Azure AppFabric WebDay, Porto, Feb. 2, 2010 Pedro Flix ( pedrofelix - PowerPoint PPT Presentation

An introduction to the Azure AppFabric WebDay, Porto, Feb. 2, 2010 Pedro Félix ( pedrofelix em cc.isel .ipl.pt)

Azure AppFabric • Set of services – Service Bus (SB) – Access Control Service (ACS) • Running in the cloud – Based on Windows Azure Platform • Providing – SB : Service Connectivity, Addressability and Discoverability – ACS : Service Access Control 2

A Motivating Scenario • Issue Tracker web app. • Cloud-based CloudTrack • Multi-tenant . View/manage issues Create/view issues Contoso Fabrikam 3

Connectivity challenges CloudTrack . Notify new issue Create new issue Fetch trace data FW, NAT, … FW, NAT, … 4

Challenges • Addressability and discoverability – Private addresses and Network Address Translation (NAT) – Dynamic addresses (e.g. ISP) • Connectivity – Firewalls (denial of inbound connections) – Event distribution – Transient connectivity 5

Service Bus address? outbound inbound 6

Service Bus “All problems in computer science can be solved by another level of indirection” Butler Lampson Service Bus outbound inbound 7

Connectivity and addressability • Relay – Service “listens” on the SB via outbound connection – Client “sends” to the SB – SB relays between client and service sends listens public address Service Bus outbound 8

Naming and discovery • Naming – Service is exposed via a public name – Local DNS binds these public names to IP addresses – Local registry describes available public names DNS Registry sends listens public name Service Bus outbound outbound 9

Naming and discovery • Naming – Public service namespaces – One Azure project – multiple service namespaces – {scheme} :// {namespace} .servicebus.windows.net/ {relpath} • Registry – Mapping between URIs and services – Readable via HTTP+ATOM 10

Buffering • Buffering – One-way messaging – Temporal decoupling sends listens public name outbound outbound 11

Eventing (pub-sub) • Eventing – multicast – One-way messages – Multiple listeners – Message distribution - multicast outbound listens sends listens Service Bus outbound outbound 12

Security • Access Control – Both “listen” and “send” subject to access control – Programmable authorization policy, defined by ACS • Isolation – SB is the DMZ ACS sends listens Service Bus outbound outbound 13

WCF architecture • Channel stack with transport and protocol channels • Channels described by binding elements • One binding contains several binding elements User code Service Impl. Client Dispatcher Protocol Protocol Binding element Protocol Protocol Binding element Encoding Encoding Binding element Transport Transport Binding element Binding 14

WCF and SB • New bindings – New transport channels and binding elements • New behaviors User code Service Impl. Client Dispatcher Protocol Protocol Binding element Protocol Protocol Binding element Encoding Encoding Binding element Service Transport Transport Binding element Bus Binding 15

Bindings • WebHttpRelayBinding – HTTP (Web programming model) – Client interoperability • BasicHttpRelayBinding e WS2007HttpRelayBinding – SOAP over HTTP (basic profile | WS-*) – Client interoperability • NetTcpRelayBinding – Similar to NetTcpBinding (request-response and duplex) • NetOnewayRelayBinding e NetEventRelayBinding – One- way w/buffering and multicast 16

Binding elements • Http(s)RelayTransportBindingElement • TcpRelayTransportBindingElement • RelayedOnewayTransportBindingElement 17

Demo http:// demos-pfelix .servicebus.windows.net/ webday 18

Access Control Service • Identity and access control • Distributed systems – Decentralized authority – Heterogeneous technologies • Claims-based model • SB integration 19

Identity and Authorization Contoso:: Contoso:: webapp:: webapp:: creds Alice LeadDev IssueMgr IssueView 20

Centralized Solution webapp (IssueTracker) Contoso:: Contoso:: webapp:: webapp:: creds Alice LeadDev IssueMgr IssueView Membership Role IPrincipal.IsInRole(...) Provider Provider 21

Decentralized Authority webapp (IssueTracker) Contoso:: Contoso:: webapp:: webapp:: creds Alice LeadDev IssueMgr IssueView Contoso Authority 22

Decentralized Authority Contoso Identity Provider Contoso Identity Provider webapp Contoso:: Contoso:: webapp:: webapp:: creds Alice LeadDev IssueMgr IssueView Identity Directory 23

Decision  Enforcement Contoso webapp Identity Authorization Information Decision Contoso:: Contoso:: webapp:: webapp:: creds Alice LeadDev IssueMgr IssueView Service Service Authorization Authorization Bus webapp:: Enforcement Enforcement SB.Listen 24

Access Control Service Authorization Enforcement Identity Provider Authorization Decision webapp webapp Contoso Access Control Service Access Control Service Contoso:: webapp:: creds LeadDev IssueView Alice SB webapp:: SB.Listen 25

Access Control Service • Claims-based Identity and Access Control • Claims transformer (“claims in, claims out”) – Consumes claims from federated issuers – Provides claims to applications and services • Rule based issuance policy – Rule: If has claim1 then output claim2 • Not an identity provider – Does not manage user’s identities 26

Protocols and technologies • AppFabric 1.0 – OAuth WRAP (Web Resource Authorization Protocol) – Simple Web Token • Future (and past)? – WS-Federation – “passive” (browser based) federation – WS-Trust – “active” (SOAP based) federation – LiveID integration 27

WRAP Identity Authorization Provider Server Bearer Token with Bearer Token with API authorization claims Protected Client Resource 28

WRAP and SWT • Simple Web Token (SWT) – Form encoded name-value pairs – HMAC-SHA-256 symmetric signature • WRAP token request – HTTP POST – username+password or authentication assertion (e.g. SAML) • WRAP protected client call – HTTP header (Authorization: WRAP access_token = “…”) – GET or POST parameter ( wrap_access_token = “…”) 29

Demo Access Control WRAP Service Membership WIF WS-Trust LeadDev username Alice + password SAML Listen Service Bus SWT WIF 30

Finally … • Service Bus – Connectivity – Addressability and discoverability – Eventing – Buffering • Access Control Service – Authorization Decision Point • For Service Bus • For other services, both cloud or on-premises – Flexible claims based policy 31