ArcReady - Architecting Modern Distributed Applications

Architecting Modern Distributed Applications ArcReady:

About ArcReady…

A forum for aspiring and practicing architects to discuss industry trends

An overview of Microsoft’s roadmap as it relates to software architecture

A mechanism to solicit your feedback

An opportunity to showcase the work you do!

About your presenter(s)… Clint Edmonson Architect Evangelist Microsoft Corporation www.notsotrivial.net [email_address] Brian Prince Architect Evangelist Microsoft Corporation www.brianhprince.com [email_address] Larry Clarkin Architect Evangelist Microsoft Corporation www.larryclarkin.com [email_address] Phil Wheat Architect Evangelist Microsoft Corporation blog.austinwheats.com [email_address]

Agenda Session 1: Blueprints for Success Break Session 2: Making It Real Drawing for prizes

Session 1 Blueprints for Success

Industry Trends

Industry Trends Trend 1: Service Oriented Architecture (SOA)

Industry Trends

Industry Trends Trend 2: Software as a Service (SaaS)

Industry Trends

Industry Trends Trend 3: Web 2.0

Industry Trends

Industry Trends Trend 4: Rich Internet Applications (RIA)

Industry Trends

Industry Trends Trend 5: Cloud Computing

Industry Trends

Industry Trends SOA: Service Oriented Architecture Reuse and Agility Web 2.0 Network Effect SaaS: Software as a Service Flexible pricing and delivery RIA: Rich Internet Applications Experience Software + Services Cloud Computing Service Utility

Industry Trends Is this just a Microsoft thing?

Industry Trends “ Let me just say it: We want native third-party applications on the iPhone, and we plan to have an SDK in developers' hands in February” - Steve Jobs Apple Reverses on Third-Party iPhone Apps “ But Google's offline approach also is a recognition that Microsoft's right in insisting that not all computing will take place in the Internet cloud. Microsoft's been touting a vision of "software plus services " that relies on Internet-connected desktop apps, and more enterprise software-as-a-service companies, such as CRM vendor RightNow, recognize the need for some client software.” Google CEO Says Software to Play a Bigger Role

Industry Trends IBM also introduced Bluehouse, the code name for services … designed to help business partners share contacts, files, project and interact via chat and Web meeting. The model is similar to what Microsoft has been pushing with its software-plus-services strategy developed by Microsoft CTO Ray Ozzie, who created the Notes platform. Microsoft is trying to define a new category with software plus services …it turns out that Microsoft may have a point and, while Salesforce.com would be unlikely to concede this, in fact it provides some supporting evidence. A few years ago Salesforce.com released its Off-line Edition for its popular customer relationship management (CRM) product.

Heads in the Cloud, Feet on the Ground

Heads in the Cloud, Feet on the Ground When it comes to running applications, organizations today face a tension between control and economy of scale Economy of Scale Low High Control High Low

Heads in the Cloud, Feet on the Ground Economy of Scale Low High Control High Low Application runs on-premise Buy my own hardware, and manage my own data center Application runs at a hoster Pay someone to host my application using hardware that I specify Application runs using cloud platform Pay someone to host my application without specifying the hardware (they promise to be “infinitely” scalable) Application is supplied by a vendor Pay for someone’s hosted application. Don’t care about the hardware, as long as it works.

Heads in the Cloud, Feet on the Ground Tension between build vs. buy Build vs. Buy Build Buy

Heads in the Cloud, Feet on the Ground “ Packaged” Application An application that I buy “off the shelf” and run myself “ Home Built” Application An application that I develop and run myself Build vs. Buy Build Buy Hosted “ Home Built” An application that I develop myself, but run at a hoster Hosted “ Packaged” An application that I buy “off the shelf” and then run at a hoster “ Home Built” using cloud An application that I develop myself, that is hosted using cloud platform “ Packaged” using cloud An application that I buy “off the shelf”, that is hosted using cloud platform “ Software as a Service” A hosted application that I buy from a vendor “ Platform as a Service” A vendor hosted development and runtime environment

Big Pharmaceutical Example “ Too costly to run this myself, but I’ve made too many customizations” “ Packaged” Application “ Home Built” Application Hosted “ Home Built” Hosted “ Packaged” “ Home Built” using cloud “ Packaged” using cloud “ Software as a Service” “ Platform as a Service” Clinical Trial Molecule Research HR System Email CRM ERP

Big Pharmaceutical Example “ CRM and Email are commodity services – They have no customizations, and it’s cheaper for someone else to run these” “ Packaged” Application “ Home Built” Application Hosted “ Home Built” Hosted “ Packaged” “ Home Built” using cloud “ Packaged” using cloud “ Software as a Service” “ Platform as a Service” Clinical Trial Molecule Research HR System Email CRM ERP

Big Pharmaceutical Example “ I can’t afford to maintain this old HR application written in VB – it’s driving me mad!” “… but due to regulatory issues, I cannot store my HR data off-premise” “ Packaged” Application “ Home Built” Application Hosted “ Home Built” Hosted “ Packaged” “ Home Built” using cloud “ Packaged” using cloud “ Software as a Service” “ Platform as a Service” Clinical Trial Molecule Research HR System Email CRM ERP

Big Pharmaceutical Example “ I wish I had access to cheaper compute and storage when I need it” “ Packaged” Application “ Home Built” Application Hosted “ Home Built” Hosted “ Packaged” “ Home Built” using cloud “ Packaged” using cloud “ Software as a Service” “ Platform as a Service” Clinical Trial Molecule Research Email CRM ERP HR System

Big Pharmaceutical Example “ THIS is where I want to spend my IT resources – I’m going to double down on this application!” “ Packaged” Application “ Home Built” Application Hosted “ Home Built” Hosted “ Packaged” “ Home Built” using cloud “ Packaged” using cloud “ Software as a Service” “ Platform as a Service” Clinical Trial Molecule Research Email CRM ERP HR System

Architectural Blueprints

Architectural Blueprints Physical, Dedicated Single service on dedicated hardware Physical, Shared Multiple services sharing same hardware Physical, HPC Physical hardware supporting HPC scenario Virtual, Single Single instance virtual image Virtual, Shared Multiple instance virtual image

Architectural Blueprints File Fileshare, flat, page-based Relational Hosted relational database, familiar, transactional, finite Unstructured Key/value Pair, no atomicity, infinitely scalable

Architectural Blueprints Service Bus Asynchronous, reliable messaging, publish/subscribe model Peer to Peer Node registration, directory, presence awareness

Architectural Blueprints Authentication Username / Password or claims based Role Based Authorization Role-checking and authorization

Architectural Blueprints Event Based Triggered based on events (e.g. document upload) High Throughput Low latency, high volume (e.g. trading confirmations)

Architectural Blueprints Search Text Search, Image Search, Indexing Social Social Graphs, Profiles Content Management Indexing, Retrieval, Conflict Management

Architectural Blueprints Transaction Pay for each transaction Subscription Pay per month/period Licensing Pay per user/machine Advertising Advert funded model

Architectural Blueprints Service Composition Composition, brokering results, aggregation Line of Business Integration Service wrapping of mainframe and other LOB applications

Architectural Blueprints Business Logic (Rules) Entities (Schema) Workflow (Process)

Architectural Blueprints Static Static content, HTML etc Dynamic Asynchronous interaction, AJAX etc. RIA Rich Internet Applications, high visuals, limited offline support Streaming Optimized for content delivery, videos etc.

Architectural Blueprints Web Services SOAP based, WS-I compliant, WS-* REST CRUD access to services via HTML RSS Syndication services for subscriptions

Architectural Blueprints VoiceXML Mobile Application Speech API SIP Session Initiation Protocol – IM Clients SMTP Email inbound and outbound delivery SMS Mobile inbound and outbound text messaging

Architectural Blueprints Browser Consumer of web based content, HTML etc., including RIA plug in Office Office Suite, including Email and RSS reader capability Client Application Rich (Smart) client applications installed locally on machine Gadgets Locally installed, desktop based Instant Messaging Locally installed Instant Messaging client

Architectural Blueprints Browser Consumer of web based content, HTML etc., including RIA plug in Office Office Suite, including Email and RSS reader capability Client Application Rich (Smart) client applications installed locally on machine SMS / IM Text messaging and IM using Mobile Device Speech Speech enabled interface

Architectural Blueprints Devices Dedicated devices Consoles Games Consoles

Architectural Trends

Architectural Trends How can we analyze our architectures using these blueprints?

Static Web Site, On Premise

Static Web Site, On Premise (Add Content Mgt)

Static Web Site, On Premise (Add Search/Social)

Static Web Site, On Premise (Add Ad Service)

Static Web Site, On Premise (Move to Hoster)

Static Web Site, On Premise (Add AJAX)

Static Web Site, On Premise (Add Mobile RSS)

Architectural Trends How about the trends we talked about earlier?

Architectural Trends Trend 1: Service Oriented Architecture (SOA)

Trend 1: SOA - Single Service, On Premise

Architectural Trends Trend 2: Software as a Service (SaaS)

Trend 2: SaaS – Web Based SaaS Provider

Architectural Trends Trend 3: Web 2.0

Trend 3: Web 2.0 – Social Networking Site

Architectural Trends Trend 4: Rich Internet Applications

Trend 4: RIA – eCommerce Site

Architectural Trends Trend 5: Cloud Computing

Trend 5: Cloud Computing – Backup Provider

Architectural Trends How about Microsoft’s own products?

Windows Live Mesh CTP (Current, Primary)

Exchange Lifecycle (Exchange 4.0, Outlook 97)

Exchange Lifecycle (Exchange 5.0, Outlook 97)

Exchange Lifecycle (Exchange 5.0 SP1, Outlook XP)

Exchange Lifecycle (Exchange 2003, Outlook 2003)

Exchange Lifecycle (Exchange 2007, Outlook 2007)

Exchange Lifecycle (Hosted Exchange, Outlook 2007)

Architectural Challenges

Big Pharmaceutical Example “ Packaged” Application “ Home Built” Application Hosted “ Home Built” Hosted “ Packaged” “ Home Built” using cloud “ Packaged” using cloud “ Software as a Service” “ Platform as a Service” Clinical Trial Molecule Research Email CRM ERP HR System

Architectural Challenges Challenge 1 - Identity

Challenge 1 - Identity

Accessing Hosted Assets with Internal Credentials

AuthN and AuthZ across FW

Credential Storage

Challenge 1 - Identity

Architectural Challenges Challenge 2 – Data

Challenge 2 - Data

Import and Export of Data

Privacy of External Data

Reporting and Analytics

Architectural Challenges Challenge 3 – Management

Challenge 3 - Management

Holistic View of Application?

Integration into existing System Management solutions?

Contracts and SLAs

Architectural Blueprints – Next Steps

Architectural Blueprints – Next Steps Step 1 – Use the “blueprints” to decompose and recompose existing applications

Architectural Blueprints – Next Steps Step 2 – Get the right people involved

Architectural Blueprints – Next Steps Infrastructure Architect / Data Center Operations Solutions and Infrastructure Architect Solutions Architect and Development Team Solutions Architect and Development Team (inc. Web Design) Solutions Architect and Development Team (inc. Designer) Enterprise Architect and CIO Data Center Operations

Architectural Blueprints – Next Steps Step 3 – Understand the Technology Mappings

Architectural Blueprints – Next Steps IE8 Windows Mobile 7 XBOX 360 IIS 7 SL Streaming WCF .NET Framework MOSS 2007 BTS Adapters MOSS 2007 BDC AD / ADFS Ad Center .NET Framework 3 rd Party BizTalk 2006 R2 ILM BizTalk / BizTalk.Net Mesh CTP IIS 7 SQL Server SSDS Windows WF MOSS 2007 Windows WF BizTalk Server Windows Server 2008 WS 2008 HPC Windows Server 2008 Hyper-V Office WPF Vista OC Win Embed .NET CF

Architectural Blueprints – Next Steps Step 4 – Document repeatable patterns

Architectural Blueprints – Next Steps

Architectural Blueprints – Next Steps Step 5 –Resources

Break Please complete an Eval

Session 2 Making it Real

Look at Identity

Look at Identity Authentication Ÿ Authorization

Look at Identity Role Based Access Control Roles -> Rights -> Resources

Rights represent actions in the system

Rights are grouped into roles

Roles are assigned to users

User authenticates User Application Username, Pwd

System finds all of the users roles, calculates the effective rights User Application Rights Storage Username, Pwd Roles: Operator, Manager Rights: vDash, vOrders, …

Attach Principal/Identity to Thread User Application Rights Storage Username, Pwd Roles: Operator, Manager Rights: vDash, vOrders, … P Principal & Identity I

Code Checks for Permission Defense in Depth!

Evolution of Security Manager

Problems with this approach?

Companies have lots of applications

Each with their own silo of identity data

Each system is hardcoded for Az/An

Duplicated Code

Tedious to implement every time

Leads to greater risk as well

Many companies have 0 or n directories

Username & Password just isn’t enough anymore

An array of accounts for users

Intracompany ?

Doesn’t work in the cloud

Hard for calling services

Single hop and Impersonation

Zermatt

Framework for Claims Based Identity

Three geeks walk into a bar…

What is a Claim? Web Application/Service Username: Brian Roles: Manager, Sales Email: Brian.Prince@microsoft.com IsOfLegalVotingAge: True

Your app is no longer concerned with

Authentication

Storing and securing usernames and pwds

Connecting to directories

Managing roles/rights/claims

Allows for Federation

“ A Cloudy World” Example The “Cloud” Big Pharma “on premise” Cloud Storage (new molecule research in purple) Cloud Platform Cloud Compute

Big Pharma deploys software to cloud

employees Clinical trial software Firewall Management IT Directory STS Internet Service Bus (Identity) STS

Employees access cloud software

“ A Cloudy World” Example The “Cloud” Big Pharma “on premise” employees Clinical trial software Firewall Management IT Directory STS (big pharma data in purple) “ cloud” CRM

Employees use “cloud” CRM

IT Manages “cloud” CRM

“ A Cloudy World” Example The “Cloud” Clinical trial patients Big Pharma “on premise” employees Clinical trial software Firewall Management IT Directory STS Cloud Platform Internet Service Bus (Connectivity) Internet Service Bus (Identity) STS Relay

External Patients using Relay to access “on premise” clinical trial software

“ A Cloudy World” Example The “Cloud” (big pharma data in purple) (big pharma instance in purple) Clinical trial patients Internet Service Bus (Connectivity) Big Pharma “on premise” Cloud Storage (new molecule research in purple) Internet Service Bus (Identity) STS Relay Cloud Compute Cloud Platform CRM Online Hosted ERP @ Hoster employees Clinical trial software Firewall Management IT Directory STS

Claim

A piece of your identity

A property

Come from issuers. You only trust the claim as much as the issuer

Zermatt : Claim Object

Identity

A set of claims that describes a user or entity

IClaimsIdentity

Security Token

A serialized set of claims that are signed by the issuer

Presented when system access is requested

Found in the SOAP envelope for a web service call

Found in the HTTP POST in a web application

IClaimsPrincipal

Easy Change

Sample Code

Issuing Authority

Many types:

Kerberos tickets

Certificate authorities

X.509 certificates

We want one that creates our security tokens.

Knows how to issue the right claims for the right user

Interacts with AuthN systems, and authenticates the user

Security Token Service (STS)

A type of Issuer

Uses standards

WS-MEX

WS-Trust

Security Assertion Markup Language (SAML)

Relying Party (RP)

The system that relies on the claim tokens

YOUR SYSTEM

Basic Scenario – Active Client (WS-Trust) Relying Party (Web Service) Smart Client Trusted Authority (Web Service) Directory/ Credential Store STS 1. Get Policy 3. Send Claims 2. Get Claims Business Rules

Basic Scenario – Passive Client (WS-Federation) Relying Party (Web App) Browser Trusted Authority (Web App) Directory/ Credential Store STS 1. HTTP GET 3. HTTP POST 2. Redirect Business Rules

Federated Scenario Relying Party (Web Service) Smart Client Trusted Authority (Web Service) Internet Trusted Authority (Web Service) STS Business Rules STS Business Rules 1 2 3 (Java?) (.NET?)

Federated Authentication Module

Zermatt ASP.NET Controls

Wiring Zermatt up to ASP.NET

Calling a Claims Aware Service

Client side WCF already has everything it needs

Wiring Zermatt up to a Service

WCF handles SAML tokens out of the box

Needs to be configured with a custom binding

Zermatt wires in custom behaviors into the WCF config

This lets you use the simplified Zermatt claims model instead of the normal WCF model

Service Identity Client / UX Data Store User User Service Account SSRS Service Domain Objects Persistence Layer

Delegation and ActAs Web Front End Trusted Authority Directory/ Credential Store ID: svcInv STS 3. Get Claims for svcInv ActAs Dieter 2. Dieter 1. Get Claims for Dieter Business Rules Dieter’s Browser ID: Dieter Back End Web Service ID: Dieter 4. svcInv ActAs Dieter

Authentication Assurance

Zermatt Resources

http://connect.microsoft.com/site/sitehome.aspx?SiteID=642

Download the whitepaper, bits, and samples

Resources… Slide deck: www.slideshare.net/ArcReady

© 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.