Posted under ASP.NET, CSS, Themes on August 29th, 2010
I ran into an issue where I need to specify print css for my ASP.NET Application. In general, we specify print style sheet by setting the media attribute to print
<link rel="stylesheet" type="text/css" href="print.css" media="print" />
But in my case I was using ASP.NET Themes where we won’t specify the style sheets in the markup. ASP.NET picks it up automatically from the themes folder. I don’t want to place & link print.css from an another folder. Then I came across a neat trick where we can specify the media type right inside the style sheet as below.
@media print {
body { font-size: 10pt }
}
no comments
Posted under Best Practices, Debugging, Exception handling, Guidance, patterns on May 3rd, 2010
Quoting from Zen Of Python
Errors should never pass silently.
Unless explicitly silenced.
Not many understand the power of logging and exception handling. Logging the right exception details will allow you to inspect the state of an application when the error happened without having a debugger attached. So, exceptions should convey as much information as they can to help you assist the debugging but still should not convey much information to the end user.
I have compiled a list of best practices to be followed for exception handling for .NET but is applicable to any language and this is just a Guidance, not a mandate.
- If an exception can be handled, handle it close to the place of occurrence and log the exception after handling it.
- Unhandled exception should be logged closest to the user to get the full stack trace. Avoid logging the same exception at multiple places in the stack to reduce noise in the logs.
- Log an exception if it is leaving the Application Boundary.
- Never hide an exception. Fail fast and Fail loud.
- Add more data regarding the state of the Application (like inputs, intermediate values, webservice endpoints) by creating a new Exception and assign the original exception as inner exception. Take care not to include any sensitive information like user id and password for connection strings.
- Always use throw instead of throw ex
e.g catch(Exception ex)
{
throw; //Don’t use throw ex;
}
- Have a global trap for all exceptions to log and display a friendly message. Do not expose the exception details to the user. If it has to be, encrypt it and then encode it.
- Handle exceptions only when you know what to do. Avoid using empty catch blocks or catch blocks with just throw.
- Have a global unique identifier which will let you trace the log details across various tiers for the given request, so that exceptions can be correlated.
- Exceptions are costly. Always statically check for errors before performing the action & don’t treat errors as exceptions. E.g Input should be of specific format is an error; while unable to commit changes due to network outage is an exception.
- If you are overriding the ToString() method of an exception class, always log the whole exception class along with InnerException & Stack Trace.
Dear Readers, Please feel free to add your views about Exception handling in the comments.
2 comments
Posted under Identity Management on September 26th, 2009
This is part 2 of the series of post which I am planning to write on Identity Management. If you wish you can read Identity Management – Part 1 – The Basics which gives a brief introduction to Identity management. One of the major part of Identity management is how to simplify the user logging in into the system and thus how to achieve single sign on capabilities in Web. At enterprise level generally it is easy to achieve single sign on as there is only one single Identity provider. But when you want to achieve single sign on between multiple organizations it gets complicated. In this post we would go through “What is federation and federated Identity?” , “What are various ways by which we achieve SSO?”
In the previous post we discussed Identity as an entity which uniquely identifies an object or user. This identity would generally valid and trusted only with in a domain, just like how your company ID card or college ID card is valid only with in your workplace or school.
So, when a system assembles an identity based on the information collected from one or more security domain and is used across security domain the assembled identity becomes a federated identity. The ultimate goal of identity federation is to enable users of one domain to securely access data or systems of another domain seamlessly, and without the need for completely redundant user administration. The setup and standards which enables federated identity is called federation. There are multiple scenarios in federation of an identity which are of significance like cross domain authentication (web based Single sign on) , Cross domain user account provisioning (Managing a user in your domain based on federated identity), cross domain user entitlement and attribute management. We would take a small peek on various ways by which we can achieve web based Single sign on.
- SAML
- Open ID Protocol
What is SAML?
SAML stands for Security Assertion Markup Language. It is a XML based standard used for exchanging the authentication and authorization data between two security domains. SAML defines assertions, protocols, binding and profiles. Assertions are the major information which is carried as a part of SAML response. SAML Protocol denotes the set of rules and regulation by which the Service consumer and Identity provider communicate. SAML binding is mapping between protocol message to the communication formats like SOAP etc. A SAML profile describes how SAML supports a particular use case. The guidelines defined by SAML forms an abstract framework and is denoted as SAML framework.
SAML’s Web SSO profile describes how to set up single sign on using the SAML assertions. Which we will go through in our next part.
What is Open ID protocol?
It is an open decentralized protocol / standard used for authenticating users, allowing users to use single identity across various services / domain. The Open ID protocol uses plain http request and response and is a concrete implementation. It also defines how the user experience should be. In my personal opinion Open ID protocol is the simplest protocol for single sign on but at the same time is also restricted. We would see more about the Open ID protocol in the subsequent posts.
One point to note is in both the cases the real authentication is left to the Identity provider. Identity provider can use Active directory or smart card or bio metrics to perform authentication of the user. These standards define how this identity is shared across two domain and hence there needs to be a trust relation ship between the identity provider and the consumer and various systems which form the federation.
3 comments
Posted under Identity Management on September 20th, 2009
In this series of posts I am going to document about Identity management and corresponding things that I have learnt. This post answers the question “What is Identity?” , “What is authentication?” and what is “Single Sign on?”
Identity is defined as a handle by which you identify someone. For example your name is your identity. your photo can be your identity. In olden days to get access to a place or to verify your identity there used to be a secret code word which is shared between the two parties and once they confirm you by verifying whether you know the code word properly. Later to prove your identity we ID Cards were introduced, which generally carries the name and photo of yourself and is vouched by someone. So, to verify your identity you get challenged to show your ID proof which is signed by an issuing authority. This process of challenging you and verifying your ID is known as Authentication.
In the virtual world, it is more or less the same. You need to have an identity on the online world and when the services where not inter connected every service provider had their own identity management system. This resulted in you having multiple identities. Your Yahoo user name is an Identity of you. Your MSN passport is an identity of you. Your Google user name is an identity of you. All these systems created a separate identity in their respective system and shared a previously agreed secret just like the old days. So, to use the service you have to tell the service provider your identity and also the secret which you have shared before to verify you. There are various ways by which the user ids and passwords are stored and will be discussed in the future posts. This system of sharing a secret and having a ID with every service provider led to lot of confusion as people has to remember their user names in every system.
So, there came the principle of single sign on (SSO). Single sign on is a process by which you use your single identity across various services by entering your user id and password only once. So, when you log into GMail, you can get singed into Google account and use the same account to access other services provided by Google. But SSO didn’t solve all the problem. You cannot log into Yahoo mail using your Google account. To address these kind of problems in web and in enterprise level came the identity management systems. In next part, I would explain about Open ID protocol, how it address the SSO problem across various providers and helps you with one single identity.
Summary
What is Identity?
Identity is a handle or property by which you identify someone. In real world your name is an Identity which is used to identify you. Similarly in Online world, you would have an id and your Google / Yahoo / MSN ids are example of your identity.
What is Authentication?
Authentication is a process by which your identity is verified and confirmed. It could be a shared secret or flashing an ID card signed by an issuing authority.
What is Single Sign On (SSO)?
Single sign on is a concept which will allow you to access various system by authenticating only once.
5 comments
Posted under Application recycle, Asp.net health monitoring, Debugging, Performance monitor on September 8th, 2009
Today, I ran across an issue and thought of documenting it over here. I was implementing a FileDependency based caching scheme and wanted to verify the caching works good. The basic testing by changing the file impacted the application and from functionality perspective everything looked good. But, I wanted to verify the file is not being read for every request. I started by loading the the FileMon to see how frequent the file was being read. To my surprise the file is being accessed on every request.
I thought there was something wrong with my implementation and tried to monitor of an item for which we were already using the File dependency caching and FileMon showed it is also accessed for every new request.
I added the “ASP. NET Applications \ Cache API Entries” and “ASP.NET Applications \ Cache API Turn over rate” counters to the performance monitors and it showed the entries are being reset to 0 and spikes for the turn over rate showing the cache is getting invalidated for every request.
To understand this further I enabled further logging and added a CacheItemRemovedCallback and logged the reason for which the cache item was removed.
I was expecting CacheItemRemovedReason.Expired but, the log showed the items are being deleted from the cache due the CacheItemRemovedReason.Removed. Trusty MSDN Documentation tells
Removed -
The item is removed from the cache by a Remove method call or by an Insert method call that specified the same key.
But in my case, I am not doing an explicit Remove / Insert. I am just using Add. So, added further tracing information to log the stack trace. The stack trace had the below entries
at System.Web.HttpRuntime.Dispose()
at System.Web.HttpRuntime.ReleaseResourcesAndUnloadAppDomain(Object)
That showed the application for some reason is recycling. So, CaheItemRemovedCallback is getting called with Removed as a reason when the application restarts. To confirm this, I loaded the performance monitor (perform.exe) and loaded the “ASP.NET \ Application Restarts” counter The counter kept increasing for every request, showing the Application restart is happening. So, I enabled the application start and application stop event logging by adding the below entry to the web.config. For more information check out the MSDN article
<add name="Application Events" eventName="Application Lifetime Events"
provider="EventLogProvider" profile="Default" minInterval="00:01:00" />
This logged only the application start event but for every request but no application end event. This thrashed my only hope for finding the the reason for application restart. But, when looking at the event logs, for every application start event there is another information logged by a in house event source informing about an Event source registration. So, I re-installed the component causing the event and that stopped the Application from re-cycling.
Application started to respond quickly and also, the performance monitor’s Cache counters showed the cache is maintained.
4 comments
Posted under Feed, RSS on September 8th, 2009
Hi folks, I have RSS Cloud enabled my blog. For all those who are asking what is RSS Cloud, it is just another version of real time web. You can read all my posts at real time, if your feed reader supports it.
For more information on RSS Cloud check out http://www.scripting.com/stories/2009/09/07/teaseTeaseTease.html
Ramesh
no comments
Posted under Microsoft, Search, TweetRank, Twitter on April 12th, 2009
Every one in the tech industry very well know about the Microsoft’s love for Yahoo. But if you look closely its not love for Yahoo, but love for search share. But as long as you don’t have quality results people are not going to try. Yahoo do have better quality compared to Live (I don’t even remember what they are calling it now) search, but there are multiple overlapping products.
So, what I feel is Microsoft should go after twitter which can dramatically improve its search results. Google’s secret sauce for its search result is PageRank. Page rank uses the linking structure to determine the weight of a given page. The higher the weight the more important is the page and hence appears on top of the page.
PageRank relies on the uniquely democratic nature of the web by using its vast link structure as an indicator of an individual page’s value. In essence, Google interprets a link from page A to page B as a vote, by page A, for page B. But, Google looks at more than the sheer volume of votes, or links a page receives; it also analyzes the page that casts the vote. Votes cast by pages that are themselves "important" weigh more heavily and help to make other pages "important". – PageRank
Now, if we slightly modify the parameters used for determining the PageRank and add some real time web into it, we get TweetRank. A Tweet with a link like
geetadayal: This is hilarious: RT @drewvigal Print Media Gets a Lifeline -http://tr.im/iGZJ
, contains valuable information regarding the following
- Link
- Tags / Keywords associated with a link
- The user who recommended it.
And twitter as a system has the below information.
- Number of times the link is tweeted / re-tweeted uniquely by a given user. (These are to be considered as inbound links in page rank)
- The authority of the user who recommended the link (based on the followers, This has to be considered as the authority when some one links to the page)
And all these in real time, can provide valuable data for indexing the web. So, Microsoft don’t let this skip away if you really want to get some search share.
Note: The current Firehose FAQ mentions –
We do not intend to allow anonymous, unregulated public access to this stream for any number of legal, financial, and technical reasons.
So, I don’t think twitter is going to let these valuable information leave the system.
3 comments
Posted under .net, java, patterns on March 7th, 2009
Double Checked Locking (DCL) is commonly used pattern / anti-pattern for creating singleton objects in a multi threaded applications. This is denoted as anti-pattern because the implementation is broken and in versions before Java 1.5. As of JDK5, there is a new Java Memory Model and Thread specification. With respect to .NET its controversial. People suggest to avoid DCL in .NET. But the .net framework itself relies on DCL when instantiating providers.
If you use Reflector and navigate to the Membership / Roles class Initialize method you could see them using the DCL.
So, care must be taken while using the Double-checked locking pattern to ensure safety of your code
no comments
Posted under கிறுக்கல் on September 7th, 2008
தேடல்
இன்னும்மும் தேடுகிறேன், பள்ளி பருவத்துடன்
துலைந்து போன அந்த நிம்மதியான நாட்களை.
Still In search, of those beautiful days
I lost when I was a kid…
1 comment
Posted under General on September 3rd, 2008
The answer for the title is, this blog is will contain things which I come across daily or things, which happened in my life. So, don’t start to think this is going to contain my experiments with technology. I am planning to keep it very minimal. This place will mostly contain my personal experience on various stuffs, people I come across, my views and the lessons I learnt.
Even this blog is an experiment which I am trying in my life. I am working in IT(Information Technology) industry. As most of you will be aware, IT is not an easy money and it has its own pressure and work culture, which I am holding it for another entry. So, as a so called Software Engg. my life is also going at a very fast phase. Atlast I had some time, to think about why all these things happened and I realised, it is like I am running a race against time. I wish, we had a Pause button in life, which would keep everything around still, while we take a deep breath and have time to enjoy, cherish things which are around us like…
இலை மேல் படிந்த பனி துளிகள் (Dew drops on leaf), உறங்கும் குழந்தையின் புன்சிரிப்பு (Smile of sleeping baby), பள்ளி செல்லும் குழந்தைகளின் குதுகலங்கள் (The joy of school going kids), தெரு முனை கோயில்களில் நடக்கும் முதியோர்களின் சந்திப்பு (The discussions between old people in the local temples), பேருந்தில் ஜன்னல் ஓர பயணம் (Busride in a window seat), மல்லிகை பூவின் மணம் (smell of jasmine flowers) போன்றவற்றை மீண்டும் பதிவு செய்ய(to recollect and record) and to get a break from the regular work, I am starting this new experiment.
Looking forward to your critical views, comments and suggestions.
Ramesh
6 comments
