www.it-ebooks.info Dominic Selly Andrew Troelsen Tom Barnaby Expert ASP.NET 2.0 Advanced Application Design 522xFM.qxd 8/31/05 3:54 PM Page i www.it-ebooks.info Expert ASP.NET 2.0 Advanced Application Design Copyright © 2006 by Dominic Selly, Andrew Troelsen, and Tom Barnaby Lead Editor: Ewan Buckingham Technical Reviewers: Robert Lair, Rakesh Rajan, Victor Garcia Aprea, Fernando Simonazzi, Hernan De Lahitte Contributors: Dave Zimmerman, David Schueck, George Politis Editorial Board: Steve Anglin, Dan Appleman, Ewan Buckingham, Gary Cornell, Tony Davis, Jason Gilmore, Jonathan Hassell, Chris Mills, Dominic Shakeshaft, Jim Sumser Associate Publisher: Grace Wong Project Manager: Beckie Stones Copy Edit Manager: Nicole LeClerc Copy Editor: Lauren Kennedy Assistant Production Director: Kari Brooks-Copony Production Editor: Kelly Winquist Compositor: Dina Quan Proofreader: Nancy Sixsmith Indexer: Broccoli Information Management Artist: Wordstop Interior Designer: Van Winkle Design Group Cover Designer: Kurt Krames Manufacturing Manager: Tom Debolski All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. Printed and bound in the United States of America 9 8 7 6 5 4 3 2 1 Trademarked names may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, we use the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. Distributed to the book trade worldwide by Springer-Verlag New York, Inc., 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax 201-348-4505, e-mail orders-ny@springer-sbm.com, or visit http://www.springeronline.com. For information on translations, please contact Apress directly at 2560 Ninth Street, Suite 219, Berkeley, CA 94710. Phone 510-549-5930, fax 510-549-5939, e-mail info@apress.com, or visit http://www.apress.com. The information in this book is distributed on an “as is” basis, without warranty. Although every precaution has been taken in the preparation of this work, neither the author(s) nor Apress shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indi- rectly by the information contained in this work. The source code for this book is available to readers at http://www.apress.com in the Source Code section. 522xFM.qxd 8/31/05 3:54 PM Page ii www.it-ebooks.info Patty made Lucy while I made this book, and so I give it to them. —dws 522xFM.qxd 8/31/05 3:54 PM Page iii www.it-ebooks.info 522xFM.qxd 8/31/05 3:54 PM Page iv www.it-ebooks.info Contents at a Glance About the Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii About the Technical Reviewers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix PART 1 ■ ■ ■ ASP.NET 2.0 Internals ■CHAPTER 1 Overview of .NET Application Architecture . . . . . . . . . . . . . . . . . . . . . . 3 ■CHAPTER 2 The ASP.NET Request Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 ■CHAPTER 3 Page Object Internals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 ■CHAPTER 4 ViewState and Scripting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 PART 2 ■ ■ ■ .NET Middle Tier Solutions ■CHAPTER 5 .NET 2.0 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 ■CHAPTER 6 SOA in .NET: Web Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 ■CHAPTER 7 Enterprise Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 ■CHAPTER 8 Hosting and Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 ■CHAPTER 9 Windows Communication Foundation . . . . . . . . . . . . . . . . . . . . . . . . . 297 PART 3 ■ ■ ■ Data Access Layer ■CHAPTER 10 Managed Providers of Data Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 ■CHAPTER 11 Data Access Layer Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373 ■CHAPTER 12 Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423 ■INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439 v 522xFM.qxd 8/31/05 3:54 PM Page v www.it-ebooks.info 522xFM.qxd 8/31/05 3:54 PM Page vi www.it-ebooks.info Contents About the Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii About the Technical Reviewers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix PART 1 ■ ■ ■ ASP.NET 2.0 Internals ■CHAPTER 1 Overview of .NET Application Architecture . . . . . . . . . . . . . . . . 3 Nonfunctional Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Vertical Scaling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Horizontal Scaling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Maintainability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Other Nonfunctional Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Service Oriented Architecture/Service Orientation . . . . . . . . . . . . . . . . . . . 15 .NET Application Architectures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 A Simple Managed Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Using Serviced Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 A Widely Distributed Service Application . . . . . . . . . . . . . . . . . . . . . . 23 An Asynchronous Messaging Architecture . . . . . . . . . . . . . . . . . . . . . 26 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 ■CHAPTER 2 The ASP.NET Request Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Application and Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 The HttpApplication Life Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Built-in Framework Extensions to the Pipeline . . . . . . . . . . . . . . . . . 40 Extending the Request Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Inheriting from HttpApplication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Implementing an HttpModule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 vii 522xFM.qxd 8/31/05 3:54 PM Page vii www.it-ebooks.info HTTP Handlers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Handlers Built into the Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Creating an Http Handler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 ■CHAPTER 3 Page Object Internals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Structure of a Web Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Options for Building Web Forms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Code Generation of ASPX Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Code Generation of ASPX Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Compilation and Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Dynamic Compilation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Precompilation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Basics of the Control Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Control Tree Essentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Web Form Event Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Control Events vs. Page Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 The Special Role of the PreRender Event . . . . . . . . . . . . . . . . . . . . . . 90 Resource Consumption when Data Binding . . . . . . . . . . . . . . . . . . . . . . . . 93 Capturing the Rendered Output Stream . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 ■CHAPTER 4 ViewState and Scripting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 The Role of ViewState in ASP.NET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 The ViewState Value . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.0 ViewState Enhancements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Replacing ViewState Persistence . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Post-Cache Substitution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Scripting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Page Support for Scripting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Out-of-Band Callbacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 PART 2 ■ ■ ■ .NET Middle Tier Solutions ■CHAPTER 5 .NET 2.0 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 A Survey of Core Security Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 The Role of Strongly Named Assemblies . . . . . . . . . . . . . . . . . . . . . . . . . . 148 An Example of Round Tripping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Preventing Roundtrip Engineering via Strong Naming . . . . . . . . . . 150 ■CONTENTSviii 522xFM.qxd 8/31/05 3:54 PM Page viii www.it-ebooks.info Encryption Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Understanding Hash Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 Hashing a File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Role-Based Security (RBS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Restricting Access Based On User Identity . . . . . . . . . . . . . . . . . . . . 157 Securing ASP.NET Web Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 Understanding Configuration Inheritance . . . . . . . . . . . . . . . . . . . . . 159 Understanding ASP.NET Authentication Options . . . . . . . . . . . . . . . . . . . . 160 Windows-Based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 Passport-Based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 Forms-Based Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Leveraging the Forms Authentication Model . . . . . . . . . . . . . . . . . . . . . . . 163 Details behind the <authentication> Element . . . . . . . . . . . . . . . . . . . . . 165 Details behind the <forms> Element . . . . . . . . . . . . . . . . . . . . . . . . 166 Cookieless Authentication Support under ASP.NET 2.0 . . . . . . . . . 167 Details behind the <authorization> Element . . . . . . . . . . . . . . . . . . . . . . . 168 Details behind the FormsAuthentication Type . . . . . . . . . . . . . . . . . . . . . . 169 Working with the <credentials> Element . . . . . . . . . . . . . . . . . . . . . 170 Forms Authentication Improvements under ASP.NET 2.0 . . . . . . . . . . . . 171 Understanding the Membership Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 Specifying a Membership Provider for your Website . . . . . . . . . . . 173 Adding New Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 The MembershipUser Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 Updating a User’s Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Deleting a User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Working with the Security Server Controls . . . . . . . . . . . . . . . . . . . . . . . . 178 The Login Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 The LoginStatus Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 The LoginName Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 The PasswordRecovery Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 The ChangePassword Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 The CreateUserWizard Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 Understanding ASP.NET 2.0 Role Membership . . . . . . . . . . . . . . . . . . . . . 186 Enabling Role Membership Services . . . . . . . . . . . . . . . . . . . . . . . . . 187 Understanding the Roles Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 Creating, Obtaining, and Deleting Roles . . . . . . . . . . . . . . . . . . . . . . 189 Assigning Users to Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 Determining Role Membership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 ASP.NET Web Application Administration Tool . . . . . . . . . . . . . . . . . . . . . . 191 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 ■CONTENTS ix 522xFM.qxd 8/31/05 3:54 PM Page ix www.it-ebooks.info [...]... way you can expand your application design toolset today, while at the same time get ready to create the applications of tomorrow www.it-ebooks.info 522xCH01.qxd 8/31/05 3:19 PM PART Page 1 1 ■■■ ASP.NET 2.0 Internals This is a book about distributed application design Here ASP.NET pertains not just to Web Forms and the generation of HTML, but also more broadly to its use as an application server We... distributed application design while showing you the enhancements in xix www.it-ebooks.info 522xFM.qxd xx 8/31/05 3:54 PM Page xx ■INTRODUCTION version 2.0 of the NET Framework in each of the different layers and tiers of these applications This combination is designed to give you a broader understanding of your choices of technologies during application design, while at the same time show you how version 2.0. .. Remoting, even for your own custom application hosting needs By treating ASP NET as an application server instead of as a web application development environment, our field of view is dramatically increased Web Forms become just a single piece of a larger, more complex puzzle, the puzzle of distributed application design This book does not cover the presentation tier of an application While there is some... on application design We simply incorporated the features of 2.0 while doing so You may have already built a full-blown n-tiered application using ASP NET If this is the case, then chances are you can glance through the table of contents and pick out a few technologies that you’ve used in the past This book will round that knowledge out, and enable you to make more informed decisions about how to design. .. And so in designing this book we decided that we did not want to do the standard “new feature march.” This book is not a general introduction to version 2.0 of the ASP NET Framework Instead, this book focuses on designing distributed applications using the NET Framework as your platform With this as our focus, we treat ASP NET not as an environment for the generation of HTML, but rather as an application. .. generation of HTML, but also more broadly to its use as an application server We start by covering some of the things that you must consider when you design a distributed application, and provide some sample distributed application solutions Then we delve into the ASP.NET request-processing pipeline In these chapters you’ll come to understand the lifetime of a request, how to extend the request-processing... bear on the design of a distributed application This chapter is high level, but it sets the stage for the specific technical discussions that follow by taking a look at what influences the decisions you need to make about the technology choices available for a distributed application There are many resources available to help you with specific technologies, in isolation from the rest of your application. .. and between adjoining tiers This is not to say it’s a blueprint for a specific application architecture You have many choices, and many more possibilities when you consider the number of ways you can combine those choices The architecture you design depends on the requirements of your application And believe it or not, all applications are unique The answer to any question when it comes to the architecture... on the application s first iteration Office was not built in a day However, knowing the requirements that will be present in future iterations can be of great benefit during the architectural design phase, as you can take some of these features into account in the solution www.it-ebooks.info 11 522xCH01.qxd 12 8/31/05 3:19 PM Page 12 CHAPTER 1 ■ OVERVIEW OF NET APPLICATION ARCHITECTURE The application. .. the functionality and reach of this vendor application Unfortunately, that group was working with technology flavor of the week “A,” and this new groups is using technology flavor of the week “B.” So the new group goes back to the drawing board, designing a new integration strategy with the vendor-supplied application, in addition to integrating with the web application s own data store, and in the process . Troelsen Tom Barnaby Expert ASP. NET 2. 0 Advanced Application Design 522 xFM.qxd 8/31 /05 3:54 PM Page i www.it-ebooks.info Expert ASP. NET 2. 0 Advanced Application Design Copyright © 20 06 by Dominic Selly,. (Apress, 20 02 ) , and Developer's Workshop to COM and ATL 3 .0 (Wordware Publishing, 20 02 ) . When he has a spare moment, he enjoys re-creating the games he once programmed for his Atari 400 using. environment provided by the .NET Framework version 2. 0 and Visual Studio .NET 20 05 might be the most broadly familiar “new” product ever released. Many features of the .NET Framework version 2. 0 will be very