Persistence and User Management

Transcription

1 Enterprise System Integratin Tutrial 8 Persistence and User Management This exercise intrduces yu sme techniques t Fr this exercise yu will need: implement security necessary t ensure safe handling f purchase rders. Windws 2008 Server, Windws In this practice, we will: 2008 Server R2, Windws Vista set up new database rles, r Windws 7 implement a wrkflw with multiple SQL Server 2008 r SQL Server interactins with backgrund services, 2008 R2 learn abut managing build qualities. Visual Studi 2010 (at least ne We will cntinue wrking n the team prject in team member need t use Visual the lab sessin. This practice fcuses n setting up Studi 2010 Ultimate) persistence f messages and wrkflws, and setting AppFabric fr Windws Server up user and system authenticatin. These techniques will be required when cmpleting this week s assignment. Suggested reading and viewing SQL Server permissins verview, Wrkflw tutrial using AppFabric, default.html ASP.NET security cnfiguratins, Part A Creating Users and Rles in Database In the previus assignment yu published a public database view t a web service and a web site. This time yu need t start supprting cmmunicatins with yur custmers and database manipulatins by yur internal users. This means, yu need t start managing user permissins and authenticatin public access t the services is n lnger an ptin. There are several ptins fr implementing authenticatin. It des nt matter, which ptin yu will use, yu will prbably need a table t stre user identities. Yu might als need t implement several authenticatin ptins t supprt different systems. The first step t setting up secured access is t create rles and users with sufficient access rights n the database server. The easiest way t add a new rle with rights t execute prcedures and use views t ur SQL Server database is t run fllwing cmmands n SQL Server: CREATE ROLE [InternalUser] GO GRANT SELECT ON DATABASE::[$(DatabaseName)] TO [InternalUser] GO GRANT EXECUTE ON DATABASE::[$(DatabaseName)] TO [InternalUser] GO These cmmands can be als be added t the database server prject. Once the rle has been created, it can be given t the users wh wuld be using these permissins. Users with permissins given using WITH GRANT OPTION can delegate these permissins t ther users, which can be useful if yu desire t add functinality fr internal users t add new users frm the web site (e.g. t manage cntracts with building cmpanies). 1/6

2 Enterprise System Integratin Tutrial 8 Part B Adding Member-Only Areas T add areas nly accessible t certain lgged in users and rles, yu have tw cmmnly used ptins fr implementing the requirement: creating custm authenticating scheme and managing security manually, r t use ASP:NET membership and rle prviders and crrespnding ASP.NET cntrls (see suggested reading fr mre details). ASP.NET supprts several membership and rle prviders ut f the bx and allws creating yur wn prviders. These prviders include SQL database and Active Directry prviders. If yu want t use SQL Server t manage rles and members, yu culd run aspnet_regsql.exe E S SANDSTOR\ESIINSTANCE sqlexprtnly rlesdbinint.sql A mr d dbname where dbname is yur database name t generate the sql script fr creating ASP.NET rles and membership database. The features generated will depend n the value specified t A flag: m membership database, r rles database. As the university s Active Directry will nt be managing yur site s rles, yu can nt use Active Directry as a rle strage. Yu can still use Active Directry fr membership (authenticatin). In additin, it is very simple t create yur wn rle and membership prviders thanks t the simple interface. If yu need t supprt multiple different identity prviders, it is suggested that yu use Windws Identity Framewrk (WIF). Step-by-step instructins n hw t set up WIF fr yur web site can be fund at Due t the cmplexity f WIF, we suggest yu use SQL database t manage users instead. It is pssible t use the same authenticatin prviders fr yur service calls; hwever, yu shuld avid ding s. A pssible means t authenticatin is using shared secret. That is, yu can give the build cmpany an identifier that it has t submit with each message it sends t yu. This tken-based authenticatin is relatively weak, but satisfactry fr ur current needs. T reduce the pprtunities fr third parties t get access t the tken, yu shuld encrypt the transmissins (we will discuss this in the future lab sessins). Part C Adding Persistence t Wrkflws As we are ging t create a lnger wrkflw, we must get prepared fr pssible issues rising during the executin f the wrkflws. In ur case, persistence is slved by string the states f the wrkflws in a database. This means a shift frm the data-riented services created in the previus assignment t prcess-riented services. Essentially, we will n lnger implicitly stre the intermediate dcuments in the database we will be using wrkflw states instead. T set up persistence in yur applicatin, we will be using AppFabric datastre that has been set up t use SANDSTOR database. T enable persistence in a wrkflw, yu shuld fllw the fllwing rules in yur wrkflw: Rule B.1 Use Transacted Receive Shape instead f Ordinary Receive Shape 1. In a new wrkflw, drag and drp TransactedReceiveScpe shape t the beginning f the wrkflw. 2. Drag and drp the receive shape int TransactedReceiveScpe s Request sectin. 3. Drag and drp a Sequence shape int TransactedReceiveScpe s Bdy sectin. 4. Drag and drp the send shape int the newly added Sequence shape. Rule B.2 Use Crrelatin t Keep Track f Message Linking t Wrkflw Instances 1. Befre receiving a secnd message int yur wrkflw, yu need t initialise crrelatin. This can be dne with Initialize Crrelatin Shape r Receive Shape. In either case yu will need t specify a list f (wrkflw crrelatin handle) variables that will be used t identify the wrkflw instance wrking n the prcess. Fr example, in 2/6

3 Enterprise System Integratin Tutrial 8 case f purchase prcess, yu might want t create a crrelatin n purchase rder identifier. 2. Fr every Receive shape yu need t specify Crrelates On prperty. Crrelates With prperty will need t pint t the wrkflw variable specified in step 1 (crrelatin initializatin) and Crrelates On shuld cntain a mapping frm message members t this wrkflw variable. Keep in mind that crrelatin handle variables are f strings and use crrespnding casts where necessary. Rule B.3 Define the Persistence Stre Cnnectin in web.cnfig 1. Add the cnnectin string t WF4 Persistence Stre: <cnnectinstrings> <add name="wf4persistence" cnnectinstring="data Surce=SANDSTOR;Database= WF4Persistence;Integrated Security=True"/> </cnnectinstrings> 2. Add the persistence service cnfiguratin t yur web.cnfig (system.servicemdel/behavirs/servicebehavirs/behavir sektsini): <sqlwrkflwinstancestre cnnectinstringname="wf4persistence" /> Managing Build Qualities As yu might have nticed, duble-clicking n a build will pen the build result. On tp f the build result yu can set the quality f the build. It is suggested that yu mark at least the deplyments that were successful and will be used fr assignment grading as Released. Yu might use this management f Build Qualities t infrm ther members in yur grup abut prject prgress like Ready fr Deplyment, Ready fr Testing, r Under Investigatin t let thers knw that yu believe that the prject is getting ready r yu are wrking n recent prblems with the builds. Als, keep in mind that TFS creates a wrk item fr each new failure f a build. Yu shuld try t clse these bugs as sn as pssible. Remarks and Tips There are a few unintuitive details when wrking with SQL Server and.net Framewrk. We have listed a few belw: Fr string date and time in SQL Server, ne shuld prefer datetime2 datatype as it cnfirms t standards better and is handled crrectly by mst clients. Yu can create a help page (it well be published at yur ruting endpint under help) detailing yur REST service API by adding a standardendpint t yur web.cnfig file: <system.servicemdel> <servicehstingenvirnment aspnetcmpatibilityenabled="true" /> <standardendpints> <webhttpendpint> <standardendpint helpenabled="true" autmaticfrmatselectinenabled="true" /> </webhttpendpint> </standardendpints> </system.servicemdel> Yu can make sure that there are certain rws in yur database while running tests by mdifying the database while initialising yur test classes. Yu shuld als make sure that yu reverse the changes after the tests are run s that the BuildIT cmpanies wuld nt get testing items r invices caused by yur tests. An example f setting up and clearing a database can be seen in the fllwing cde snippet. Nte the #regin and #endregin directives, which allw yu t hide the initialisatin and clean-up cde in Visual Studi 3/6

4 Enterprise System Integratin Tutrial 8 when implementing the test methds (each methd cunts as a separate test). Keep in mind that test methds are run in randm rder (parallelised) and test classes can als be instantiated in parallel r randm rder (thus, race cnditins can apply if yur tests are using the same resurces). #regin Additinal test attributes // Use ClassInitialize t run cde befre running the first test in the class [ClassInitialize()] public static vid MyTestInitialize(TestCntext testcntext) string cnnectinstrname = "ReleaseDatabase"; #if DEBUG cnnectinstrname = "DebugDatabase"; #endif using (SqlCnnectin sc = new SqlCnnectin(System.Cnfiguratin.CnfiguratinManager.C nnectinstrings[cnnectinstrname].cnnectinstring)) sc.open(); using (SqlTransactin st = sc.begintransactin(system.data.islatinlevel.serializable) ) using (SqlCmmand scmd = sc.createcmmand()) scmd.transactin = st; scmd.cnnectin = sc; try scmd.cmmandtext IF NOT EXISTS(SELECT * FROM [esi].[inventryitem] WHERE [Name] = N'PriceListServiceTes titem') INSERT INTO [esi].[inventryitem] ([Name], [DefaultPrice], [CurrencyId], [Descript in], [DateAdded], [DateUpdated]) VALUES (N'PriceListServiceTestItem', , N'EUR', N'This is a fictinal it em used by autmated unit testing.', GETDATE(), GETDATE())"; scmd.executennquery(); scmd.cmmandtext IF NOT EXISTS(SELECT * FROM [esi].[custmer] WHERE [Name] = N'PriceListServiceTest Cus tmer') INSERT INTO [esi].[custmer] ([Name], [POEndpint], [Descriptin]) VALUES (N'PriceListServiceTest Custmer', N' vice', N'This is a fictinal custmer used by autmated unit testing.')"; scmd.executennquery(); scmd.cmmandtext int; int; = [InventryItemId] FROM [esi].[inventryitem] WHERE [Name] = N'Pri celistservicetestitem'; = [CustmerId] FROM [esi].[custmer] WHERE [Name] = N'PriceList ServiceTest Custmer'; DELETE FROM [esi].[reservatin] WHERE [InventryItemId] INSERT INTO [esi].[reservatin] ([InventryItemId], [CustmerId], [Frm], [T], [ReservatinStateId]) VALUES ' ', ' ', 0), ' ', ' ', 1), ' ', ' ', 2), ' ', ' ', 3);"; scmd.executennquery(); st.cmmit(); catch (Exceptin) st.rllback(); thrw; 4/6

5 Enterprise System Integratin Tutrial 8 sc.clse(); // Use ClassCleanup t run cde after last test has run [ClassCleanup()] public vid MyClassCleanup() string cnnectinstrname = "ReleaseDatabase"; #if DEBUG cnnectinstrname = "DebugDatabase"; #endif using (SqlCnnectin sc = new SqlCnnectin(System.Cnfiguratin.Cnfiguratin Manager.CnnectinStrings[cnnectinStrName].CnnectinString)) sc.open(); using (SqlTransactin st = sc.begintransactin(system.data.islatinlevel. Serializable)) using (SqlCmmand scmd = sc.createcmmand()) scmd.transactin = st; scmd.cnnectin = sc; try scmd.cmmandtext DELETE FROM [esi].[reservatin] WHERE [InventryItemId] IN (SELECT [InventryItemId] FROM [esi].[inventryitem] WHERE [N ame] = N'PriceListServiceTestItem')"; scmd.executennquery(); scmd.cmmandtext FROM [esi].[inventryitem] WHERE [Name ] = N'PriceListServiceTestItem'"; scmd.executennquery(); scmd.cmmandtext FROM [esi].[custmer] WHERE [Name] = N 'PriceListServiceTest Custmer'"; scmd.executennquery(); st.cmmit(); catch (Exceptin) st.rllback(); thrw; sc.clse(); // #endregin Assignment Deliverables This week s assignment will require yu t publish service calls fr checking availability f a plant, requesting a purchase, and sending a purchase rder. Yu will als need an authenticated web page sectins fr reviewing and creating purchase requests. Nte that purchase requests fr items nt available n the requested dates shuld be rejected autmatically. Thus, we will need the fllwing: An additinal sectin f the web site fr use by authenticated users (n annymus access shuld be allwed) fr PO review. Fllwing autmated tests (must be run autmatically at 10AM n Mnday): 5/6

6 Enterprise System Integratin Tutrial 8 A test requesting an availability f an item I frm date A t B (where I, A and B are given as parameters t query) frm yur middleware service fr a nn-existent item (shuld return a fault). A test requesting an availability f an item I frm date A t B (where I, A and B are given as parameters t query) frm yur middleware service fr an existing item (shuld return list f perids where the item is available). A test requesting purchase f a nn-existent item frm the service. A test requesting purchase f an unavailable item frm the service. A test requesting purchase f an available item frm the service. A test requesting purchase f an available item frm the service but fails t authenticate itself. 6/6