Wah On Terra .NET: Martin Granell's Blog

Back in the world of blogging, just moved.

Martin Granell — Thu, 18 May 2006 14:10:00 GMT

New blog home: http://granell.net/martin

Its been a while, but I now have my blogging fingers primed, after a long absence, having been very busy offline these past few months. I will also be putting up my demos and slides from the various user groups/conferences I've been at during this time, so see you there.

Wah.Onterra is dead, long live Granell.NET

Yours,

Martin

#! /usr/bin/vbc support for windows script (or self-compiling .NET scripts)

Martin Granell — Tue, 09 Aug 2005 11:27:00 GMT

This post and comments can now be found on my new blog here

One of the “nice” things about the unix shell is the ability to create a script file that contains the program that will run the script at the top of the file. This allows all kinds of extensibility in the shell, and the ability to plug in your favourite script interpreter. This post shows how to create the same effect for .NET 1.1 on windows.

I was just reading Ken Schaefer’s blog about using Windows Scripting Host, and it reminded me of some old code I had written that was a self-compiling VB.NET WSF script. An example script is below:

' vbc /r:System.Windows.Forms.dll
'<job id="IncludeExample"><script language="JScript">var WshShell = WScript.CreateObject("WScript.Shell");var filespec = WshShell.ExpandEnvironmentStrings("%TEMP%")+"\\" +WScript.ScriptName+".exe";var fso=WScript.CreateObject("Scripting.FileSystemObject");if (fso.FileExists(filespec)) fso.DeleteFile(filespec);var ts=fso.OpenTextFile(WScript.ScriptFullName, 1);var comp = ts.ReadLine();comp=comp.substring(comp.indexOf(" ")+1);ts.Close();var f=fso.GetFolder(WshShell.ExpandEnvironmentStrings("%windir%\\Microsoft.NET\\Framework\\"));if (!f) WScript.Echo("You must have the .NET Runtime installed");var netVersion="";fc = new Enumerator(f.SubFolders);for (;!fc.atEnd(); fc.moveNext()){if (fc.item().name > netVersion)netVersion = fc.item().Path;}oExec = WshShell.Exec(netVersion + "\\" + comp + " /out:"+filespec+" /target:exe /debug "+WScript.ScriptFullName);while (oExec.Status == 0){if (!oExec.StdOut.AtEndOfStream){WScript.Echo(oExec.StdOut.ReadAll());}WScript.Sleep(100);};if (!oExec.StdOut.AtEndOfStream){WScript.Echo(oExec.StdOut.ReadAll());}if (!fso.FileExists(filespec)) WScript.Quit(1);oExec = WshShell.Exec(filespec);while (oExec.Status == 0){if (!oExec.StdOut.AtEndOfStream){WScript.Echo(oExec.StdOut.ReadAll());}if (!oExec.StdErr.AtEndOfStream){WScript.Echo(oExec.StdErr.ReadAll());}WScript.Sleep(100);};if (!oExec.StdOut.AtEndOfStream){WScript.Echo(oExec.StdOut.ReadAll());}if (!oExec.StdErr.AtEndOfStream){WScript.Echo(oExec.StdErr.ReadAll());}</script></job>
'
' A "Hello World!" program in Visual Basic.
Imports System
Imports Microsoft.VisualBasic
Imports System.Windows.Forms
Module Hello
   Sub Main()
        ' Console class from .NET
        Console.Write("To the console...")

' Intrinsic VB compatible code
MsgBox("Hello World!") ' Display message on computer screen.

        ' Example of using the shell object
        Dim shell as Object = CreateObject("WScript.Shell")
        shell.Popup("hello2")

        ' Example of using a referenced assembly
        MessageBox.Show("This is using System.Windows.Forms")
    End Sub
End Module

The magic in this script comes from the second line, which contains a valid WSF fragment. It is also VB.NET commented, so that the file is a valid VB.NET file. The code searches for the latest version of the .NET runtime, reads the first line of itself for the compiler and any additional arguments (e.g. references to other assemblies), compiles the .exe into the TEMP directory, and then runs the executable, making sure to copy standard out and error out into the console window.

To run the example, copy it into a file named foo.wsf, and run:

cscript foo.wsf

If you wanted to use the c# compiler instead, it would be a small matter of changing the compiler in the first line, and making the code compatible (of course you couldn’t use the late binding support available within VB.NET). Now you have the full power of .NET without having to run the compiler manually…

MVP Award

Martin Granell — Sat, 02 Jul 2005 07:27:00 GMT

This post and comments can now be found on my new blog here

I would like to thank those who have nominated me, both internally and externally to Microsoft, for my being awarded MVP status. I will endeavor to extend my community involvement over the coming year, with more presentations, break out sessions, technical postings and helping out with some of the trickier questions in the architecture and patterns forums.

The dearth of postings on this blog is crying out to be filled, and I have a whole suite of juicy technical postings to post, that have been building up while I’ve been head down buried in curriculum development land. On the cooking platter at the moment are a series of tools and updates to help people building solutions using Enteprise Library, and various code generation pieces.

Btw, if you are in Amsterdam for TechEd Europe, then I might see you there…

Configuration WebCast with Hands On Lab

Martin Granell — Sat, 05 Mar 2005 20:01:00 GMT

This post and comments can now be found on my new blog here

This morning (US time), Ron Jacobs and Scott Densmore did a web cast on the Configuration Block of Enterprise Library. For the web cast series we are building a set of hands on labs, which step you through how to use the various blocks. You can download the Configuration hands on lab (and future labs) from Ron’s website.

Please leave feedback on the lab, as we’re in the middle of building the labs for the next set of webcasts, and we’d love to get your input on how to improve the lab. I’d also be interested in what languages people are using with Enterprise Library, is it mainly VB.NET and C#, or have people tried more exotic languages like IronPython.

Greg Low joins our happy team

Martin Granell — Sun, 20 Feb 2005 22:58:00 GMT

This post and comments can now be found on my new blog here

Greg Low has announced that he is joining our team. Congratulations Greg, and I look forward to working with you into the future.

Enterprise Library Demo from tonights user group meeting

Martin Granell — Fri, 18 Feb 2005 00:27:00 GMT

This post and comments can now be found on my new blog here

Hi folks,

Here’s the web service that I demoed tonight. This web service provides an authenticated and instrumented web service that uses a persistent, encrypted database cache to support web farm caching of generated results in 60 lines of code. It also (coincidentally) makes use of every one of the Enterprise Library application blocks directly, or through configuration.

You can download the demo here. The powerpoint file can be found at the Enterprise Library gotdotnet workspace (under releases on the right-hand side), this is a direct link to that file.

To run, ensure that you have created the Caching and Security databases (by running the .cmd files in the Enterprise Library source). Add a user “martin”, password “martin” using the SecurityDatabaseConsole.exe program. Make sure that the ASPNET account has access to the databases. You may also need to run the “Install Services” script to register instrumentation sources.

Declarative security with Enterprise Library (The Real Thing)

Martin Granell — Thu, 10 Feb 2005 00:42:00 GMT

This post and comments can now be found on my new blog here

Lets start off with Why bother to use declarative security attributes? It’s only a few more lines of code to write:

public void DoSomethind()

{

IAuthorizationProvider prov = AuthorizationFactory.GetAuthorizationProvider();

if(!prov.Authorize(Thread.CurrentPrincipal, "important stuff"))

{

throw new SecurityException("Not allowed to do this");

}

Versus:

[AuthorizationPermission(SecurityAction.Demand, Context = "important stuff")]

public void DoSomethind()

{

}

But there are two main advantages to the attribute approach (as well as reduced LOC, and cleaner code):

1. The ability to read the metadata. Permview is an example of an application that can read the meta data from an assembly, and spits out the following for the method above:

Method AuthTest.Class1::DoSomethind() NonCasDemand permission set:

   <IPermissionclass="Readify.EnterpriseLibrary.Permissions.AuthorizationPermissionXml, Readify.Entlib.Permissions"
                version="1"
                unrestricted="False"
                context="important stuff"/>

</PermissionSet>

This then allows us to scan all the assemblies in the application, and build up a manifest of which methods are protected by which authorities.

2. Flexibility – If we want to add additional logging to our attribute, or change the factory behaviour, we have one level of isolation from the underlying authorization source (in this case enterprise library).

OK, well how do we build one? Have a look at the source from here to see a finished custom non-code access security attribute. See this post for an overview of the process.

There are a few tricks to know:

1. The attribute must derive from CodeAccessSecurityAttribute, even if it is not a CAS attribute. If it just derives from SecurityAttribute, then the C# compiler will ignore it (although the VB.NET one does the right thing…)

2. The ToXml() method must create an element with the name IPermission, and there must be a class attribute with the assembly qualified name.

3. The assembly must be strongly named, otherwise you won’t get the compiler to emit the permission.

4. The assembly must either be added to the GAC, or to the Visual Studio devenv.exe directory, for the VS.NET compiler to find it (although the command line compiler does not have the same problem).

5. The attribute must have a single constructor which takes a single SecurityAction parameter. Don’t be tempted to provide multiple parameters to initialize the attribute instead.

6. The debugger is your friend. Debug visual studio by launching it in the program arguments of the project debugging properties, and step through what your permission and attribute is doing.

7. Reflector is critical. When things start going wrong, the error messages are usually totally irrelevant. Look at the implementation of PermissionSet in reflector, and use permview to dump the XML that your attribute created.

8. Unit tests. Unit tests. Unit tests. Unit tests. Did I mention unit tests?

Now, point number 3 was that the assembly had to be strong named. Since we want to call the authorization interface in enterprise library, and the default installation of enterprise library is not strong named, this is a problem.

Well… back to reflection land. I’ve created three wrapper classes, that on class constructor dynamically load the weakly named enterprise library using an assembly string, using reflection to grab MethodInfo instances for each the types, and then has some public wrapper methods that invoke the method infos.

Performance should not be too bad, and should be outweighed by the real authorization costs being performed anyway. From a security perspective (Trojan succeptability), this is no worse than using the IAuthorizationProvider interfaces directly, if the enterprise library assemblies being used are not strongly named.

If you do strongly name your enterprise library, then you can rip out the wrappers, and the calls to the wrappers, and replace with direct calls to the enterprise library factory and interfaces.

Type Validation errors trying to use non-GAC types in the Enterprise Library Configuration Tool

Martin Granell — Thu, 10 Feb 2005 00:02:00 GMT

This post and comments can now be found on my new blog here

One of the bugs in Enterprise Library v1.0 relates to Type validation. The problem occurs when selecting a type from an assembly which is not in the Global Asssembly Cache, and not in the EntLibConfig.exe directory.

Example steps to reproduce are:

· Create a project with a custom authorization provider (i.e. derive from ConfigurationProvider, and implement IAuthorizationProvider).

· Add an application configuration file.

· Build the app.

· Run enterprise library, and open the application configuration file.

· Add a Security Application Block section.

· Add a Custom Authorization Provider.

· Click the ellipsis on the type name.

· Add the application assembly containing the custom provider type

· Select the new type.

· Attempt to save.

At this point you will receive a validation error stating that the type is not valid. The problem is that some of the configuration settings have the [TypeValidation] attribute, which will attempt to check that the assembly qualified name of the type is a valid type. Unfortunately, this is running in an App Domain which is rooted in the EntLibConfig.exe directory, and so will only be able to resolves types in assemblies in that directory, or in the GAC.

The longer term solution is for the TypeValidation attribute to be able to look in the correct assembly locations, but at the moment you will need to change the enterprise library source.

Open the file: <Program Files>\Microsoft Enterprise Library\src\Configuration\Design\Validation\TypeValidationAttribute.cs

And comment out line 60:

// errors.Add(instance, name, SR.ExceptionTypeNotValid(typeName));

Re-build Enterprise library by running the batch file:

<Program Files>\Microsoft Enterprise Library\src\BuildLibrary.bat

New release of String Resource Generator with multi-language SR.strings support

Martin Granell — Wed, 09 Feb 2005 22:33:00 GMT

This post and comments can now be found on my new blog here

UPDATE: There was a problem in the previous release. Method (b) would not work (thanks to VS.NET for not handling satellite assemblies correctly..). I've updated the instructions below, and the sample in the release, to cover what needs to be done to make it work:

Hi Folks,

The next release (~~1.2.2~~ 1.2.3) of the string resource tool is here… Changes for this release are:

1. More complete sample, that should cover all of the functionality of the Custom tool and Batch .exe

2. Accessibilty option now works (with VB.NET & C# only at this point, otherwise it can only be public, blame CodeDom).

3. The Resource class generation can be turned off by using “generate_class = false”

4. SR.strings files can now contain multi-line resources, by doing the following:

[strings]
ResName(int age) = First Line
= Second Line {0}
= Third Line
NextRes = Blah

5. From release 1.2.1 onwards its possible to use 3 methods of having multiple locales resources in the same project.
(a) Have a primary .resx file (e.g. SR.resx), with the CustomTool option set. Have secondary .resx files (e.g. SR.de.resx, SR.en.us.resx), which do not have a custom tool set.

b) Have a primary SR.strings file, with one [strings] section with all the neutral resources, with the CustomTool set. Have secondary .strings files (e.g. SR.strings-de) _with_ the Custom Tool set, but with “#! generate_class = false” at the beginning of all the secondary .strings files, and locale dependent [strings] sections, e.g:

SR.strings:
[strings]
ResName = blah

SR.strings-de:
#! generate_class = false
[strings.de]
ResName = German blah

SR.strings-de-DE:
#! generate_class = false
[strings.de-DE]
ResName = German in Germany blah

Note: The extension on the secondary strings files can be anything, but the base filename must be the non-localized resource name. i.e. SR.de.strings is not valid because the base name is “SR.de“. SR.strings-de is valid, because the base name is “SR“.

c) Multi-locale .strings file. Have a SR.strings file with multiple [strings] sections, one for each locale. e.g.
[strings]
Res1 = Text
...

[strings.de]
Res1 = German Override
...

[strings.de.DE]
Res1 = Germany override
...

Note that you can combine all of these options if you wish. E.g. a primary SR.strings file with:
[strings]
[strings.en]
[strings.en.US]

And a secondary SR.strings-de file with:
#! generate_class = false
[strings.de-DE]
[strings.de-CZ]

which will generate:
SR.de-DE.resx
SR.de-CZ.resx

Declarative security with Enterprise Library

Martin Granell — Thu, 03 Feb 2005 23:35:00 GMT

This post and comments can now be found on my new blog here

UPDATE: ok, so it's tomorrow, and I haven't done the post... however I have uploaded the files. You can get the source here. Tomorrow, I promise, I'll put up a post describing how I built the code, what issues there were, and how to use it.

Tomorrow I’ll be posting some code I’ve been working on that allow the use of declarative attributes to secure blocks of code, and uses Enterprise Library’s authorization model to do so. An example line in VB.NET would be:

< AuthorizationPermission(SecurityAction.Demand, Context:="OrderBooks" > _
Public Sub OrderBooks()
 
End Sub

This is somewhat equivalent to the PrincipalPermission attribute, but uses (in this case the default) IAuthorizationProvider instance obtained through the enterprise library provider model.

The code will show a few things:

1) How to use the authorization API of enterprise library

2) How to build custom security attributes

3) How to get around the problem of security attributes having to be strong named, but the default install of enterprise library does not use strong naming. (Remember that a strongly named assembly may only reference other strongly named assemblies).

This can be used as part of a defence in depth strategy, typically to secure business methods. One of the great advantages to using security attributes is the ability to use permview to dump which methods in which assemblies require which authorities. This allows a high degree of security visibility and checking.