http://github.com/nanek/redmine_windowsauth

Things that are working fairly well:

• Foursquare API access.
• JSON.NET is used to parse the JSON responses.
• sqlite is used for caching http responses.
• OAuth is used for authentication to foursquare.
• GPS lookup.

Things that don’t work and have proved difficult to implement:

• Responsiveness.  At times the app stops responding and overall feels too slow for normal use.
• Cell ID lookup.  This is important as GPS often does not work indoors.  It appears access to this API may be protected on most phones.
• Good looking user interface.  Plus dealing with different phone resolutions, orientations, and sizes makes it a little more complicated.

Things that would be interesting to implement but require a solid base application:

• Map integration
• Integration with other API’s such as Yelp

You can find the source at http://foursquare.codeplex.com along with a CAB for installation on your phone if you want to try it out.  Look under the planned download section.  It works ok on my HTC Touch Pro.  If you are interested in contributing to this effort, let me know.  I’m debating spending more time on making this work better or building a HTML5 based mobile web application.

I’m sure I missed a bunch.  What do you recommend?

Since I recently started writing a lot more .NET based applications I have come across two useful tools for assisting in providing application security.  Even if you are careful to validate all application inputs, it is still useful to validate your work using these tools.

Anti-XSS – a library that can help sanitize inputs to help protect from cross site scripting attacks.
CAT.NET – a Visual Studio plugin that will do code analysis to help identity cross site scripting and SQL injection vulnerabilities.

It is a good idea to set up security scans has part of your project build steps with a continuous integration server.

A Continuous Integration server can help you automate tasks in your development life cycle.  It will checkout a project from your source code repository, build it, and run any number of additional tasks that you can configure.  For example, it can run unit tests that you have written for your project.  Another example would be to configure StyleCop or FxCop to analyze your source code against various rules.  All of these tasks are completed on a build server automatically and any issues are delivered through the UI, email, or RSS.  This instant feedback loop will make you and your team members spot any issues sooner and make you a better programmer.

Some things that make Hudson in particular stand out:

• It can build .NET and Java applications.
• To get started you just run the jar, or deploy to tomcat.  No db or other configuration to install.  It can even install itself as its own service.
• Lots of plugins.  Plugins that you can install from within the application just like WordPress.
• User interface is simple and clean.
• It just works.

Bottom line, take 10 minutes and check it out.  Let me know if this is not the best Continuous Integration server for Java and .NET.

Take for example Premier support offered by most enterprise software vendors that include claims of 4 hour response times and the like.  If your goal is having someone on the phone, then sure this works ok.  However if you actually want your problem solved, then get ready for a surprise.  Most of the time you are going to have to pull some pretty intense efforts to prove the issue is the vendors problem.  In most of these situations you end up doing all of the leg work which often includes writing the fix or workaround.  In many cases, the vendor boils down to becoming a place for you to file bugs along with their solutions so that you dont have to deal with in the next release.

Upgrades.  Oh don’t get me started.  Enterprise software vendors never sell licenses on how easy it is to install or upgrade their software.  In fact, sometimes I wonder if they don’t intentionally make this process difficult in order to require customers to buy more hours from consulting services.

Lastly, the enterprise product knowledge bases often require you to use the vendors website using customer logins.  This limits who has access and makes searching and contributing to this content difficult if not impossible.

Open Source on the other hand has to have great maintenance and support processes in order to gain any traction and acquire a user base.  WordPress is a great example.  The installation and upgrade process is as simple as it gets.  Searching for any problems or issues is as simple as searching the web.

Like many things in the world, the logical choice is not the first choice due to tradition and fear.  Just keep in mind times are changing, walls are falling, and open source will set you free.

• $500 million dollars invested for each data center
• Half of all Exchange/SharePoint/Dynamic CRM revenue is expected to come from online service in the next 5 years
• Everything is replicated at least 3 times
• Currently runs .NET and C++.  Java/Ruby other languages coming soon
• Visual Studio works with all of the services but is not required, everything is exposed through REST and SOAP
• BizTalk Server 2009 can be used to help manage connections to the cloud
• Declarative Fabric controller handles the deployment and configuration automatically
• Community Tech Preview is currently free.  Service will be live by the end of 2009 with pricing plans

Other Cloud Computing links of interest:

http://www.cloudcamp.com/
http://cloudcomputingexpo.com/
http://videos.visitmix.com/mix09 has videos on all of the sessions including some on the Microsoft Azure platform.

<script type="text/javascript" src="/path/to/jquery-latest.js"></script>
<script type="text/javascript" src="/path/to/jquery.tablesorter.js"></script>

$(document).ready(function()
    {
        $("#myTable").tablesorter();
    }
);

One requirement is that the HTML table must use the THEAD and TBODY tags.  A .NET GridView does not include these tags by default, but they can be added easily enough with the following:

if (this.gridView.Rows.Count > 0)
{
gridView.UseAccessibleHeader = true;
gridView.HeaderRow.TableSection = TableRowSection.TableHeader;
}

Lately I have been doing more .NET development and ultimately at some point you get stuck, forget how to do something, or wonder what the best practices for something is.  You immediately run a few google searches and get back some articles on a bunch of weird answer sites.  Recently a new site for asking questions started with a really good and unique design.  If you have not ran across it already, I highly recommend taking a look.  StackOverflow.com is a mix between wikis, blogs, forums, and digg for programming questions and answers.  Even though it is fairly new, it already has a great community and lots of content.  Many languages and topics are covered even though the community, founders, and the site itself are primarily .NET based.

They also run a great blog and podcast where they talk about the site and how they developed it.  They are off to a great start, and they are looking to start a similar site oriented towards IT Centric version soon.  These guys get it.

Most commonly, you might have a production Active Directory server that a production portal syncs with and a development server that syncs with a development Active Directory server.  Now lets say you migrate your production portal database to your development environment.  There are a number of items you have to fix for it to operate in this new environment.  Take a look at ALUI Administration Tool for Environment Refresh: String Replacing for URLS for more information regarding syncing environments.  For the purpose of this post, we are just concerned about the users and keeping their settings, preferences and security throughout the portal.

In our case, a users Active Directory ObjectGUID is their unique identifier and by definition this is different in each Active Directory server (unless they are in the same domain of course).  So if we just sync with the development Active Directory server, the portal would delete all of the users and then recreate them even though the usernames are the same.  Below are some steps I have successfully used in the past to avoid deleting these users by migrating them to the new authentication source.  Your results may vary, and I do not offer any guarantees so certainly test this procedure thoroughly if you find yourself in a similar situation.

• Backup the database before starting incase something goes wrong.
• Lets assume the existing authentication source id = 201
• Create a temporary authentication source used for migration.  Lets assume its id = 202. 
• Configure both of these authentication source to point to the development Active Directory server.
• Run the sync job only for auth source 202.
• Run the following SQL script which generates another SQL script that will update the settings of users of the 201 auth source in the PTUSERS table to match those of the 202 auth source.

SELECT 'UPDATE PTUSERS SET AUTHUNIQUENAME=''' + AUTHUNIQUENAME
+ ''', DESCRIPTION=''' + DESCRIPTION
+ ''', AUTHUSERNAME=''' + AUTHUSERNAME
+ ''' WHERE MAPPINGAUTHNAME=''' + MAPPINGAUTHNAME
 ''' AND AUTHSOURCEID=201;'
FROM PTUSERS
WHERE AUTHSOURCEID=202;

• Verify the script that it generates escapes any apostrophe characters and then run it.
• Run the following SQL script which generates another SQL script that will update the settings of groups of the 201 auth source in the PTUSERGROUPS table to match those of the 202 auth source. 

SELECT 'UPDATE PTUSERGROUPS SET AUTHUNIQUENAME=''' + AUTHUNIQUENAME
+ ''', DESCRIPTION=''' + DESCRIPTION
+ ''', SYNCHGROUPNAME=''' + SYNCHGROUPNAME
+ ''' WHERE MAPPINGAUTHNAME=''' + MAPPINGAUTHNAME
+ ''' AND AUTHSOURCEID=201;' 
FROM PTUSERGROUPS
WHERE AUTHSOURCEID=202;

• Verify the script that it generates escapes any apostrophe characters and then run it.
• Delete the 202 auth source.
• Run the 201 auth source sync job.
• Verify that users you expected not to be deleted, were not deleted.

The PTUSERS table contains some CRC fields, which are based upon all of the fields in a PTUSER record.  The easiest way to update these CRC values for a user, is to save the user using the portal UI or API.  In the past I have written a script that loops through each user in the authentication source and saves them, thus updating the CRC fields, however I can not find it.  I will leave this part as an exercise for the reader.  Just keep in mind that you will need this before the user will be able to authenticate properly.  Although it does seem like the .NET portal relies on the CRC values more so than the Java portal version.

As a side note, I am using the SyntaxHighlighter Plus wordpress plugin to provide the syntax highlighting.