Tuesday, September 27, 2016

ASP.NET MVC View Model Patterns

Copyright from: stevemichelotti.com
Since MVC has been released I have observed much confusion about how best to construct view models. Sometimes this confusion is not without good reason since there does not seem to be a ton of information out there on best practice recommendations.  Additionally, there is not a "one size fits all" solution that acts as the silver bullet. In this post, I'll describe a few of the main patterns that have emerged and the pros/cons of each. It is important to note that many of these patterns have emerged from people solving real-world issues.
Another key point to recognize is that the question of how best to construct view models is not unique to the MVC framework.  The fact is that even in traditional ASP.NET web forms you have the same issues.  The difference is that historically developers haven't always dealt with it directly in web forms – instead what often happens is that the code-behind files end up as monolithic dumping grounds for code that has no separation of concerns whatsoever and is wiring up view models, performing presentation logic, performing business logic, data access code, and who knows what else.  MVC at least facilitates the developer taking a closer look at how to more elegantly implement Separation of Concerns.
Pattern 1 – Domain model object used directly as the view model
Consider a domain model that looks like this:
?
1
2
3
4
5
6
7
public class Motorcycle 
{
    public string Make { getset; }
    public string Model { getset; }
    public int Year { getset; }
    public string VIN { getset; }
}
When we pass this into the view, it of course allows us to write simple HTML helpers in the style of our choosing:
?
1
2
<%=Html.TextBox("Make") %>
<%=Html.TextBoxFor(m => m.Make) %>
And of course with default model binding we are able to pass that back to the controller when the form is posted:
?
1
public ActionResult Save(Motorcycle motorcycle) 
While this first pattern is simple and clean and elegant, it breaks down fairly quickly for anything but the most trivial views. We are binding directly to our domain model in this instance – this often is not sufficient for fully displaying a view.
Pattern 2 – Dedicated view model that *contains* the domain model object
Staying with the Motorcycle example above, a much more real-world example is that our view needs more than just a Motorcycle object to display properly.  For example, the Make and Model will probably be populated from drop down lists. Therefore, a common pattern is to introduce a view model that acts as a container for all objects that our view requires in order to render properly:
?
1
2
3
4
5
6
public class MotorcycleViewModel 
{
    public Motorcycle Motorcycle { getset; }
    public SelectList MakeList { getset; }
    public SelectList ModelList { getset; }
}
In this instance, the controller is typically responsible for making sure MotorcycleViewModel is correctly populated from the appropriate data in the repositories (e.g., getting the Motorcycle from the database, getting the collections of Makes/Models from the database).  Our Html Helpers change slightly because they refer to Motorcycle.Make rather than Make directly:
?
1
<%=Html.DropDownListFor(m => m.Motorcycle.Make, Model.MakeList) %>
When the form is posted, we are still able to have a strongly-typed Save() method:
?
1
public ActionResult Save([Bind(Prefix = "Motorcycle")]Motorcycle motorcycle) 
Note that in this instance we had to use the Bind attribute designating "Motorcycle" as the prefix to the HTML elements we were interested in (i.e., the ones that made up the Motorcycle object).
This pattern is simple and elegant and appropriate in many situations. However, as views become more complicated, it also starts to break down since there is often an impedance mismatch between domain model objects and view model objects.
Pattern 3 – Dedicated view model that contains a custom view model entity
As views get more complicated it is often difficult to keep the domain model object in sync with concerns of the views.  In keeping with the example above, suppose we had requirements where we need to present the user a checkbox at the end of the screen if they want to add another motorcycle.  When the form is posted, the controller needs to make a determination based on this value to determine which view to show next. The last thing we want to do is to add this property to our domain model since this is strictly a presentation concern. Instead we can create a custom "view model entity" instead of passing the actual Motorcycle domain model object into the view. We'll call it MotorcycleData:
?
1
2
3
4
5
6
7
8
public class MotorcycleData 
{
    public string Make { getset; }
    public string Model { getset; }
    public int Year { getset; }
    public string VIN { getset; }
    public bool AddAdditionalCycle { getset; }
}
This pattern requires more work and it also requires a "mapping" translation layer to map back and forth between the Motorcycle and MotorcycleData objects but it is often well worth the effort as views get more complex.  This pattern is strongly advocated by the authors of MVC in Action (a book a highly recommend).  These ideas are further expanded in a post by Jimmy Bogard (one of the co-authors) in his post How we do MVC – View Models. I strongly recommended reading Bogard's post (there are many interesting comments on that post as well). In it he discusses approaches to handling this pattern including using MVC Action filters andAutoMapper (I also recommend checking out AutoMapper).
Let's continue to build out this pattern without the use of Action filters as an alternative. In real-world scenarios, these view models can get complex fast.  Not only do we need to map the data from Motorcycle to MotorcycleData, but we also might have numerous collections that need to be populated for dropdown lists, etc.  If we put all of this code in the controller, then the controller will quickly end up with a lot of code dedicated just to building the view model which is not desirable as we want to keep our controllers thin. Therefore, we can introduce a "builder" class that is concerned with building the view model.
?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
public class MotorcycleViewModelBuilder 
{
    private IMotorcycleRepository motorcycleRepository;
  
    public MotorcycleViewModelBuilder(IMotorcycleRepository repository)
    {
        this.motorcycleRepository = repository;
    }
  
    public MotorcycleViewModel Build()
    {
        // code here to fully build the view model
        // with methods in the repository
    }
}
This allows our controller code to look something like this:
?
1
2
3
4
5
6
public ActionResult Edit(int id) 
{
    var viewModelBuilder = new MotorcycleViewModelBuilder(this.motorcycleRepository);
    var motorcycleViewModel = viewModelBuilder.Build();
    return this.View();
}
Our views can look pretty much the same as pattern #2 but now we have the comfort of knowing that we're only passing in the data to the view that we need – no more, no less.  When the form is posted back, our controller's Save() method can now look something like this:
?
1
2
3
4
5
6
7
public ActionResult Save([Bind(Prefix = "Motorcycle")]MotorcycleData motorcycleData) 
{
    var mapper = new MotorcycleMapper(motorcycleData);
    Motorcycle motorcycle = mapper.Map();
    this.motorcycleRepository.Save(motorcycle);
    return this.RedirectToAction("Index");
}
Conceptually, this implementation is very similar to Bogard's post but without the AutoMap attribute.  The AutoMap attribute allows us to keep some of this code out of the controller which can be quite nice.  One advantage to not using it is that the code inside the controller class is more obvious and explicit.  Additionally, our builder and mapper classes might need to build the objects from multiple sources and repositories. Internally in our mapper classes, you can still make great use of tools like AutoMapper.
In many complex real-world cases, some variation of pattern #3 is the best choice as it affords the most flexibility to the developer.
Considerations
How do you determine the best approach to take?  Here are some considerations to keep in mind:
Code Re-use – Certainly patterns #1 and #2 lend themselves best to code re-use as you are binding your views directly to your domain model objects. This leads to increased code brevity as mapping layers are not required. However, if your view concerns differ from your domain model (which they often will) options #1 and #2 begin to break down.
Impedance mismatch – Often there is an impedance mismatch between your domain model and the concerns of your view.  In these cases, option #3 gives the most flexibility.
Mapping Layer – If custom view entities are used as in option #3, you must ensure you establish a pattern for a mapping layer. Although this means more code that must be written, it gives the most flexibility and there are libraries available such as AutoMapper that make this easier to implement.
Validation – Although there are many ways to perform validation, one of the most common is to use libraries like Data Annotations. Although typical validations (e.g., required fields, etc.) will probably be the same between your domain models and your views, not all validation will always match.  Additionally, you may not always be in control of your domain models (e.g., in some enterprises the domain models are exposed via services that UI developers simply consume).  So there is a limit to how you can associate validations with those classes.  Yes, you can use a separate "meta data" class to designate validations but this duplicates some code similar to how a view model entity from option #3 would anyway. Therefore, option #3 gives you the absolute most control over UI validation.
Conclusion
The following has been a summary of several of the patterns that have emerged in dealing with view models. Although these have all been in the context of ASP.NET MVC, the problem with how best to deal with view models is also an issue with other frameworks like web forms as well. If you are able to bind directly to domain model in simple cases, that is the simplest and easiest solution. However, as your complexity grows, having distinct view models gives you the most overall flexibility.

ASP.NET MVC Best Practices

Copyright from: www.codeproject.com
The ASP.NET MVC is becoming more and more popular each day.  As the application grows in size so does the maintenance nightmare.  Following are some

Editorial Note

This articles was originally at wiki.asp.net but has now been given a new home on CodeProject. Editing rights for this article has been set at Bronze or above, so please go in and edit and update this article to keep it fresh and relevant.
The ASP.NET MVC is becoming more and more popular each day.  As the application grows in size so does the maintenance nightmare.  Following are some of the better practices, that if followed, may help maintain our application and also provides a means of scalability as the demand increases.  Feel free to add/update practices/tips as required.
 Do note that this checklist are just for quick reference and are not detailed materials and can be used as a quick reference.  
  1. Isolate Controllers
    Isolate the controllers from dependencies on HttpContext, data access classes, configuration, logging etc.  Isolation could be achieved by creating wrapper classes and using an IOC container for passing in these dependencies
  2. IoC ContainerUse an IoC container to manage all external dependencies  The following are some of the wellknown containers/framework.
    1. Ninject
    2. Autofac
    3. StructureMap
    4. Unity Block
    5. Castle Windsor

  3. No "magic strings"
    Never use magic strings in your code. This means hard-coding view names, link text etc. into your views. Frameworks such as T4MVC can help with this.  More to come on this.
  4. Create a ViewModel for each view
    Create a specialized ViewModel for each view.  The role of ViewModel should only be databinding.  It should not contain any presentation logic.
  5. HtmlHelperFor generating view html use HtmlHelper.  If  the current HtmlHelper is not sufficient extend it using extension methods.  This will keep the design in check.
  6. Action Methods
    Decorate your action methods with appropriate verbs like Get or Post as applicable.
  7. Caching
    Decorate your most used action methods with OutputCache attribute.

  8. Controller and Domain logicTry to keep away domain logic from controller.  Controller should only be responsible for
    1. Input validation and sanitization.
    2. Get view related data from the model.
    3. Return the appropriate view or redirect to another appropriate action method.
  9. Use PRG pattern for data modificationPRG stands for Post-Redirect-Get to avoid the classic browser warning when refreshing a page after post.  Whenever you make a POST request, once the request complets do a redirect so that a GET request is fired.  In this way when the user refresh the page, the last GET request will be executed rather than the POST thereby avoiding unnecessary usability issue. It can also prevent the initial request being executed twice, thus avoiding possible duplication issues.

  10. RoutingDesign your routes carefully.  The classic route debugger comes to rescuehttp://haacked.com/archive/2008/03/13/url-routing-debugger.aspx
  11. There should be no domain logic in the views. Views must be, only, responsible for showing the data.
  12. Views should not contain presentation logicViews should not contain any presentation logic.  For e.g. If a "Delete" button is to be displayed only for "Admin" role this should be abstracted away in an Html Helper.  This is just an example and there will be many scenarios which will require this abstraction for easy maintenance of views. 

  13. Use POST for "Delete" links instead of GET
    Using Delete links (GET) is more vulnerable than using POST.  Here is a detailed post on this along with a couple of alternatives.
    http://stephenwalther.com/blog/archive/2009/01/21/asp.net-mvc-tip-46-ndash-donrsquot-use-delete-links-because.aspx

Wednesday, July 15, 2015

Claims Based Authentication in SharePoint 2013, SharePoint 2010 and SharePoint Online

Copyright from: yalla.itgroove.net

What is SharePoint Claims Authentication?

The claims-based identity is an identity model in Microsoft SharePoint that includes features such as authentication across users of Windows-based systems and systems that are not Windows-based, multiple authentication types, stronger real-time authentication, a wider set of principal types, and delegation of user identity between applications.
Claims-based identity is based on the user obtaining a security token that is digitally signed by a commonly trusted identity provider and contains a set of claims. Each claim represents a specific item of data about the user such as his or her name, group memberships, and role on the network. Claims-based authentication is user authentication that utilizes claims-based identity technologies and infrastructure. Applications that support claims-based authentication obtain the security token from the user and use the information within the claims to determine access to resources. No separate query to a directory service like Active Directory is needed.
You check in at the Airport (Authentication)
– present credentials (Passport)
– credentials are validated by security guard
You receive a boarding pass (Signed Claims)
– Seat, Frequent Flyer, Gate etc.
Think of a claim as a piece of identity information (for example, name, e-mail address, age, or membership in the Sales role). The more claims your application receives, the more you know about your user. These are called “claims” rather than “attributes,” as is commonly used in describing enterprise directories, because of the delivery method. In this model, your application does not look up user attributes in a directory. Instead, the user delivers claims to your application, and your application examines them. Each claim is made by an issuer, and you trust the claim only as much as you trust the issuer. For example, you trust a claim made by your company’s domain controller more than you trust a claim made by the user.
Claims-based authentication in Windows is built on Windows Identity Foundation (WIF), which was formerly known as the Security Token Service, or STS. Many areas of SharePoint still refer to the name STS so it’s important to understand that it and WIF are one in the same. The Security Token Service comes pre-baked into the standard SharePoint 2010 install:
The Security Token Service Application in Central Administration:

The Security Token Service Application in IIS:



WIF is a set of .NET Framework classes that is used to implement claims-based identity. Claims-based authentication relies on standards such as WS-FederationWS-Trust, and protocols such as SAML.
Microsoft recommends Claims-based authentication as the preferred provider to use on fresh SharePoint 2010 installs. You can configure this on a per-Web Application basis in SharePoint via the following dialog in Central Admin > Web Applications > Manage Web Applications > Ribbon Bar – New
If you select Classic-Mode Authentication, you configure the Web application to use Windows authentication and the user accounts are treated by SharePoint Server 2010 as Active Directory Domain Services (AD DS) accounts.
If you select Claims-Based Authentication, SharePoint Server automatically changes all user accounts to claims identities, resulting in a claims token for each user. The claims token contains the claims pertaining to the user. Windows accounts are converted into Windows claims. Forms-based membership users are transformed into forms-based authentication claims. Claims that are included in SAML-based tokens can be used by SharePoint. Additionally, SharePoint developers and administrators can augment user tokens with additional claims. For example, Windows user accounts and forms-based accounts can be augmented with additional claims that are used by SharePoint Server 2010.
Claims Based Authentication (Tokens)Classic Mode Authentication
-Windows Authentication: NTLM/Kerberos, Basic-Forms-based Authentication (ASP.NET Membership provider and Role Manager)
-Trusted Identity Providers-Custom Sign-in page
-Windows Authentication (NTLM/Kerberos) only
*Both map authenticated users to the same SPUser object (security principles)

What does Claims look like/feel like?

The core process of Claims is illustrated as follows:

The core currency of Claims is the identity token.
 
EXAMPLE 1:

i:0#.w|contosojsmith
EXAMPLE 2:
i:0#.w|jsmith@contoso.com
i = Identity Claim all other claims will use “c” as opposed to “i”
: = Colon separator
0 = Reserved to support future Claims
#/? = Claim Type Encoded Value. The out of the box claim types will have a hardcoded encoded value, this will enable parity across farms.
E.g. Key: ? Value: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
./0 = Claim Value Type. The out of the box claim value types will have a hardcoded encoded value, this will enable parity across farms.
            E.g. Key: . Value: urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name
            Key: 0 Value: http://www.w3.org/2001/XMLSchema#string –
w/m/r/t/p/s = Original Issuer Type -> w = windows, m = membership, r = role, t = trusted STS, p = personal card, s= local sts claim

Why do I want to use Claims?

1. Decouples Authentication logic from Authorization and Personalization logic – this means speed and flexibility
2. Provides a common way for applications to acquire the identity information the need about users
3. Cloud-ready – lays the foundation to be able to Authenticate against Azure, Facebook, Google, Windows Live ID etc.
4. Federation – Partner networks, business to business, subsidiaries can all interact in the same sphere of authentication, cross machine and cross-farm
5. Supports existing identity infrastructure (Active Directory, LDAP, SQL, WebSSO etc.)
6. Standards-based and interoperable
Bonus Prize:
7. In SP 2010 we can have a single Web Application configured to use multiple authentication types which allows different auth types to be served from one URL:

Claims Gotchas

General issues for all Claims implementations
– Search crawler requires NTLM in the zone it uses
– Office Client Integration (2007 SP2+, 2010 are minimum requirements in order to maintain Client integration e.g. fluid editing of Word Document)
– SharePoint Designer does not support working with Claims Enabled Endpoints for Web Services
Migration issues when moving from Classic to Claims
– When upgrading from Classic to Claims, you will need to migrate users and Test & re-work customizations (Web parts, workflows etc.)
– After you move to Windows claims, you cannot go back to Windows classic. Ensure that you have good backups before you start and try your migration in a lab first before moving into production.
– Existing alerts may not fire, if this occurs the only workaround may be to delete and recreate the alerts
– Search crawl may not function, double-check the web application policies and ensure that the search crawl account shows the new converted account name. If it does not, you must manually create a new policy for the crawl account.
References

Sunday, June 21, 2015

Access is denied: ‘xxx.dll’ – Manually add an assembly (.dll) to the GAC on Windows Server 2008 R2

Copyright from: stepbistep.net

I supposed to post this issue few months ago, but I don’t really know why this has been in my draft folder till this date! When we were migrating our servers to new environment, we deployed some custom web parts manually. While deploying the web part (Drag and drop the assembly (web part .dll) into Global Assembly Cache (GAC) folder) I have got the following wired error message! :(
GAC normally located in C:\Windows\assembly directory, and ‘WebPartStepBiStep.dll‘ is my web part assembly.
After spending some time on the web, I have got the solution here. Actually the ‘User Account Control: run all administrators in Admin Approval Mode’ was Enabled on the Local Security Policy. Which means the local administrators group required Admin Approval Mode (AAM) to perform these kind of operations. Here is the definition for Admin Approval Mode (AAM) from MicroSoft site.
Admin Approval Mode: AAM is a User Account Control (UAC) configuration in which a split user access token is created for an administrator. When an administrator logs on to a Windows Server 2008, the administrator is assigned two separate access tokens. Without AAM, an administrator account receives only one access token, which grants that administrator access to all Windows resources.
To access the Local Security Policy, either we can goto the Administrative Tools –> Local Security Policy OR we can run the secpol.msc’ on the command prompt.
Start –> Administrative Tools –> Local Security Policy
Click Start –> Cmd –> type ‘secpol.msc’ then enter
You will be getting the Local Security Policy window like below and the highlighted is the AAM.
So the solution for our problem is Disabled the User Account Control. To do this double click on the highlighted policy on the Local Security Policy above and then you will be getting this window.
Click Disabled and OK.
After disabling this you will be able to drag and drop the .dll to the GAC.
Please Note:  1. Rebooted required for changes to the local security policy on the server.
2. Disabling this can make security problems in your environment, so after completing task, you should be enabled back the UAC.
That’s all guys, Happy drag and dropping..!
Thanks. R/.
References: