WCF + .NET 2.0

I’ve got an application that is stuck at .NET 2.0 for a while. But I don’t do something to demonstrate WCF is useful, it will be stuck at 2.0 for much longer.

The Use Case: Unit Testing.
WCF opens your application up to more clients. If you think your application has only one client, your wrong, you application should have unit tests and the unit tests constitute a client, in addition to you web forms or windows forms application.

WCF in one Assembly, Business Logic in the Other.
This works fine for the service class. The .svc file is a wrapper around some class that implements an interface with the relevant attributes. I haven’t figured out a way to do this without using a wrapper pattern. However, not so serious a problem because a service is probably going to be designed differently than the underlying business object– probably more stateless for one.

The complex data types used for the data transfer objects are more problematic. The WCF way is to put a [DataContract] attribute on them. This means either putting a wrapper around your data types (i.e. your Customer object, the Order object, etc) or moving the WCF attributes into the business logic class’s assembly. Not possible if I want to leave the business logic tier at .NET 2.0.

Fortunately, .NET 3.5 SP1 supports POCO serialization, i.e. WCF will turn any plain old clr object into xml on the wire. That means you don’t need to put the DataContract attribute on your 2.0 business objects, or wrap the business object in a 3.5 wrapper.

Choice of Host.
If your stuck with .NET 2.0, you’re probably stuck with IIS 5/6 and Server 2000/2003. That means no WAS. So hosting means web services wcf style over http. Unless you write your own host, probably using a windows service.

The sorry state of application security audit logging

Security oriented audit logging records what happened and who did it. So lots of logging frameworks fail because they aren’t very well integrated into the authentication scheme. Ideally, the log entries would non-deniable and read and write-only (i.e. no updates and deletes) by a non-administrator. And super-ideal would be a rich, granular permissions system. For example, NTFS rights are read/write. There isn’t an append-only right for files. And ordinary users need to be able to write to the log. Logging isn’t useful if only the administrator can write a log entry. And ordinary users need to be able to review the log, although not necessarily the same ordinary users that wrote to the log.

This excludes logging techniques where you can write

Log(“I committed a crime”);
DeleteLogs(); //or update logs

Likewise, this should’t happen when running as user John Doe:

Log(“Bill committed a crime”); //Not me!

Windows Event Log.
Requires pinvoke/win32 API calls to record event with user Id.
Can log to Application from ASP.NET with blank user from C#.
You might not even be able to tell which website or application wrote the error log entry.
Looks like it only works with windows authentication, and not custom authentication, e.g. GenericPricincipal.
Only an administrator can create a new log/event source.

Sql Event Log
No user (except SPID) is recorded
Xp_Logevent requires membership in dbo in master, or systeadmin, or explicit rights

EXECUTE master..xp_logevent 50003,’hello world E’, ERROR
RAISERROR (‘hello world from raiserror’, 500000,1) WITH LOG –Requires sysadmin rights to use WITH LOG

IIS Log
Response.AppendToLog(“Action recorded by Austin Powers, really.”);
Has the cs-username field, but it is the service name, not the real user.
For IIS5/6 you need to write an ISAPI filter to hook into the code writing to that log to change cs-username.