April 2011 - Posts
Windows Azure is a new platform. Thus many decision makers think that developing application on Windows Azure is too risky. In this post I would like to challenge that.
Windows Azure is an operating for the cloud. It means that Windows Azure deals with abstracting the cloud to your application and storing data in Microsoft's data centers. It has nothing to do with the application itself.
From the application point of view I would like to argue that the application should never know on which platform it is being hosted and who exactly stores its data.
I love Domain Driven Design (DDD). Classes are grouped in domains. An abject does not "know" any other object outside its own domain. Cross domain calls are implemented using interfaces. For example if an "Employee" needs to store some data it calls the nearest IDataStorage implementation. It has no knowledge who exactly is the implementation it is using and it does not care. The IDataStorage knows to store the data. That is all that matters.
When developing Azure applications such abstractions should be used. Behind the abstraction there can be Windows Azure implementations for Azure installations (for example Azure Storage) or on premises implementations such as SQL for traditional installations. An Azure implementation of a Data Access Layer (DAL) must be implemented with deep knowledge of the mechanics of Azure storage services but users of such DAL do not need to know anything about it.
Yet there is one rule that must be enforced throughout the application: Make it stateless.
It means that the core application code should not save state (data that is used between several calls) directly in memory or in the file system. State must be stored by using an abstraction of a state manager. In single instance installations the state manager can use the memory or the file system but in distributed installations (such as Windows Azure) the state manager must store the data in a single location that all instances can reach. Examples can be a distributed cache, Azure storage or a database.
If you write applications that do not abstract their interfaces with Windows Azure the development cycle will be longer because most developers will have to install Azure development SDK and be familiar with the technology. Testing will be more complicated because it is dependent on Windows Azure and it has to test scenarios where the compute and storage emulators do not behave like the real cloud. (There are many)
The outcome is simple: The overall software development risk is high.
If you keep the stateless rule and you abstract all infrastructures (DDD) you can develop applications and have the freedom to decide where to host it. You can use the cloud; you can use a local data center; you can do a hybrid installation. Testing is simple because you are not bound to a particular environment also the development speed is higher because most developers do not need to install anything and know about Azure.
The outcome is simple: The overall software development risk is low.
Azure is not that special. All good software abstracts the infrastructure they use. All distributed systems are designed to be stateless and keep their state in an independent state manager accessible to all instances. It means that if you design your software properly the fact that you want to host it in Windows Azure does not introduce a substantial additional much risk.
Manu
Bookmark is a simple mechanism for asynchronous triggering provided by Workflow 4.0. In a NativeActivity we create a bookmark and wait. In the host (WorkflowApplication) we resume the bookmark and continue execution. I think that the mechanism is too simple. For example: What about timeouts?
Well it is impossible to set a timeout and limit the time the workflow will wait on the bookmark.
I found a solution by creation a custom activity which wraps the activity that owns the bookmark and use a Pick activity to implement the timeout.
Here is the code:
public sealed class ActivityWithBookMark : NativeActivity
{
public string BookmarkName { get; set; }
protected override bool CanInduceIdle
{
get
{
return true;
}
}
protected override void Execute(NativeActivityContext context)
{
context.CreateBookmark(BookmarkName, Callback);
}
private void Callback(NativeActivityContext context, Bookmark bookmark,
object value)
{
// do work ...
}
}
public sealed class BookmarkWrapper : NativeActivity
{
private Pick pick = new Pick();
private PickBranch branch1, branch2;
public TimeSpan Timeout { get; set; }
public InArgument<string> Text { get; set; }
public string BookmarkName { get; set; }
protected override void CacheMetadata(NativeActivityMetadata metadata)
{
branch1 = new PickBranch();
branch2 = new PickBranch();
metadata.AddImplementationChild(pick);
branch1.Trigger = new ActivityWithBookMark()
{ BookmarkName = BookmarkName };
branch2.Trigger = new Delay() { Duration = Timeout };
pick.Branches.Add(branch1);
pick.Branches.Add(branch2);
base.CacheMetadata(metadata);
}
protected override void Execute(NativeActivityContext context)
{
context.ScheduleActivity(pick);
}
}
Hope this helps
Manu
Since the launch of the Microsoft Network (MSN) in 1995, Microsoft has built and hosted a wide variety of services:
- Familiar consumer-oriented services such as the Windows Live Hotmail web-based email service and the Bing search engine
- Enterprise-oriented services such as the Microsoft Dynamics CRM Online business software and the Microsoft Business Productivity Online Standard Suite from Microsoft Online Services
- Many behind-the-scenes services that handle online billing and advertising functions for Microsoft customers.
Microsoft’s Global Foundation Services (GFS) provides the cloud infrastructure for these services, with a focus on adherence to numerous regulatory, statutory, and industry standards. The OSSC team within GFS works with partners and other teams throughout the company to manage security risks to global online services at Microsoft in order to fulfill its mission to provide trustworthy, available online businesses that create a competitive advantage for Microsoft.
All Microsoft data centers are managed according to the following privacy principles:
Accountability in handling personal information within Microsoft and with external vendors and partners
Notice to individuals about how we collect, use, retain, and disclose their personal information
Collection of personal information from individuals only for the purposes identified in the privacy notice have provided
Choice and consent for individuals regarding how we collect, use, and disclose their personal information
Use and retention of personal information in accordance with the privacy notice provide to individuals and the consent that the individuals have provided in return
Disclosure or onward transfer of personal information to vendors and partners only for purposes that are identified in the privacy notice, and in a secure fashion
Quality assurance steps to ensure that personal information in our records is accurate for and relevant to the purposes for which it was collected
Access for individuals who want to inquire about and, when appropriate, review and update personal information they have in our possession
Enhanced security of personal information to help protect against unauthorized access and use
Monitoring and enforcement of compliance with our privacy policies, both internally and with our vendors and partners, along with established processes to address inquiries, complaints, and disputes
Microsoft’s software development teams apply the PD3+C principles, defined in the Security Development Lifecycle (SDL), throughout the company’s development and operational practices:
- Privacy by Design – Microsoft uses this principle in multiple ways during the development, release, and maintenance of applications to ensure that data collected from customers has a specific purpose and that the customer is given appropriate notice in order to enable informed decision-making. When data to be collected is classified as highly sensitive, additional security measures such as encrypting while in transit, at rest, or both may be taken.
- Privacy by Default – Microsoft’s offerings ask customers for permission before collecting or transferring sensitive data. Once authorized, such data is protected by means such as access control lists (ACLs) in combination with identity authentication mechanisms.
- Privacy in Deployment – Microsoft discloses privacy mechanisms to organizational customers as appropriate to allow them to establish appropriate privacy and security policies for their users.
- Communications – Microsoft actively engages the public through publication of privacy policies, white papers, and other documentation pertaining to privacy.
Windows Azure storage is no exception to the policies governing other online services hosted by Microsoft. The software running Windows Azure was developed with privacy in mind under the PD3+C principles defined in the SDL.
Information stored in Microsoft's data center is managed under strict privacy policies and regulations. Microsoft is committed to keeping your privacy and protecting your data. Microsoft also keeps close watch on all of the evolving security standards and regulations in order to continually maintain compliance.
It is not surprising, therefore, that Microsoft’s cloud infrastructure has obtained the Federal Information Security Management Act of 2002 (FISMA)’s Authorization to Operate (ATO), which authorizes US government organizations to store their data in Windows Azure.
For more information: see http://www.microsoft.com/privacy/principles.aspx
http://www.globalfoundationservices.com/security/documents/SecuringtheMSCloudMay09.pdf
http://www.globalfoundationservices.com/security/documents/InformationSecurityMangSysforMSCloudInfrastructure.pdf
Manu
I upgraded my Visual Studio 2010 and installed the new SP1, but then I found that "Add STS Reference" is gone.
The add-in is in place but it does not work.
It took me some time to find the solution:
Run the command:
devenv /ResetAddin Microsoft.IdentityModel.Tools.VS.VSAddin.FederationAddin
Now everything is back to normal.
Hope this will help.
Manu
VM role is currently in CTP. To enable it you should join the beta program through the portal.
It takes about a week to be excepted.
One extra is still required:
If you have not installed the latest version of the Windows Azure Tools (which includes the SDK), please install it from here.
After you have installed the Windows Azure Tools, please run this additional script to enable the VM Role features in the Visual Studio development environment: 32-bit or 64-bit.
A mail with all those these instructions is sent to customers accepted to the programs. For customers who lost the mail I created this post.
Manu