Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts

Thursday, November 12, 2009

[Event] TechED 2009 – Experience Summary

Last Sunday I arrived at the TechEd 2009 in Berlin and registered in the evening. There were many people from all over Europe and even Speakers from the US. About 736 Sessions for over 7000 people were announced. What an event, the week promised to be awesome!

I did 4-5 session per day and also tried to do as much Hands-On-Labs and Interactive Discussions as possible. When I got a possibility to talk to Microsoft collaborators on upcoming technologies I did it!

I attended at sessions on Architecture, WCF 4.0, WIF, Dublin, Parallel Programming, SQL Azure and Visual Studio 2010 and many others. An enormous amount of news was given to the audience and I was very excited of what was presented.

WCF 4.0 will not have major updates but will get default bindings, default behaviors and standard endpoints that will make configuration in most cases much easier. There will be new protocol mappings, a whole new routing mechanism (!!!) and new ad-hoc service discovery features that make it possible to detect services on the network automatically. It will be possible to configure the content-type of the service return format (xml, text, json, atom, etc...).

The Geneva project, that will rewrite history for security handling in application, was renamed to WIF (Windows Identity Foundation). This new claims based approach decouples security handling and management from application development. It works via Tickets that are delivered via an STS (Security Token Service). Cardspace 2.0 will be used to provide users with the possibility to select an identity.

WIF is the framework that is used inside applications for being able to use Tickets and recover claims that are important for them. Finally an abstraction layer for security, something that will make application development much easier and security handling much more flexible!

Dublin, which was renamed to "AppFabric", will provide a new hosting environment for WCF. Some extensions to IIS were shown, that add for example, a new management Dashboard that greatly aids in managing WF 4.0 Workflows and WCF services. WCF 4.0 in conjunction with Dublin will really provide a whole new experience and will be a good alternative for BizTalk in many use cases. Definitely worth looking into it when it will be shipped!

The new Parallel Programming features in .NET 4.0 will make it much easier to get the most out of multi-core machines. In most cases you just have to identify the parts of the application that may be parallelized and use Tasks, PLINQ and the TPL (Task Parallel Library) to optimize for parallel processing. Thread optimization and complicated algorithms will rarely be necessary. There are many new features in Visual Studio 2010 that further aid the developer to master parallel development (Thread/Tasks can be separately debugged and profiled, Performance analysis can be done, etc...).

SQL Azure will be a relational database in the Cloud that can be used together with Windows Azure or client applications on client servers. The experience is seamless and you really see no difference inside your applications. You even can use SQL Server Management Studio (in a new version that can be found here) to manage your online databases. Your databases can have a size be up to 10 GB and the same on-a-use based payment model is applied as with Windows Azure ($9.99 and $19.99 payment plans).

And I could go on and on. This was really an amazing event and I am very happy that Winwise sent me to it. I would love to get into more detail on all the new features, so just contact me if you want additional information.
Share/Save/Bookmark

Thursday, September 4, 2008

[Concept] Application Security
Using Oracle Proxy Users

Application security can greatly be enhanced by using a dedicated proxy user for Oracle DB connections. An Oracle proxy user is a user that is allowed to connect on behalf of another user. The real user accounts do not need to identify themselves against the DB anymore and do not need to know their passwords. Instead they connect through a middle tier proxy user.

The middle tier proxy user just needs the "create session" and "connect through to xxx user" rights. It is just a regular user that enables the real user account to impersonate itself and connect to the DB. The proxy user will appear as real user during the session. It will only have the rights that the real user has.

Example:

User1 is using the application and the application needs to access the Oracle DB. It will use the middle tier proxy user to connect to the DB. It will request that the middle tier proxy user pretends to be User1 for the session.

Since the DB knows the middle tier proxy user and it has the right to connect through User1 it accepts the impersonation. The session now only has the rights that are configured for User1 in the DB meaning that it can only do what User1 is allowed to do.
Share/Save/Bookmark