CTU June 2011 - Windows Azure App Fabric
Download as PPTX, PDF0 likes1,525 views
This document provides an overview of Windows Azure AppFabric. It discusses the identity and access control, service bus, and caching services that AppFabric provides. The identity service implements claims-based authentication and uses the Access Control service to integrate single sign-on with multiple identity providers. The service bus enables hybrid cloud applications through a relay that provides secure messaging. Caching improves performance by storing data in memory for low-latency access.
CTU June 2011 - Windows Azure App Fabric
- 1. A Lap AroundWindows Azure AppFabricWely LauMicrosoft MVP, Windows Azure“Cloud” Architect, NCSEmail : wely@ncs.com.sgBlog: http://wely-lau.net/
- 2. AgendaWindows Azure Platform In One SlideWhat is Windows Azure AppFabric?Identity and Access ControlService BusCaching
- 3. “Windows Azure Platform” In One Slide ComputeWeb Role
- 4. Worker Role
- 6. Blobs
- 8. Traffic ManagerReportingDatabaseData SyncAccess ControlService BusCaching
- 9. AgendaWindows Azure Platform In One SlideWhat is Windows Azure AppFabric?Identity and Access ControlService BusCaching
- 10. Motivating ChallengesHow do you expose your software to users outside of your organization?Can they use their existing identities? Social identities?How do you integrate with components outside your corporate network?What about smaller, non-enterprise customers?How do you reduce latency and increase performance?Access ControlService BusCaching
- 11. What is Windows Azure AppFabric?Comprehensive building block services / middleware for developing, deploying, and managing appGoalsExtend .NET technologies to the cloudIncrease developer productivityBridge existing applications to the cloudOpen and accessible service APIREST, SOAP, RSS, AtomPub, …Class libraries for .NET, Java, PHP, Ruby,
- 12. AgendaWindows Azure Platform In One SlideWhat is Windows Azure AppFabric?Identity and Access ControlService BusCaching
- 13. Identity – Stuff to think aboutLogin / Federated LoginAuthenticationAuthorizationUsername & PasswordMembership DatabaseIdentity ProvidersSingle Sign OnTokens & Its FormatSecurity & CertificateAnd the list goes on…
- 14. Single Identity ApproachThe site is the Identity ProviderI have 100s of these identities“island of identity”It’s annoying
- 15. Using a 3rd partyPick a 3rd party, rely on itSomewhat limiting, but a step in the right directionTypically “claim-based”
- 16. Claim-based Identity Term DefinitionsRelying PartyYour application that rely on IdP for authentication and authorizationIdentity Provider (IdP)Third party service that will authenticate your usersEx: GoogleID, WindowsLiveID, Yahoo!, or even your appClaimsA statement that one subject makes about itself or another subject.E.g. : name, email, groups, privilege, etc…Security TokenA piece of token representation of claims that is cryptographically signed by the issuer Security Token Service (STS)A service that issues claims and packages them in encrypted security tokens
- 17. Typical Claims-based App SequenceBrowserIdentity Provider / STSApplication (Relying Party)1. Request Resource2. Redirect to Identity Provider4. Authenticate & Issue Token3. Login5. Redirect to Relying Party7. Validate Token6. Send Token to Relying Party8. Return resource representation
- 18. But… I want more IdP…I want my user, can log-in withChallenges:Deal directly with different IdPDeal directly with different Security Token Format?Deal directly with different ProtocolDeal directly with different …EnterpriseActive Directory
- 19. Access Control ServiceIntegration SSO and centralized auth into your web Hides one layer of abstractionJust to deal with ACS, not with many IdPAccess Control ServiceYour App….ADFS 2.0
- 20. Access Control Website SequenceBrowserIdentity Provider / STSAccess ControlApplication (Relying Party)1. Request Resource2. Redirect to Identity Provider4. Authenticate & Issue Token3. Login5. Redirect to AC service7. Validate Token, Run Rules Engine, Issue Token 6. Send Token to ACS8. Redirect to RP with ACS Token10. Validate Token9. Send ACS Token to Relying Party11. Return resource representation
- 21. Access Control FeaturesIntegrates with Windows Identity Foundation and toolingClaims-based access controlSupport for OAuth WRAP, WS-Trust, and WS-Federation protocolsSupport for the SAML 1.1, SAML 2.0, and Simple Web Token token formatsIntegrated and customizable Home Realm DiscoveryOData-based Management Service to ACS configuration
- 22. demoAccess Control Service- Preparing simple app- Setting up ACS account- Add STS Ref- Security Token Visualizer- Simple Authorization
- 23. AgendaWindows Azure Platform In One SlideWhat is Windows Azure AppFabric?Identity and Access ControlService BusCaching
- 24. Service BusProvides secure messaging and connectivity across different network topologiesEnables hybrid applications that span on-premises and the cloudEnables various communication protocols and patterns for developers to engage in reliable messaging
- 25. … and here’s why this is interesting … Existing code, not designed for the cloud Things you can’t run in the cloud Things you might not want to run in the cloud
- 26. Enabling hybrid applicationsDatacenterPartnerLOB appMobile DeviceLOB web service
- 27. Enabling hybrid applicationsPartnerDatacenterACSLOB appSBMobile DeviceLOB web service
- 28. Enabling hybrid applicationsDatacenterPartnerACSLOB appSBMobile DeviceLOB web service
- 29. Enabling hybrid applicationsDatacenterPartnerACSLOB appSBMobile DeviceLOB web service
- 30. RelayRelay Connectionshttp://{account}.servicebus.windows.net/a/bOutbound SSL TCP connection to relay rendezvous endpointReceiver can also listen overHTTP to overcome port restrictionson the receiving side (“Web sockets”)One-Way Messagesthrough TCP TunnelSenderReceiver
- 31. RelayDirect Connectionshttp://{account}.servicebus.windows.net/a/b- Outbound SSL TCP connection to relay - Out-of-band protocol to negotiate Direct ConnectionSenderReceiverUpgrade to direct connection when possible
- 32. RelayEventing: Publish/Subscribehttp://{account}.servicebus.windows.net/a/bOutbound SSL TCPconnection to relay rendezvous endpointOne-way messagesthrough TCP TunnelSenderReceiverReceiverReceiverReceiver
- 33. Have a Service Listen on the SBListen on SB addressEnable ACS Auth behaviorUse a ‘relay’ binding
- 34. Connect to a Service as a ClientAgain, just use a SB address and bindingUse a behavior to handle ACS authorization
- 35. demoService Bus- Local Svc Hosted on IIS- Exposing WCF to Service Bus- Establishing Direct Connection- Eventing
- 36. AgendaWindows Azure Platform In One SlideWhat is Windows Azure AppFabric?Identity and Access ControlService BusCaching
- 37. Latency PyramidMemoryWindows Azure AppFabric Caching (local cache)Lowest latencyNetworkWindows Azure AppFabric Caching (distributed cache)Lower latencyDiskHighest latencyStorage
- 38. What is the Caching service?A distributed, in-memory cache for applications running in Windows Azure:In-memory cache located near your Windows Azure applicationsSimple administrationBased on Windows Server AppFabricCachingBenefits:Highly scalable 64-bit caching solution with low latency and high throughputCan dynamically increase and decrease as needed, without redeploying or modifying your applicationDoesn’t have to bother with configuration, deployment, or management of their cache infrastructure
- 39. Windows Azure AppFabric Caching DifferentiatorsBuilt-in ASP.NET providers for session state & page outputExtreme low latency with the local cache Caches any managed object (CLR objects, rows, XML, Binary Data…)Only requirement is that the object should be serializableEasily integrates into existing applicationsSecured by the Access Control Service
- 40. Anatomy of A Distributed CacheCache footprint or bandwidth requirement may grow beyond a single VMDistributed caches scale outMultiple role instances may be cache clientsClients access the cache as if it was a single large namespaceUnified Cache ViewCache layer distributes data across the various cache instances
- 41. Caching FeaturesASP.NET providers for session state and page output cachingCache any managed objectNo object size limitsNo serialization costs for local cachingEasily integrates into existing applicationsSecured by Access Control
- 42. Windows Azure Session StateWindows Azure Load Balancer uses round-robin allocation. Session state must persist to client or storage on every requestsession[“foo”] = 1;session[“foo”] = 2;LBWhat is the value of session[“foo”]?
- 43. AppFabric Caching Session StateSession state stored using Windows Azure AppFabric Caching and an out-of-the-box session state providersession[“foo”] = 1;session[“foo”] = 2;LBWhat is the value of session[“foo”]?AppFabric Caching
- 44. demoCaching- Standard data cache API- Measuring data throughput- “built-in” Session Cache Provider
Editor's Notes
- #35: There’s a number of things that I’d like to point out to you before we break into a demo.First, the caching service comes with out-of-the-box ASP.NET providers for both session state and page output caching. This makes it extremely easy to quickly speed up your existing applications by leveraging these providers and updating your web.config files. You can also leverage the local cache, which stores data on the client to speed up access to data retrieved from the Caching service.You can cache any managed object, with no object size limits. Also, when you leverage the local caching option, you won’t pay any serialization costs, as the data will stay on the client. This can make for some extremely fast solutions.You will leverage the exact same APIs you have used with Windows Server AppFabric Caching, which are .NET assemblies. This makes it very easy to get going.The Caching service is secured by the Access Control Service. Through config or at runtime, you simply specific an ACS token that is used for authentication.Finally, as we move towards commercial launch, we’ll add many of the features that make Windows Server AppFabric Caching extremely popular, such as High Availability, which minimizes data loss by persisting the cache, regions for partitioning and co-locating data, the ability to emit notifications to clients when then need to refresh their local cache, and more.
- #38: Slide ObjectiveExplains the operation of Session state in Windows Azure multi instance rolesSpeaking NotesMust move session state off the Web Role instances In this animationFirst request hits one instanceSubsequent request hits another instanceAt the end of the animation the value of Foo is hard to determine.Is it 1, 2 or null?Will depend on which server the LB routes our request toNotes