1 Building XML Web Services for the Microsoft .NET Platform by Scott Short ISBN: 0735614067 Microsoft Press © 2002 (426 pages) Understand how to build robust, high-performing business solutions for the Web by exploiting protocols and tools such as SOAP, WSDL, UDDI, and XML. For OR Forum 2 Introduction 10 Whom This Book Is For 10 How This Book Is Organized 10 If You Are in a Hurry 11 System Requirements 11 The Companion CD 12 Support 12 Chapter 1: Why Web Services? 14 Overview 14 Web Services Building Blocks 16 Web Services Design Decisions 17 Choosing Transport Protocols 17 Choosing an Encoding Scheme 18 Choosing a Formatting Convention 18 Choosing Description Mechanisms 19 Choosing Discovery Mechanisms 20 What’s Missing from Web Services? 20 Summary 20 Chapter 2: Creating a Basic Web Service 22 Overview 22 A Simple Commerce Application 22 Creating a Web Form 22 Creating a Payment Web Service 25 Updating the Order Web Form 27 The Web File Share Application 29 Creating the WebFileShare Web Service 29 Creating the WebFileUtil Program 31 Summary 35 Chapter 3: SOAP 37 Overview 37 Anatomy of a SOAP Message 38 SOAP Actors 39 The Header Element 39 The Body Element 42 Using SOAP RPC Messages 44 SOAP Encoding 46 Simple Types 47 Compound Types 47 Passing Parameters by Reference 55 Protocol Binding 61 3 Summary 63 Chapter 4: XML Schema 64 Overview 64 Describing XML Documents 65 Built-In Datatypes 66 Integers 67 Strings 67 Binary Data 68 Namespaces 70 targetNamespace Attribute 70 xmlns Attribute 71 schemaLocation Attribute 73 noNamespaceSchemaLocation Attribute 74 XML Schema and XML Schema Instance Namespaces 74 Element Definitions 75 Custom Datatypes 75 Simple Types 76 Complex Types 81 Element and Attribute Groups 88 Namespace Scoping 89 Polymorphism 91 Restricting Inheritance 95 Summary 97 Chapter 5: Using WSDL to Document Web Services 100 Overview 100 WSDL Document Syntax 100 definitions Element 101 types Element 102 message Element 104 portType Element 106 binding Element 108 service Element 110 Extensibility Elements 111 SOAP Extensions 111 HTTP GET/POST Extensions 115 import Element 121 Documentation 122 The Calculator Web Service WSDL Document 123 Summary 128 Chapter 6: ASP.NET 130 Overview 130 Creating an ASP.NET Web Service 130 4 Transport Protocols and Bindings 136 Web Service Documentation 138 Raising Errors 142 SOAP Encoding Styles 144 Encoding References 147 Interface Inheritance 151 Managing State 155 Session State 156 Application State 160 Defining and Processing SOAP Headers 165 Processing Unknown Headers 172 Using SOAP Extensions 174 SOAP Extension Attributes 174 SOAP Extension Class 175 Using the WSDL Utility to Generate Proxy Code 189 Proxy Class 191 Cookies 200 Summary 201 Chapter 7: XML Serialization 203 Overview 203 Controlling XML Serialization 204 Defining the Root PurchaseOrder Datatype 205 Defining the Items Array 211 Creating Derived Datatypes 216 Creating an Open PurchaseOrder Schema 217 Defining the AcceptPO Web Method 219 Server-Side Validation 220 Implementing Custom Serialization 221 Summary 221 Chapter 8: Using Remoting to Build and Consume Web Services 223 Remoting vs. ASP.NET 223 The Grabber.NET Application 224 Remoting Architecture 225 Creating an IIS-Hosted Web Service 226 Creating a WinForm-Hosted Web Service 231 Accessing Web Services 235 Adding SOAP Headers 241 Generating WSDL 244 Suds WSDL Extension Elements 245 Summary 246 5 Chapter 9: Discovery Mechanisms for Web Services 248 Overview 248 UDDI 248 UDDI Architecture 249 UDDI API 249 UDDI SDK 252 UDDI Enterprise Server 253 Registering the Purchaser 253 Registering the Supplier 269 Visual Studio .NET Integration 275 DISCO 277 Visual Studio .NET and DISCO 277 Summary 280 Chapter 10: Building Secure Web Services 281 An Introduction to Threat Modeling 281 Brainstorming Threats 281 Choosing Techniques to Mitigate the Threats 282 Web Service Security Technologies 285 Web Services Authentication 286 Web Services Authorization 290 Web Services Privacy and Integrity 291 Security Technologies in the .NET Framework 292 Future Web Service Security Technologies 294 Common Security Mistakes 295 Mistake #1: Storing Secret Data Insecurely 295 Mistake #2: Connecting to SQL Server Incorrectly 296 Mistake #3: Building Insecure SQL Strings 296 An In-Depth Example 297 The Insecure Version (Do Not Try This at Home!) 297 A Secure Solution 298 Summary 301 Chapter 11: Debugging Web Services 302 Overview 302 Interactive Debugging 302 The Basics of Debugging 302 Remote Debugging 303 Web Services–Friendly Call Stack 304 Information the Debugger Needs 306 Assembly Metadata 307 Program Database 307 Tracking Information 308 Debugging Dynamically Compiled Source Code 310 6 Instrumenting Web Services 311 Tracing 311 Event Log 321 Performance Counters 322 Tips and Tricks for Debugging 326 Summary 327 Chapter 12: Scalability and Availability 328 Overview 328 Scaling Your Web Service 328 Scaling Up 329 Scaling Out 329 Overcoming Scalability Bottlenecks 333 Maintaining High Availability 333 Highly Available Scale-Up Resources 334 Highly Available Scale-Out Resources 336 Programming Against a Highly Available Resource 336 Third-Party Web Services and Availability 337 Failing Over to an Alternative Web Service 338 Creating an Offline Mode of Operation 342 Optimizing Performance 343 Caching 343 Summary 350 Chapter 13: The Future of Web Services 351 Overview 351 Introducing .NET My Services 351 Securing .NET My Services 353 Working with .NET My Services 355 The Global XML Web Services Architecture (GXA) 358 WS-Inspection 359 WS-Security and WS-License 362 WS-Routing 368 WS-Referral 370 WS-Referral Registration Message Exchange 372 Dynamic Application Topologies 373 Orchestrating Web Services 374 Summary 378 Appendix: XML Schema Built-In Types 380 List of Figures 384 Chapter 10: Building Secure Web Services 384 List of Tables 385 Introduction 385 Chapter 3: SOAP 385 7 Chapter 4: XML Schema 385 Chapter 5: Using WSDL to Document Web Services 385 Chapter 6: ASP.NET 385 Chapter 7: XML Serialization 386 Chapter 8: Using Remoting to Build and Consume Web Services 386 Chapter 9: Discovery Mechanisms for Web Services 386 Chapter 10: Building Secure Web Services 386 Chapter 11: Debugging Web Services 386 Chapter 12: Scalability and Availability 387 List of Sidebars 388 Chapter 10: Building Secure Web Services 388 8 Acknowledgments As with any project of this magnitude, it took a considerable amount of effort from a lot of people to deliver a complete manuscript. I couldn’t ask for a more supportive and loving family. I would like to extend a very special thank you to my wife, Suzanne. Without your support, I never could have completed this book. You supported my decision to write this book even though you were pregnant with our first child when I signed the contracts and you gave birth to our son, Colin Patrick Short, toward the beginning of the project. I would also like to thank my son Colin for being such a good little proofreader as he quietly sat in my lap as I typed, at least for the first 15 to 30 minutes. Now that the book is done, Daddy has much more time to play! I have the unique opport unity to work for Microsoft but still enjoy the sunshine and the great skiing that Colorado has to offer. I would like to thank the Microsoft Rocky Mountain District management team for supporting my efforts. Specifically, I would like to thank Catharine Morris for your creativity in making this happen. Jim Sargent, Larry Shaw, Laura Neff, and Scott Johnson, without your support, this project would never have gotten off the ground. Catharine and Jim, good luck with your new positions at corporate. I miss you both! I work with a very talented group of peers in Colorado and throughout Microsoft. Of those, I would like to thank Michel Barnett and Joe Hildebrand for your peer reviews of the first couple of chapters and Karsten Januszewski for reviewing the Discovery chapter. I would also like to thank Mike Howard and Peter Roxburg. Your contributions to the manuscript directly affected getting this book in the hands of the readers in a timely fashion. Thank you both for reading my nagging e-mails about topics I wanted covered in your material. I would also like to thank the Microsoft Press project team. You guys have been incredibly supportive throughout the entire project. David Clark and I met early on to discuss potential projects. David, thank you for thinking of me when the opportunity to write the Web services title presented itself. Kathleen Atkins was the enforcer. Kathleen, thank you for taking on the unenviable task of ensuring that I didn’t slip the schedule too much. Dail Magee Jr. helped ensure the technical accuracy of the content. Dail, thank you for your colorful commentary in the edited text. I too believe that “the publishing industry went astray when it stopped using scrolls.” Ina Chang had the responsibility of transforming my raw material into prose. Through the course of the project, there were quite a few late nights in which I found myself staring at my computer screen completely exhausted and unmotivated. During these times, I would often fire up my Web browser and look at Jeff Prosise’s Book Blog (http://www.wintellect.com/about/instructors/prosise/blog/ ), his online diary of the book- writing experience. Reading through a couple of entries always seemed to provide motivation to crank out a few more pages. Jeff, thank you for your inspiration as well as taking the time to give me advice now and then. Finally I would also like to thank all of the folks in the product group for their support with this project. You all gave me the best material in the industry to write about. Specifically, I would like to thank Keith Ballinger, Rob Howard, Karsten Januszewski, Angela Mills, Jonathan Hawkins, Peter de Jong, Scott Guthrie, and Oliver Sharp. About the Author Scott Short 9 Scott Short is currently a Senior Consultant with Microsoft Consulting Services. He works with a number of high-tech companies, helping them develop scalable, available, and maintainable e-business applications. He is always interested in working with companies to solve challenging problems, so feel free to contact him at sshort@microsoft.com . Scott has also contributed to a number of books about developing .NET applications and is a frequent speaker at professional developer conferences. Scott’s primary motivation for moving to Colorado was to be closer to the Rocky Mountains. When not glued to his computer, Scott enjoys spending time with his family and friends skiing, backpacking, hiking, and rock climbing. He also loves spending evenings with his wife Suzanne and his son Colin. 10 Introduction You can hardly pick up a technical magazine, developer conference brochure, or corporate IT strategy document without seeing a reference to Web services. So what is all the hype about? Simply put, Web services allow developers to create unrestricted applications— applications that span different operating systems, hardware platforms, and geographic locations. In this book, I explain what Web services are and how you can leverage the Microsoft .NET platform to build and consume them. Whom This Book Is For To get the most out of this book, you should be an experienced programmer. The platform on which you have gained your experience is not important. However, you should have a reasonable handle on object-oriented concepts and basic programming constructs. You should also have some familiarity with basic C# syntax. All examples in this book are written in C#. But even if your primary development language is not C#, the examples are simple enough that you should be able to easily port them to other .NET languages, such as Microsoft Visual Basic. How This Book Is Organized Developers generally fall into two groups: those who like to learn the underpinnings of a technology before they use it, and those who have little concern about what is going on under the hood and feel comfortable using a tool set that abstracts many of the details. I personally fall into the former category and, chances are, if you have purchased a 400-plus page book dedicated to Web services, so do you. Therefore, I’ve decided to take a bottom- up approach to presenting Web services and the support that the .NET platform provides for building and consuming them. It is hard to make sense of the details unless you have a good grounding in how Web services fit into the overall solution, so the first two chapters of the book provide the necessary background. In Chapter 1, I explain the rationale behind Web services. I also present an overview of the underlying protocols and explain how they build on one another to provide an overall solution. Chapter 2 offers a high-level overview of how to use Microsoft Visual Studio .NET to create and consume Web services hosted on the ASP.NET platform. My primary goals in this chapter are to give you an appreciation of how well the ASP.NET runtime abstracts the underlying protocols for the developer and to explain where the protocols come into play in the context of a functioning Web service. In Chapters 3 through 5, I discuss the core underlying Web services protocols in detail— what some might consider too much detail. Frankly, much of the content in these chapters could have gone into the appendix, but unfortunately the limitations of the publishing process prevented me from making such a drastic change to the structure of the book. So you will have to wait until the second edition. Meanwhile, I recommend that you skim those chapters the first time through. As you become more involved with Web services, you can give them a more thorough read. There is no better way to advance your understanding of Web services than to have a deep understanding of the underlying protocols, especially if you need to interoperate with a Web service that is hosted on another platform. [...]... to create the sample applications yourself A Simple Commerce Application You will first create an ASP.NET Web Form that collects and validates credit card information The Web Form allows users to enter their credit card information, and then it informs users whether the information they entered is valid You then move the credit card validation logic into a Web service and modify the Web Form so that... 2 Change the name of the WebForm1 class and its corresponding constructor to Order 3 In the Properties pane, change the name of the label to Status, the text of the label to Please enter your credit card information, the name of the button to PlaceOrder, and the text of the button to Place Order After you adjust the layout and add some additional text, the Web Form should look similar to the following:... Order Web Form so that it calls the CreditCard Web service to validate the user’s credit card You first add a Web reference for the CreditCard Web service to the commerce application by using the Web Reference Wizard You start the wizard by choosing Add Web Reference from the Project menu In the Address text box, enter the URL to the server that hosts your targeted Web service Click on the link to the Payment... Start the Web Reference Wizard by choosing Add Web Reference from the Project menu In the Address text box, enter the URL of the server that hosts the Web service Click on the link to the WebFileShare directory The WebFileShare Web service will automatically be selected, as shown here: 31 Click the Add Reference button Change the name of the new W eb reference listed in Solution Explorer to WebFileShare... you provide the implementation for the Place Order button To add an event handler for the order button, double-click it and write the following code so that when the user clicks the button, the Validate method is called to determine whether the credit card information the user entered is valid The code will also adjust the label’s text to display appropriate text to inform the user whether the credit... decorate the class with the WebMethod attribute and compile the application The WebMethod attribute is the only code required to expose the Validate method on the Web! [WebMethod] public bool Validate(string cardNumber, DateTime expDate) { : } The WebMethod attribute tells the ASP.NET runtime to provide all of the implementation required to expose a method of a class on the Web including the ability... However, the XML response message is not a valid SOAP message There are multiple ways in which an ASP.NET-hosted Web service can be called The Web service will return a well-formed SOAP message only if the request was a SOAP message I will discuss ASP.NET-hosted Web services in detail in Chapter 6 Updating the Order Web Form The next task is to switch back to the Commerce application and update the Order Web. .. Studio NET creates a project on the specified Web server and places template Web application files into that directory Included in these files is a Web Form page named WebForm1.aspx Rename it Order.aspx, and then change the name of the class defined within Order.aspx from WebForm1 to Order by following these steps: 1 Open the Order.aspx code-behind file by right-clicking on the filename in Solution Explorer... enumerations The important thing to realize is that the resulting message is 10 0 percent compliant with the industry-standard SOAP specification Therefore, clients on other platforms, operating systems, or hardware can interact with your WebDirectory Web service Now that you have built the Web service, let’s create a client for retrieving files through the WebFileSystem Web service Creating the WebFileUtil... correspondence to either of the following addresses: Postal Mail: 12 Microsoft Press Attn: Building XML Web Services for the Microsoft NET Platform Editor One Microsoft Way Redmond, WA 98052-6399 E-mail: mspinput @microsoft. com Reference this book within the subject line or body of the e-mail Please note that product support is not available through the preceding addresses For more information about product . Organized 10 If You Are in a Hurry 11 System Requirements 11 The Companion CD 12 Support 12 Chapter 1: Why Web Services? 14 Overview 14 Web Services Building Blocks 16 Web Services Design. Element 10 4 portType Element 10 6 binding Element 10 8 service Element 11 0 Extensibility Elements 11 1 SOAP Extensions 11 1 HTTP GET/POST Extensions 11 5 import Element 12 1 Documentation 12 2 The. Chapter 13 : The Future of Web Services 3 51 Overview 3 51 Introducing .NET My Services 3 51 Securing .NET My Services 353 Working with .NET My Services 355 The Global XML Web Services Architecture