“REST Services Security Using the Microsoft .NET Access Control Service”

I like the presentation style. Justin has just explained the scenario they have probably used internally to drive the project and which is a foundation for their business model. I like this kind of openness, in my eyes, it puts commercial software development on the same fairness level than open-source software.

The product itself is not immediately appealing to me. First because it is in Azure, and Azure is way too expensive. I mean, small businesses don’t need the scalability and availabitily it promises (at least, not at this price level), and the big ones like popular social sites would want to invest into own cloud anyway, due to a number of reasons.

The second problem is that it is too much a bare platform. Typical Microsoft way of thinking — we create a platform, and our partners make it meaningful for the end customers. The problem with that approach is that nowadays, in times of open source, “anybody” can create a popular platform, or standard, or protocol. You don’t need to be Microsoft for that. So what’s the value of a bare platform? I could re-implement the main features of ACS in two weeks (excluding AD stuff).

The value of ACS can only be increased by implementing particular integrations that are of value for end customers. Future integration with Facebook, Google, Yahoo and LiveID goes into right direction.

“ADO.NET Data Services: What’s New with the RESTful Data Services Framework”

Great presentation by Pablo Castro, and cool that more and more products and services support OData.

I’m only a little wary about the deep integration with WCF, because using WCF in my typical projects is a major pain in the a$$ due to its over-engineered nature. WCF is perhaps best suited for enterprise intranet and federation scenarios, but not for a really simple internet site. My favorite war story is that when you create a new WCF service in VS2008 under Windows7, and then deploy it to Windows Server 2008, it stops working, because VS2008 uses some configuration parameters that are not available on WS2k8, at least not without additional installation. And to fix it, you have to understand the WCF configuration settings. And to be able to understand WCF configuration, you have to understand all their terms like endpoints, various binding and behaviors, channels, messages, etc — all that stuff I don’t want to know. That’s a lot of unnecessary work if everything you wanted is to expose a trivial REST interface to manage objects in a database.

I only hope the integration of Astoria into WCF would simplify and de-crapify the WCF following the example of Astoria, and not vice virsa. And that they make REST to a first-case citizen in WCF ideology, not just a special case of a weird SOAP like it is now (WCF tracing capabilities of REST, anyone?)

The OData initiative is just great; I believe it is a major step towards a better, HTML-less Internet. The next important steps could be
a) to make Bing to search in Dallas and other public available OData repositories,
b) to extend the format with the possibility to define a standard renderer for the data. Something like an additional url for each entity; and when you open it in the browser, you’ll get an app (be it html or silverlight based) capable of rendering the info contaned in the entity in a user-friendly way,
c) to research the possibility of using OData as a protocol of real-time apps (Twitter, IM)

“Extending Internet Information Services (IIS) 7.x”

I havent’s expected that this session will contain such a fundamental announcement. And it is almost shocking to see how its audience has barely reacted to it.

I’ve met IIS7 since a beta version of Windows Vista and I know about its tight coupling to .NET — something Microsoft prefers to call extensibility. Well, since implementation of the PHP support, I think they have the right to call it so. So writing managed modules isn’t something new to me. Moreover, we could do that for most practical purposes also with IIS6.

What really an important move is that they announce IIS as a (business) platform for web applications.

The Web Platform Installer resembles your typical package/repository infrastructure similar to apt, RPM or other package managers we know from the Linux world. Only it is specific to web apps and its repository is fully controlled my Microsoft. Everyone can submit their web app to the repository, and there is an export tool allowing you to create a package by executing a simple wizard. Typical Microsoft, this export tool is only usable for a very limited set of simple scenarios, but 3rd party ISVs can, as always, write their own tools. I wonder if InstallShield already offers a more powerful tool.

But I digress. In addition to web apps, the new market niche of IIS modules has been created. A module in this sense is a plugin extending IIS with a functionality all web apps running on that IIS can benefit from. Modules can have management UI that nicely integrates into the IIS manager. Typical examples of such modules:
* a failed requests tracker (you can configure it to gather tracing and performance info for requests whose execution took longer than some threshold — very nice!),
* a database manager automatically detecting connection strings from your web app configuration and allowing you to manage the databases directly from within the IIS manager UI,
* a SEO toolkit,
* a load-balancing module called Application Request Routing (I suppose it is something similar to nginx or lighttpd),
* if I’m not mistaken, the Dublin and this appfabric story is also integrated with the IIS manager.

What’s still missing is a geo-location and –blocking module and a health dashboard module.

Generally, IIS slowly evolves from a simple Microsoft’s http server implementation into an operating system for http-based server side applications. Microsoft is constantly emphasizing how important web for their operating system strategy is. I think, the latest development of IIS is a part of this puzzle. I mean, already today, you can export your app from your development server and deploy it to your production server with a couple of clicks (if your app is simple enough). May be, in the future, you will be able to deploy your app into Azure with a couple of clicks, and manage your Azure instances just like another IIS servers. And with integration of database management and workflows facilitating import/export and other background working proceses typical to web sites, you can end up with an ultimate infrastructure and management suite…

We’ll see what future brings.