need to:

1. record the name of the private key file using the X509Certificate tool
2. B. delete the certificate using mmc, from both the Local Machine (Trust)
   as well as the Current User (Trust)
3. C. ensure that the private key file has been removed from the machine.

To obtain a .cer file, use the certificate snap-in in the MMC console, find the certificate and export it without it's private key.

Finally, notice that Step 3 places the client certificate in the LocalMachine store; clients certs are more generally placed in the CurrentUser store.

Please take note that X.509 Digital Certs generated this way are for testing and development purposes only. It is best to *purchase* a digital certification from a TRUE Certificate Authority (CA) for production purposes. Performance is usually better with digital certificates issued from a true CA as well.

With reference to my previous posted here on Real World UsernameToken Authentication Scenarios with WSE 2.0

I have received some very good responses and feedback based on that and the questions tend to continue:

Some of the feedback I have received asked about the Encryption of the UsernameToken in the ResponseStream in the example given above. Here is a sample question:

Encrypting the username token using the public key of the server ensures
that the password is encrypted in the request to the server. What happens
when the response from the server is sent to the client ? I have looked at the
the trace the output tace at the client has no password in clear text. But
the input trace on the client has a clear text password. Why ?

The username credentials returned will follow that of the request method. So, if you send a SendPlainText mode of the PasswordOption in a request [even though you encrypt the UsernameToken afterwards], the UsernameToken in the response will be sent back in PlainText as well. This happens, of course, if you added the mutable UsernameToken back into the response stream
 
'Add Mutable Token into the Token Collection of the Response
ResponseSoapContext.Current.Security.Tokens.Add(RetrievedUsernameTokenFromRequestStream)

We cannot re-do the process we did earlier in the RequestStream by encrypting the UsernameToken again. If you remember, that was done because we had to do some Hash-Digest comparision with the Hash value stored in the user db against the Hash value generated from the Password sent in the RequestStream. Thus, the Password send have to be in PlainText mode. However, we will encrypt the UsernameToken so that it doesnt get seen on the wire. We encrypt it with the Recipient's PublicKey for the Recipient's perusal. At least, an encrypted token CAN be decrypted, a Hashed one CANNOT.
 
However, we cannot do the same in the reverse ResponseStream. This is because we cannot encrypt the Recipient's SecurityToken with the Recipient's key. The Recipient machine would not know how to decrypt it.

ResponseSoapContext.Security.Elements.Add(New EncryptedData(eTok, "#" & eTok.Id))

doesnt make any sense and would be invalid and the Recipient would respond with a SOAP Client error:
 
    ApplicationException: WSE507: The order of security elements and security tokens
    will cause a processing failure on the receiving end, and they must be reordered
    to create a valid message.
 
To hack around this constraint in WSE 2.0, the best alternative I could think of and tried is to intercept the process and force the UsernameToken to be sent back with a SendHashed or better, with a SendNone Option. This can be done by typeCasting the SecurityToken that is retrieved from the earlier RequestStream to that of a UsernameToken. Then retrieve all the necessary credentials of the casted UsernameToken (eg. Username, Password) and send that details into a new instantiated UsernameToken. Then, add this newly created mutable UsernameToken into the ResponseSoapContext Stream.

'Retrieve the Signing Token from the Request Message

Dim eTok As SecurityToken = GetBodySigningToken(RequestStream)

'Retrieve the Encrypting X509Security Token from the Request Message

Dim sTok As X509SecurityToken = GetBodyEncryptingToken(RequestStream)

'CAST the SecurityToken into a UsernameToken type

eTok =CType(eTok, UsernameToken)

'Force the process to send back a Hashed or NO Password

Dim ut As UsernameToken =New UsernameToken _CType(eTok, UsernameToken).Username, CType(eTok, UsernameToken).Password, PasswordOption.SendHashed)

'Retrieve the same Cert from the Local Machine store and Check if it supports Digital Signing

Dim sX509KeyID AsString= Convert.ToBase64String(sTok.Certificate.GetKeyIdentifier)
sTok = Helpers.GetSigningX509Cert(sX509KeyID)

'Add Mutable Token into the Token Collection of the Response

ResponseSoapContext.Security.Tokens.Add(ut)
ResponseSoapContext.Security.Tokens.Add(sTok)

'Add the Message Signature into the message

Resp.Security.Elements.Add(New MessageSignature(sTok))

'Add the Encrypted data into the message

Resp.Security.Elements.Add(New EncryptedData(ut))

From the ResponseStream generated, you will be able to look at the UsernameToken sent back now to the Recipient. However, the Password will be Hashed or there may be NO Password at all (if you configured to be sent back with a PasswordNone Option). Below is the trace snippet sent back from the Server to the Recipient.
 
        <wsse:UsernameToken...>
          <wsse:Username>TestAccount</wsse:Username>
          <wsse:Password Type=...>wc9Xl04zDgbbd0NIrOuHuRcsRVs=</wsse:Password>
          <wsse:Nonce>qr7saTsm5H/YNSjIl3w2kA==</wsse:Nonce>
          <wsu:Created>2004-08-05T09:38:53Z</wsu:Created>
        </wsse:UsernameToken>

Of course, if the Service Consumer has their X.509 Digital Certs as well, we can always embed a binarySecurityToken representation of the client's Public Key into the SOAP Request stream and then, in the Service Response Stream, encrypt the Consumer's UsernameToken with his own Public Key taken from the binarySecurityToken representation and dispatches it. However, this is not an elegant solution as

1. Most Service Consumers do not have their own X.509 Digital Certs and therefore, we have to cater for those who dont. This means extra processing power and code is needed to parse the SOAP Message to check for the binarySecurityToken and extra logic is required to hash it back using the above method if the binarySecurityToken is not found.
2. Message Payload will increase with any type of encryption as compared to hash digest and with the attachment of the binarySecurityToken as well.

Do let me know if this works for any of you or, if you have better suggestions.

It sure is great to see many people beginning to experiment and use Web Services Enhancements (WSE) 2.0. Many people I speak to and come across today are still trying to grasp the security features of WSE.

I had blogged about this earlier in my old weblog host here. However, I will just summed it up for interested parties in this post.

...While the Documentation of WSE 2.0 teaches on how to authenticate a usernameToken from a client request against a database query [I print it here for your benefit]:

Bearing in mind the constraints of

1. Passwords must be sent from the client in PlainText Form so the service can hash it and compare against the database
2. Passwords cannot be sent in Hash Digest form as the service would have NO idea on how to re-engineer the actual password from the Hash Digest

I suggest a couple of alternatives to solve this problem....Most of what you choose will depend on very much how much control you have over the client

1. SSL it [The ugliest, expensive and least scalable way...but requires the least coding work]
2. Send the username, password in ClearText Via the usernameToken. However, encrypt this entire usernameToken before sending it over. The pipelines of WSE will handle the decryption for you. Once it reaches your service application, you will know what the ClearText password is. Hash it and then do a straight comparison of the Hash Digest against the one returned from the Database. This method assumes that the server has the Private Key portion of an asymmetric token such as a X509 Digital Certificate or even the service has a X509 Digital Certificate to begin with and it also assumes the knowledge of the Hash Algorithm method employed by the user DB.

While the documentation may be poor, the extensibility of the UsernameTokenManager is great ! I will reproduce snippets of option [2] for your benefit

[Calling Client]

[Service Side]

My previous blogs on .NET