Reviewed: DXperience & ADO.NET 3.

5 Cookbook

www.aspnetPRO.com

October 2008
Volume 7 Number 10 Solutions for Building Enterprise Web Applications
 ��������������������������������
����������������������������
�������������������������������
����������������������������������������������������������������������������������������
����������������������������������������

���������������������������������
�����������������������������������������������������������������������������
�������������������������������� ���������������������������������������������������
����������� ���������

�������������� �������������
���������������������������������������������������������������������������������������������
��������������������

�����������������������������
�����������������������������������������������������������������������������������
����������������������������������������

������������������������������
��������������������������������������������������������������������������������������
������� ���������������� �����������������������������������������������������������������
����������������

������������������������

����� ����������������������������� ������������������ ������������

������������������������� ��������������������

���������������������������������������������������������������������
�������������������������������������������������������������������������������������������������������������������������������
����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� ���� �������������������������������������������������������������������������������������������������������������������������������������������������������������������������
 In This Issue
October 2008 | Volume 7 Number 10

Columns
�������������������������������������������

14 CoreCoder: Authentication and AJAX

�����������������

���������������
Upgrading your software doesn’t always entail a learning curve: Getting
��������������������������������������������������
credentials and sharing tokens in AJAX is much the same as in classic
������������������

ASP.NET, as Dino Esposito explains.

19 ControlFreak: Process Payments Promptly

Many Web development tasks are much easier to implement than they used to
be. But one that remains relatively laborious is payment processing. Steve C. Orr
provides two free ASP.NET Web controls to easily add e-commerce capabilities to
your Web site.

26 Exploring WCF Web Services: Workflow Services

Michele Leroux Bustamante introduces Workflow Services, then explores
how to expose workflows as WCF services, and how to consume WCF services
from workflows using features introduced with .NET Framework 3.5.

Cover Design by Diana Nishimura

48 BackDraft: Spreading the Word
Microsoft’s dynamic new cross-platform Web development and video stream-
ing technology, Silverlight, stands to play an important role in the future of Web
development. That is, if it catches on. Jonathan Goodyear explains.

Cover Stor y
Feature
8 Custom Criteria
One of the most time-consuming
tasks involved in building any 36 Convention Over Configuration: Part II
Emad Ibrahim wraps up his two-part series on how to create applications
application is the customization using ASP.NET MVC, jQuery, and AJAX.
of the different criteria pages
for the reports. In this article,
Carl Ganz, Jr. illustrates how to Reviews
centralize your reporting criteria
interface into one page and 44 CloserLook: DXperience Universal
DXperience includes components for developing Windows and ASP.NET appli-
cations. Focusing on the components designed for ASP.NET, Anand Naraya-
dynamically create report criteria
pages at run time using defini- naswamy reviews the first build of the 2008 series.
tions stored in a table.

46 BookReport: ADO.NET 3.5 Cookbook

Solving one problem in the middle of a project can often be worth the price of
a book. Find out if Dennis Hayes thinks this is one of those books.

Departments
6 Crossword Puzzle
by Ravi Nangunoori

47 Advertising Index
asp.netPRO Online
Here’s just some of the content that’s available only online at www.aspnetpro.com.
• “Dynamic Data with the Entity Framework in Medium Trust.” Don Kiely provides
workarounds for using Dynamic Data with the Entity Framework in medium trust.
• “Creating XBAP Poppers.” Alvin Bruney shows us how to create XBAP Poppers.
• You’ll also find additional book and product reviews, product announcements, and
more — and only available at www.aspnetpro.com.

2 October 2008 | www.aspnetPRO.com

 ASP.NET Crossword Puzzle
§ By Ravi Nangunoori
22. You must use these files to support multiple
1
languages in a Web application.
23. The Document Object Model used for code
2 3 generation in .NET.

4 5 DOWN
6 1. The keyword used in C# to call a member of
7
the current instance of a class.

8 9 10 3. This event ends when an end user leaves an

ASP.NET-based Web application or closes the
11 12
browser.
13 14
4. This page directive must be added to the top
of an .aspx page to cache the pages in a Web
15 16 application.
6. This utility is used to create UI, properties,
17 18 19 and events for creating custom controls.
9. A text message is displayed to an end user
20
if a control’s validation fails by setting this
property of the Validation control.
21
10. HttpHandlers are classes that implement this
22
interface.
23
12. This Namespace System.Web._____ must be
used to send messages from an application.
14. This provider is required to generate compil-
able code and keep this code in sync with a
source file.
Please see page 47 for answers to this puzzle. Copyright © www.dotnetvideos.net, www.visualsoftinc.com 16. These classes receive output from Debug and
Trace classes.

ACROSS 19. A property of the TextBox server control that

2. One must assign this property of an .aspx
page to change its Master Page at run time.
5. To display a pop-up message box on the client
side in a Web application, one must set to True
this property of the ValidationSummary control.
7. A current selection from a List server control
can be received using this property.
8. One must use this control on a Web form to
group controls.
11. A cleaner and more stringent version of
HTML.
13. The URL property of this class must be set
after instantiating an object of this class in
order to set the URL of a Web service at
run time.
determines whether the text entered in it can
14. These lines of code or conditions will always be displayed as a single line or multiline, or
cause an application to break in the debugger. as a password format.
15. To avoid a first hit delay of a public site built
using ASP.NET, developers employ this process.
17. To uncover Web application-wide problems,
one must set this flag to True in the web.config
file before viewing the trace.axd page in the
browser.
Ravi Nangunoori is a Principal at
18. This represents a disconnected representa- www.visualsoftinc.com and specializes in
tion of data held in memory.
developing Web applications using .NET
20. This Page___ event occurs as the last event technologies. He also runs a multimedia
in the life of the Page object. content site (www.dotnetvideos.net)
21. This window allows one to monitor the values serving the Microsoft developer community
of all the variables of a procedure when a around the world. He can be reached at
program is executing in Debug mode. ravi443@gmail.com.

EDITOR-IN-CHIEF SYSTEMS ADMINISTRATOR P R I N T E D BY S C H U M A N N DISTRIBUTION BY CURTIS

David Riggs .................................................driggs@informant.com Bob Silva PRINTERS, INC. CIRCULATION COMPANY
CONTRIBUTING EDITORS INFORMANT COMMUNICATIONS GROUP MANAGEMENT 701 South Main Street 730 River Road
Jonathan Goodyear and Mike Riley PUBLISHER Fall River, WI 53932 New Milford, NJ 07646
TECHNICAL EDITORS Mitchell Koulouris ................................ mkoulouris@informant.com Phone: 920.484.3348 Phone: 201.634.7400
Ken McNamee and Anand Narayanaswamy CHIEF FINANCIAL OFFICER Fax: 201.634.7497
CONTRIBUTING WRITERS Nancy Nomellini
Michele Leroux Bustamante, Dino Esposito, Carl Ganz, Jr., ADMINISTRATIVE ASSISTANT
Dennis Hayes, Emad Ibrahim, Ravi Nangunoori, and Steve C. Orr Rachel Morgan
ART DIRECTOR Customer Support....................... customerservice@informant.com 5105 Florin-Perkins Road
Diana Nishimura .................................. dnishimura@informant.com Phone .....................................................................916.379.0609 Sacramento, CA 95826-4817
NATIONAL SALES MANAGER Fax .........................................................................916.379.0610 Phone: 916.379.0609
Cathy Sanassarian ...................................... cathys@informant.com Fax: 916.379.0610
www.informant.com

6 October 2008 | www.aspnetPRO.com

 C o v e r S t o r y
LANGUAGES: C# | VB.NET
§ By Carl Ganz, Jr.

Custom Criteria
Customize Data-driven Report Criteria Pages

O
ne of the most time-consuming tasks involved in
building any application is the customization of Column Name Data Type Description

the different criteria pages for the reports. This ReportID Int ID of report to which these criteria
article illustrates how to centralize your reporting criteria controls belong.

interface into one page and dynamically create report cri- ControlName Varchar Name of the control object using ‘txt’,
‘lst’, etc. prefix.
teria pages at run time using definitions stored in a table.
ParameterName Varchar Name of the report parameter to which
the entered value is assigned.
The controls typically required for criteria pages are
Label Varchar Text used to described the control on
text/numeric input boxes, date controls, checkboxes, list-
the Web page.
boxes, and comboboxes. Radio buttons are not necessary
because comboboxes can handle the same choices and Type Tinyint Enumerated value indicating the type of
are much easier to work with when using data-driven control: ComboBox, ListBox, etc.
programming techniques. DataSource Varchar Connection string for data-populated
controls.
As a general rule, date criteria should be set up in a
StoredProc Varchar Name of the stored procedure, the value
“from/to” layout specified by the user as a range. If a user column, and the description column
only needs one day’s worth of information, the “from/to” that populated the control separated by
dates can be set to the same date. If the particular param- semi-colons.
eter truly requires only a single date, then certainly offer DefaultValue Varchar Default value of the control.
the user only one date box. Your validation code should
preclude the user from entering a “from” date that is later Left Int Left position on the Web page.
than the “to” date (and any other such logical inconsis-
Top Int Top position on the Web page.
tencies). Optionally, the “to” date can be defaulted to the
system date as user needs require. Because there’s nor- Width Int Width position on the Web page.
mally very little free-form data you would pass to a report
engine, most of the error checking can occur before the Height Int Height position on the Web page.
user selections are submitted to the reporting tool.
Figure 1: Set the definitions for your criteria controls in a table.
Checkboxes handle Boolean values; textboxes can allow
the user to restrict the output based on free-form text the report could return “Smoot”, “Smith”, “Smythe”, etc.
— a last name, for example. Often you may wish to treat Depending on the flavor of SQL you are using, this can be
all entries in the textbox as partial search criteria. For accomplished by using the LIKE keyword and appending
example, if in filtering by last name the user enters “Sm”, a percent sign to the end of the search value:

8 October 2008 | www.aspnetPRO.com

 ASP.NET ASP WINDOWS FORMS
®
.NET ACTIVEX

N Se nd 3 n X fiel
centralize

EW cti 2 M d
Co

64 fice S W
O te
m

bi O o

VE n br it v sup omp
f M
pl

t a pe rd
e

o b L c
RS eak ersi po ati
IO s ons rt bilit
N
:
your word processing

y
���������� ��� 2 CREATE
print-ready
����������������
PDF documents

�������� �����������������
ê STORE
documents on a
server

7 EDIT

�������������� documents in a
�������������������������
browser

�������
TX Text Control ®
.NET Server 14.0
��� ������

SERVER-SIDE
��������������������������
• Create, modify and convert DOCX, DOC, RTF and HTML documents on a
central server
• Load and save MS Word documents including all merge fields
• Merge templates and create print-ready, password encrypted PDF documents
CLIENT-SIDE
• Edit documents directly in Microsoft Internet Explorer®
• Integrate a fully featured word processing interface, including headers and
footers, text frames, images, decimal tabs, section breaks and many more

© 2008 The Imaging Source Europe GmbH. All rights reserved. TX Text Control is a registered trademark of The Imaging Source Europe GmbH in the United States and/or other countries. All other names of actual companies and
products mentioned herein may be trademarks of their respective owners. Microsoft, Windows and Internet Explorer are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

Download a fully functional trial version at

www.textcontrol.com TX Text Control Sales: 877-462-4772 (toll free)
TX Text Control Europe Sales: +49 (0) 421 3359 0
CoverStory | Custom Criteria

SELECT * Suppose you want to display a

FROM Employees listbox to the user that will allow
WHERE LastName LIKE 'Sm%'
them to select none, one, or multi-
ple items. You can accomplish this
Listboxes provide the most flexible criteria control. Use of a with the following line of code:
listbox implies that the user may select more than one option.
Each listbox should have a button underneath it that allows ShowListBox(szControlName,
the user to clear the choices made. This way if a user wishes to szParameterName,
szLabel,
run a report for both the Human Resources and Manufacturing szDataSource,
departments, it is rather easy to do so. In those cases where szStoredProc, Figure 2: Filter departments.
the user is permitted to select only one out of a set of options, szDefaultValue,
iLeft,
use a combobox. In both cases, each control has two columns. iTop,
The first is invisible to the user and contains the unique ID of iWidth,
the table that contains the filter options. The second column iHeight);

contains the text description the user would recognize.

CheckBoxList controls, specifically, are usually best for
making multiple selections on an individual control.
Though you can certainly accomplish the same thing
with a ListBox control, my experience has been that the
user can easily forget to press the Ctrl key when making
multiple selections and may end up deselecting every-
thing selected so far. This is not a problem with Check-
BoxList controls. ListBox controls are more appropriate
in cases where you need mutually exclusive lists. For
example, when you want two adjacent ListBox controls
so that when the user double-clicks on the first listbox,
the choice is moved to the second, and vice versa. The
reason a CheckBoxList control is not being used here is
because the id values assigned to it through the ListItem
object do not persist client side, and therefore cannot
be retrieved through JavaScript. Microsoft Knowledge
Base article Q309338 (support.microsoft.com/kb/309338)
explains this problem in greater detail. CheckBoxList con-
trols work very well when building a WinForms interface.
This code will display the Web page shown in Figure 2.
The goal is to retrieve the user selections client side only
because you can always pass the values to the server via
hidden controls. Because of the increasing popularity of
asynchronous JavaScript (AJAX), more and more develop-
ers are avoiding full-page postbacks for tasks such as report
generation. By retrieving the user selections client side and
invoking an on-demand reporting Web service asynchro-
nously, you can display the report output with minimal
server traffic. This approach also simplifies the UI code
because we don’t need to maintain state between postbacks.
abstract class ControlManager
{
private string szName;
private Label oLabelControl;
public string Name
{
get { return szName; }
set { szName = value; }
}

Dynamic Criteria Controls public Label LabelControl

{
The data-driven techniques for each of the criteria controls are get { return oLabelControl; }
very similar to one another. Therefore, we’ll examine the code set { oLabelControl = value; }
}
for creating ListBox controls. ListBoxes are the most complex of
}
the controls and, therefore, illustrate every feature.

class ListBoxManager : ControlManager

You can set the definitions for your criteria controls in a {
table. The table structure in Figure 1 shows the data needed private System.Web.UI.WebControls.ListBox oListBoxControl;
to display a criteria screen. Each report will have as many private Button oButtonControl;

rows in the table as it has parameters. public System.Web.UI.WebControls.ListBox ListBoxControl

{
This isn’t a complete list of attributes for the various get { return oListBoxControl; }
set { oListBoxControl = value; }
controls. You also could add a Required column that tells }
the engine to generate the necessary JavaScript to force
public Button ButtonControl
the user to make a selection. Likewise, you could have
{
a JavaScript column that contains a block of JavaScript get { return oButtonControl; }
code that handles validation. You also could have a set { oButtonControl = value; }
}
RegEx column that contains the regular expression that }
formats input; for example, a valid e-mail address or a
masked edit. Figure 3: ControlManager and ListBoxManager classes.

10 October 2008 | www.aspnetPRO.com

 ���������������
������������������������������

��������������������������������������������������������������������������������������������������
����������������������������������������������������������������������������������������������������
����������������

�������������������������������������������
�������������������������������������� ��������������������������������������������
�������������������������� ���������������������������������������
������������������������������������ ����������������
����������������������������� � ������������������������������������������
������ ���������������������������
�
���������������� ������
������
��� ��������������������������������������������������
������
���������������������������������
��������������������������������
����������������������������������
�������������������������������
�������������
������������������������������������������
�����������������������������������
������������
����������������������������������������
����������������������������
������������������������������
�����������������
��������������������

��������������������������������������
�������������������������������������
��������������������������������������
���������������������������������
�������������������������������������

������������������������������������������������������������
��������������������������������������������������������������������
CoverStory | Custom Criteria
private void ShowListBox(string szControlName,
string szParameterName,
string szLabel,
string szDataSource,
string szStoredProc,
string szDefaultValue,
int iLeft,
int iTop,
int iWidth,
int iHeight)
{
ListBoxManager oListBoxManager;
oListBoxManager = new ListBoxManager();
oListBoxManager.Name = szControlName;
oListBoxManager.LabelControl =
AddDynamicLabel(szControlName, iLeft, iTop, szLabel);
oListBoxManager.ListBoxControl =
AddDynamicListBox(szControlName, szDataSource,
szStoredProc, iLeft, iTop + 20, iWidth, iHeight);
oListBoxManager.ButtonControl =
AddDynamicListBoxButton(szControlName, iLeft,
iTop + iHeight + 20, iWidth, 23, szLabel);
} }
Figure 4: The ShowListBox method.
private Label AddDynamicLabel(string szControlName,
int iLeft,
int iTop,
string szCaption)
{ int iHeight,
Label oLabel;
oLabel = new Label();
oLabel.Style["position"] = "absolute";
oLabel.Style["left"] = iLeft.ToString() + "px";
oLabel.Style["top"] = iTop.ToString() + "px";
oLabel.Text = szCaption;
Panel1.Controls.Add(oLabel);
return oLabel;
} oButton.Attributes.Add("onclick",
Figure 5: The AddDynamicLabel method.
The ShowListBox method invokes additional methods that
display the Label, ListBox, and Button objects that make
up the set of controls. These controls are managed in the
classes shown in Figure 3.
Because every control has a name, and almost all have an
associated Label control, these properties are encapsulated
in the ControlManager base class from which the individual
control’s classes, like ListBoxManager and TextBoxManager,
inherit. To display the control, you must pass the control
name to the ShowListBox method (see Figure 4), along with
the data source information, the dimensions of the listbox,
and the caption. ShowListBox instantiates an object of type
ListBoxManager, which receives the instantiated objects of
the Label, ListBox, and Button types.
12 October 2008 | www.aspnetPRO.com
private System.Web.UI.WebControls.ListBox
AddDynamicListBox(string szControlName,
string szDataSource,
string szStoredProc,
int iLeft,
int iTop,
int iWidth,
int iHeight)
{
System.Web.UI.WebControls.ListBox oListBox;
oListBox = new System.Web.UI.WebControls.ListBox();
LoadListBox(oListBox, szDataSource, szStoredProc);
oListBox.ID = szControlName;
oListBox.Style["position"] = "absolute";
oListBox.Style["left"] = iLeft.ToString() + "px";
oListBox.Style["top"] = iTop.ToString() + "px";
oListBox.Style["height"] = iHeight.ToString() + "px";
oListBox.Style["width"] = iWidth.ToString() + "px";
oListBox.BorderStyle = BorderStyle.Solid;
oListBox.SelectionMode = ListSelectionMode.Multiple;
Panel1.Controls.Add(oListBox);
return oListBox;
Figure 6: The AddDynamicListBox method.
private Button AddDynamicListBoxButton(string szControlName,
int iLeft,
int iTop,
int iWidth,
string szCaption)
{
Button oButton;
oButton = new Button();
oButton.Style["position"] = "absolute";
oButton.Style["left"] = iLeft.ToString() + "px";
oButton.Style["top"] = iTop.ToString() + "px";
oButton.Style["width"] = iWidth.ToString() + "px";
oButton.Text = "Clear Selected " + szCaption;
"return DeselectAll('" + szControlName + "')");
Panel1.Controls.Add(oButton);
return oButton;
}
Figure 7: The AddDynamicListBoxButton method.
The AddDynamicLabel method instantiates a Label object
and assigns its location via the Style method (see Figure 5).
The new control is then added to the Controls collection of
the owner Panel object, which displays it to the user.
Likewise, the ListBox control itself is displayed in a similar
fashion, as illustrated in the AddDynamicListBox method
shown in Figure 6. The SelectionMode property is always set
to multiple selections; otherwise, a combobox would suffice.
The szStoredProc parameter contains a semi-colon-delimited
 function DeselectAll(szListBox)
{
var oListBox = document.getElementById(szListBox);
for (i=0; i < oListBox.options.length; i++)
oListBox.options[i].selected = false;
return false;
} DrivenCriteriaScreens directory. You should create a direc-
Figure 8: The DeselectAll method.
function ParseIt(szListBox, bQuotes, bCheckedOnly)
{
var oListBox = document.getElementById(szListBox);
var szResult = new String('');
var szQuotes = '';
var szValue = '';
if (bQuotes)
szQuotes = "'";
for (i=0; i < oListBox.options.length; i++)
{ one control at a time. In the code shown here, the selected
szValue = oListBox.options[i].value;
if (bCheckedOnly)
{ function GetData()
if (oListBox.options[i].selected)
szResult += szQuotes + szValue + szQuotes + ",";
else
szResult += szQuotes + szValue + szQuotes + ",";
if (szResult.length > 0)
szResult = szResult.substring(0, szResult.length - 1);
return szResult;
}
Figure 9: The JavaScript ParseIt function.
Figure 10: Dynamically generated criteria screen.
list of the stored procedure name, the value id, and the dis-
played description. The LoadListBox method will parse this
string into its three components. Using the connection string
supplied by szDataSource, it will connect to the database,
execute the stored procedure, and load the appropriate data
columns into the ListBox control.
The Button control is also created and displayed in a similar
fashion as the Label and ListBox controls, as shown in Figure 7.
The Button control triggers JavaScript code that, when
clicked, must clear the selections in the ListBox with
Notes
When running the sample application, please adjust the
database path on line 638 as needed. In addition, please
adjust the database path in the DataSource column of the
ReportParameters table in the MDB file.
Also, add the Access database inside the C:\Articles\Data-
tory if it doesn’t exist.
which it is associated. The generic JavaScript function
that clears the selected options in the ListBox is shown
in Figure 8. The Button’s onclick event is wired to this
JavaScript function using the Attributes.Add method.
Extracting the User Selections
After the user has completed entering their report criteria,
the Get Data button can generically retrieve the information
departments are retrieved and displayed in an alert box:
{
var szDepartments = "Departments: " +
ParseIt("ListBox6", false, true) + "\n";
alert(szDepartments)
return false;
}
The JavaScript ParseIt function shown in Figure 9 iterates
the ListBox and extracts the data.
The other controls are handled in a fashion similar to the
ListBox. Ultimately, the data definitions will produce the
screen shown in Figure 10.
Using these techniques can dramatically reduce the effort
required to produce and maintain report criteria screens.
By storing the definitions in a database table, you can
easily add new criteria for a report, or provide support for
a brand new report, without releasing another version of
the application. </>
Source code accompanying this article is available for down-
load to asp.netPRO subscribers at www.aspnetPRO.com.
Carl Ganz, Jr. is president of Seton Software Development, Inc.,
a provider of software design and development services located in
Raritan, New Jersey. He has an MBA in Finance from Seton Hall
University and is the author of three books on software development,
as well as dozens of articles on Visual Basic, C#, and Microsoft
.NET technology. He is the president and founder of the New Jersey
Visual Basic User Group and has been a featured speaker at software
development conferences in both the US and Germany. Contact Carl
at seton.software@verizon.net.
asp.netPRO | October 2008 13
 C o r e C o d er
LANGUAGES: C# § ASP.NET VERSIONS: 3.5
Authentication and AJAX
Getting Credentials and Sharing Tokens in AJAX Is
Much the Same as in Classic ASP.NET
B
ecause of the statelessness of the HTTP protocol,
Web applications have a lot to gain from server-
side services that make up for the extreme
simplicity of the protocol. On the other hand, the HTTP
protocol was designed for an idea of the Web quite differ-
ent from the one we have today. Such a simple protocol
was just fine for sharing HTML-based and hyperlinked
documents; it is less than ideal when we actually use
HTML as an application delivery format and claim for
security, state maintenance, and caching. At the end of
the day, though, HTTP is still there — and it forms the
foundation of ASP.NET and AJAX.
To empower Web applications, virtually all server-side run-
time environments build an abstraction layer and provide
additional services to applications, such as session state,
caching, user profiling, and, especially, authentication and
role management.
In ASP.NET, the vast majority of these application services
are incorporated in the runtime pipeline and use the HTTP
module infrastructure. Services intercept pipeline events
and kick in when appropriate. The page developer isn’t
involved in the services activity and passively deals with
the results of the activity itself. What does it mean? For
example, if a profiling service is in place, the page devel-
oper will find profile information for the current user ready
to use. The same goes for the role management service.
But what about authentication, instead?
14 October 2008 | www.aspnetPRO.com
§ By Dino Esposito
Authentication is a key feature in ASP.NET. It ensures
that only recognized users are granted access to a given
resource — be it a page, a folder, or a simple image.
Authentication is implemented through an HTTP module
that intercepts any request to a protected resource and
directs the user to a log-in page first. Are authentication
and other services compatible with ASP.NET AJAX?
How Authentication Works in ASP.NET
In the configuration file in classic ASP.NET, you declare
which resources in which folder are off-limits for the anony-
mous user. At that point, the runtime pipeline automatically
redirects the anonymous user to a log-in page, where the
user is prompted for credentials. Next, if the user is success-
fully authenticated, an authentication token is generated as
a cookie and appended to the response. Finally, the user is
redirected to the originally requested page and passes any
further check because of the attached token. Forms authenti-
cation is the ASP.NET built-in infrastructure that implements
the log-in pattern. Forms authentication requires an addi-
tional log-in page and two HTTP redirect commands. Is it
possible to save one redirect and authenticate the user from
within an HTML page through an AJAX call?
An AJAX Infrastructure for Authentication
For ASP.NET AJAX clients, the infrastructure for authentica-
tion consists of two key components: a client-side JavaScript
class and a system-provided HTTP handler. The same model
is in place for other system services, such as role manage-
ment and user profiles.
The JavaScript class supplies one method to send any user’s
credentials to a server-side endpoint. The HTTP handler

Method Description
login Verifies credentials and issues an authentication ticket if
the credentials are good.
logout Clears the authentication ticket.
Figure 1: Methods of the Sys.Services.AuthenticationService object.
Property Description
isLoggedIn Boolean read-only property; indicates whether the
current user is logged in.
path Gets and sets the URL to reach the authentication
Web service.
timeout Gets and sets the timeout for the user authentication
process.
Figure 2: Properties of the Sys.Services.AuthenticationService object.
internally invokes a system-provided scriptable Web service.
As a result, you receive a Boolean answer that indicates
whether the user has been authenticated or not. The Web
service uses the server-side ASP.NET authentication and
membership API to validate the user information. When you
use a JavaScript proxy to command a remote authentication
service, you check your users more quickly because you
can incorporate a log-in form into any pages in the site that
users visit regularly. The authentication essentially consists
of a request, and doesn’t force a redirect to a specialized
log-in page.
From JavaScript, you invoke a proxy class implemented as a
singleton. The original JavaScript class is instantiated in the
Microsoft AJAX client library and is exposed as an object (as
named here):
var proxy = Sys.Services.AuthenticationService;
The methods offered by the authentication
JavaScript proxy class for ASP.NET AJAX are
listed in Figure 1. Figure 2, instead, details the
properties defined on the object. The underlying
JavaScript class is a regular JavaScript proxy class
nearly identical to any other JavaScript proxy
class that the ScriptManager control generates for
referenced Web and WCF services. The only dif-
ference is that such proxy classes for authentica-
tion, role management, and profile services are
natively part of the Microsoft client library and
downloaded as part of the MicrosoftAjax.js file.
The back-end of the authentication service is
implemented in the AuthenticationWebService
class, marked as sealed and internal. The class
features a script service, as illustrated here:
[ScriptService]
class AuthenticationService
{
// Methods
public AuthenticationService();
[WebMethod]
public bool IsLoggedIn();
[WebMethod]
public bool Login(string userName, string password,
bool createPersistentCookie);
[WebMethod]
public void Logout();
}
Let’s focus on the login method. The first two arguments
set the credentials of the user. When you authenticate a
user through Forms authentication, a cookie is created
and attached to the response. This cookie is referred to
as the authentication cookie and its name defaults to
.ASPXAUTH. The final Boolean argument indicates wheth-
er a persistent cookie is required. If so, authenticated
credentials will be in a persistent cookie saved across
browser sessions.
What about the expiration of the authentication cookie?
The cookie is simply given the expiration that you specify
in the configuration file. So to set the timeout that is
appropriate for your site, you simply set the timeout
attribute in the <authentication> section of the applica-
tion’s web.config file to the desired number of minutes.
You should note that the authentication service sets the
cookie using the SetAuthCookie method on the Forms-
Authentication class. This means that most settings
defined in the <authentication> section of the configura-
tion file are taken into proper account while creating the
authentication ticket.
The Role of Membership Providers
Where would you specify the logic to check credentials? The
AJAX authentication service takes advantage of the currently
registered ASP.NET membership provider. The default mem-
public class CustomMembershipProvider : MembershipProvider
{
public CustomMembershipProvider()
{
}
public override bool ValidateUser(string username, string password)
{
return AuthenticateUser(username, password);
}
private bool AuthenticateUser(string username, string password)
{
// Your authentication logic here
}
// Override all other abstract methods in MembershipProvider
:
}
Figure 3: Skeleton for a custom membership provider.
asp.netPRO | October 2008 15
CoreCoder | Authentication and AJAX

bership provider checks username and

password against the content of the
users table in the aspnetdb.mdf file.
However, both the database schema
and the logic applied are a detail you
can change at will.
If you want to apply an application-
specific piece of logic or reuse an
existing database of users, all you have
to do is create a custom membership
provider. Starting with ASP.NET 2.0,
forms authentication is built atop a
provider-based, extensible model that
lets you easily change the underlying
machinery, such as validation code
and users management, while leaving
the front-end API intact. Based on this
model, you can easily adapt your exist-
ing code to connect to the authentica-
tion machinery of ASP.NET, also from
an AJAX client.
A custom membership provider takes
the form as shown in Figure 3. It is
essentially a class that inherits from
MembershipProvider and overrides
a few members. The key member to
override is ValidateUser. This method
takes a username and password and
returns a Boolean answer. It’s within
this member that you should place
your custom logic for managing a
user’s credentials.
Note also that MembershipProvider is an
abstract class with a long list of mem-
bers to override in any derived class.
The complete list is shown in Figure 4.
public abstract class MembershipProvider : ProviderBase
{
public abstract bool ChangePassword(
string username, string oldPassword, string newPassword);
public abstract bool ChangePasswordQuestionAndAnswer(
string username, string password, string newPasswordQuestion,
string newPasswordAnswer);
public abstract MembershipUser CreateUser(
string username, string password, string email, string passwordQuestion,
string passwordAnswer, bool isApproved, object providerUserKey,
out MembershipCreateStatus status);
public abstract bool DeleteUser(
string username, bool deleteAllRelatedData);
public abstract MembershipUserCollection FindUsersByEmail(
string emailToMatch, int pageIndex, int pageSize, out int totalRecords);
public abstract MembershipUserCollection FindUsersByName(
string usernameToMatch, int pageIndex, int pageSize, out int totalRecords);
public abstract MembershipUserCollection GetAllUsers(
int pageIndex, int pageSize, out int totalRecords);
public abstract int GetNumberOfUsersOnline(
);
public abstract string GetPassword(
string username, string answer);
public abstract MembershipUser GetUser(
object providerUserKey, bool userIsOnline);
public abstract MembershipUser GetUser(
string username, bool userIsOnline);
public abstract string GetUserNameByEmail(
string email);
public abstract string ResetPassword(
string username, string answer);
public abstract bool UnlockUser(
string userName);
public abstract void UpdateUser(
MembershipUser user);
public abstract bool ValidateUser(
string username, string password);
// Properties
public abstract string ApplicationName { get; set; }
public abstract bool EnablePasswordReset { get; }
public abstract bool EnablePasswordRetrieval { get; }
public abstract int MaxInvalidPasswordAttempts { get; }
public abstract int MinRequiredNonAlphanumericCharacters { get; }
public abstract int MinRequiredPasswordLength { get; }
public abstract int PasswordAttemptWindow { get; }
public abstract MembershipPasswordFormat PasswordFormat { get; }
public abstract string PasswordStrengthRegularExpression { get; }
public abstract bool RequiresQuestionAndAnswer { get; }
public abstract bool RequiresUniqueEmail { get; }
}

You are not required to give an effec- Figure 4: Definition of the MembershipProvider class.
tive implementation to each member,
but at the very minimum you should day, this class is a relatively thin wrapper around
throw an exception, as shown here: MembershipProvider that overrides ValidateUser and
throws for any other method. You might seriously consider
public override bool ChangePassword(string username, deriving your custom provider class from this instead of
string oldPassword, string newPassword) MembershipProvider.
{
throw new NotSupportedException();
} Finally, to register the new membership provider, tweak the
web.config file as shown here:
For ASP.NET AJAX, though, there’s a quicker way out you
might want to consider. In the System.Web.ClientServices.- <membership defaultProvider="MyMembershipProvider">
Providers namespace you’ll find the ClientFormsAuthenti- <providers>
cationMembershipProvider class. This class is essentially <add name="MyMembershipProvider"
type="YourNamespace.CustomMembershipProvider" />
an implementation of MembershipProvider that ASP.NET </providers>
AJAX uses to perform default validation. At the end of the </membership>

16 October 2008 | www.aspnetPRO.com

 ��������������
����� ��������������
���������������������
������������� �� ����������������������������

�����������������������������������������������������������������������
�������������������������������������������������������������������������������������������
���������������������������������������������������������������������������

������������������������������ ���������������������������������������������������������������������������
� ���� � ����������������������������������
� ���� � �����������������������������
� ��������������������� � �����������������������
� ��������������� � ����������
� ��������������������� � ������������������
� ���������������������� � �����������������������������������
� ����������������������� � �����������
� ��������������������������������� � ���������������
� ����������
� ������������������������������������
����������������
����� ������ ����� �
� ���������������������
� ��������������������
������� ����� ����� � ���������������� � ������������������
� ������������ � ��������������
���������� ����������� ��������������� � �������� � ��������������������������������
���������������� �������������� �������������� � ������������������������� �����
��������������� ������������ � ���� � ���������������������������
��������� ��������������������������������� � �������������������������������������
�������� ������������ �
�������������������������������
� ��������� �
��������� ��������������� � �������������������������������� � ��������������������������������
��������� � ������� � ����
� ���������������������������� � ���

���������������
���������������������� � ������������ � ������������
CoreCoder | Authentication and AJAX
Add the preceding code to the web.config file under the
<system.web> node and you’re done.
Performing Authentication
Using ASP.NET AJAX authentication requires a bunch of
HTML input tags to collect username, password, and the
optional checkbox for a persistent cookie. You also need a
JavaScript button bound to the following code:
<script type="text/javascript">
var username = $get("Login1_UserName");
var password = $get("Login1_Password");
function Login1_Click()
{ Brief Notes on AJAX Authentication
Sys.Services.AuthenticationService.login(
username.value, password.value, false,
null, null, onLoginCompleted);
return false;
}
: <system.web.extensions>
</script>
The authentication occurs asynchronously; when all is
done, the callback (in this case, onLoginCompleted) is
invoked to give you a chance to update the user interface.
What about the log-out process? To give users a chance
to log out directly from the client, you must add another
100s of FREE
ASP.NET Videos
18 October 2008 | www.aspnetPRO.com
button to your client user interface and bind it to the fol-
lowing JavaScript code:
function Logout1_Click()
{
Sys.Services.AuthenticationService.logout(
onLogoutCompleted);
return false;
}
The function originates a redirect and a full page reload.
The final response doesn’t include any more than the
authentication cookie.
ASP.NET AJAX authentication needs to be explicitly
enabled through a setting in the configuration file:
<scripting>
<webServices>
<authenticationService enabled="true" />
</webServices>
</scripting>
</system.web.extensions>
In ASP.NET, forms authentication always sends credentials
as clear text. This is nothing new, but a reminder is still
useful. For a number of security-related reasons, it is rec-
ommended that log-in forms be placed in pages you reach
through HTTPS. Clear text is not related to AJAX, but
using AJAX for authentication certainly makes it easier for
developers to place log-in forms everywhere.
Another point to keep in mind is that the AJAX authentica-
tion service doesn’t work with applications that use a cook-
ieless authentication scheme.
Conclusion
Forms authentication is the mechanism in ASP.NET applica-
tions that allows you to show a log-in page in front of users
when they attempt to access a protected resource. In classic
ASP.NET, forms authentication is based on a couple of HTTP
redirects. In an ASP.NET AJAX scenario, you can use some
JavaScript code to make at least the log-in process happen in a
smoother way. </>
Dino Esposito is an architect at IDesign and specializes mainly
in ASP.NET, AJAX, and RIA solutions. Dino is the author of
Programming ASP.NET 3.5 Core Reference (Microsoft Press, 2008).
He also wrote Introducing ASP.NET AJAX, also for Microsoft Press.
Late-breaking news is available at weblogs.asp.net/despos.
 C o n t r o l Fre ak
LANGUAGES: VB.NET | C# § ASP.NET VERSIONS: 2.0+
§ By Steve C. Orr

Process Payments Promptly

Use Free PayPal-compatible Web Controls to Add E-Commerce
Capabilities to Your Web Site

O
ver the years, many Web development tasks have
become easier to implement. For example, HTML
is generated with drag and drop simplicity, basic
state management is now virtually automatic, and user
profile data management is nearly as simple as getting and
setting variables.
One thing that remains relatively laborious, however, is
payment processing. In an attempt to quench the thirst
for simpler e-commerce capabilities, I’ve assembled two
ASP.NET Web controls that will empower any user to
donate money or buy a basic product or service from
your Web site.
Present Purchases
The BuyNow control has a nearly identical design and
a similar one-button user interface. It is intended to be
associated with a specific product or service so users may
purchase it. Like the donation control, the user’s initial
button click leads them through PayPal’s intuitive pay-
ment processing system. When the transaction is com-
plete, PayPal provides multiple options for transferring the
flow back to your Web site and allowing your Web site to
verify the completed payment.
The default user interface of the Buy Figure 2: The Buy
Now button is shown in Figure 2. An Now button allows
alternative button image may be speci- a user to purchase
a particular product
fied by adjusting the ImageUrl property.
or service.

In the following paragraphs I’ll show you how easy it is to
use these controls from an ASP.NET application. Following
that, I’ll show you how the controls were designed so you
can extend them or learn how to make similar Web controls.
Accept Donations
The Donate control allows users to give money in a simple
and intuitive way. When the user clicks it at run time, they are
led through PayPal’s payment system that accepts credit card
payments and other common payment options. End users do
not necessarily need to be PayPal members, but Web sites will
need a basic account with PayPal in order to accept such pay-
ments. Setting up a PayPal account is free, although they typi-
cally take a small specified amount from each transaction as
their fee. When the transaction is complete, users are option-
ally redirected automatically back into
the specified flow of your Web site.
Common Properties
The two controls present slightly different user interfaces
to the user, but they share the same set of public proper-
ties. Some of the properties are likely more relevant for the
Buy Now button than the Donate button, but all the prop-
erties can be useful for both controls in certain situations.
If you’re familiar with the standard ASP.NET ImageButton
control, you’ll find most of the properties to be familiar
because both controls ultimately inherit from it. Here I’ll
cover the unique properties the controls offer (see Figure 3).
Perhaps the most important property is the BusinessEmail
string. This must be set to the e-mail address associated
with your registered PayPal account. If this property is
not set correctly, you will not receive payments that were
intended for you.

The default user interface of the Donate
button is shown in Figure 1. An alter-
native button image may be specified
by adjusting the ImageUrl property.
Figure 1: The Donate The Price property is also of notable functionality. For
control provides a
simple and familiar way
the Buy Now button you’ll almost certainly want to set
for users to contribute this property to the amount of the associated product or
to your cause. service. For the Donate button, you might choose to leave

asp.netPRO | October 2008 19

ControlFreak | Process Payments Promptly

The ItemName property should be filled with the name of the

Value
Property Description product or service with which the Buy Now button is associ-
Type
ated. PayPal presents this name to the user so they can rest
SuccessReturnUrl String The public URL to which PayPal assured they are purchasing the correct item. This property is
should return the user upon clearly optional for the Donate button, although you might (in
successful payment.
some cases) choose to associate a donation with a particular
FailReturnUrl String The public URL to which PayPal item of some sort. If the ItemName property value is omit-
should return the user upon ted, PayPal typically allows the user to enter a free-form item
aborted payment.
name with which their payment is associated.
NotifyUrl String The URL to which PayPal posts
information about the transaction Similarly, the ItemNumber property can be filled with any
via Instant Payment Notification. custom identifier that you may have associated with the
Must be URL-encoded.
specified product or service. This passthrough variable is
BusinessEmail String The registered e-mail address of never shown to the user, but is saved along with the trans-
your PayPal account. action to help identify what was purchased. Taking this con-
CustomData String Passthrough variable never presented cept one step further, the Invoice and CustomData properties
to the customer. May be useful for also can be filled with personalized passthrough identifiers
associating custom state or identifier of some sort to help identify particular purchases.
data with the transaction.

Invoice String Passthrough variable you can use to The Boolean RequireNote property can be set to true to
identify your invoice number for this force users to include a note along with their payment. The
purchase. default value of this property is false.
ItemName String Description of item. If omitted,
customers can enter an item name You can avoid having to manually collect shipping address
at time of purchase. information for purchases that must be physically shipped to
ItemNumber String Passthrough variable for you to track
a user simply by setting the Boolean RequireShippingAddress
purchases or donations, passed property to true. This will prompt PayPal to collect the ship-
back to you at payment completion. ping address information, thus simplifying your own input
requirements.
CurrencyCode String Defines the currency of the payment.
Default is USD.
Transaction Complete
Price Single The required payment amount. If you want the user to return to the flow of your Web site
(Leave blank to allow the user to
after they’ve completed their interaction with PayPal, you
choose the payment amount.)
must set the SuccessReturnUrl and FailReturnUrl properties.
PostReturn Boolean Return method GET or POST: the The SuccessReturnUrl property should be set to the absolute
FORM METHOD used to send data
public Web address of the page intended to accept the user
to the URL specified by the return
variable after payment completion. back into your site. If the user cancels out of the PayPal trans-
Default: false. action, the FailReturnUrl page accepts the redirection instead.

RequireShippingAddress Boolean Prompts customer for a shipping

All these transaction variables will be posted to the
address. Default: false.
above specified ReturnUrl if the Boolean PostReturn
RequireNote Boolean Prompts customer to include a note property is set to true. This allows the page to potentially
with payment. Default: false. contain custom logic to recognize the incoming transaction
data and respond intelligently to the success or failure of
Figure 3: These are the unique public properties of the Donate and that transaction. For example, a custom function could be
BuyNow controls. called to order the shipment of the product associated with a
successful transaction. The relevant form variables are docu-
this property value unspecified. In either case, if the prop- mented on PayPal’s Web site at https://www.paypal.com/
erty is left blank, PayPal will prompt the user to specify IntegrationCenter/ic_std-variable-ref-buy-now.html.
their desired payment amount.
However, instead of blindly trusting any data claiming to be
The CurrencyCode property is only relevant when the price from PayPal that is posted to this page, you might want to
property has been set. The default currency code is USD, take a more secure approach by verifying the data with one
which specifies that the Price property contains a United of PayPal’s other payment notification services. These services
States Dollar amount. Any other standard currency code can also can be useful if you choose to leave the PostReturn prop-
be specified for this property value. erty at its default value of false.

20 October 2008 | www.aspnetPRO.com

ControlFreak | Process Payments Promptly
'(requires reference to System.Design)
<Editor(GetType(System.Web.UI.Design.UrlEditor), _
GetType(System.Drawing.Design.UITypeEditor)), _
Bindable(True), Category("Behavior"), _
DefaultValue(""), Localizable(True)> _
Property SuccessReturnUrl() As String
Get
Dim s As String = CStr(ViewState("SuccessReturnUrl"))
If s Is Nothing Then
Return String.Empty
Else
Return s
End If
End Get
Set(ByVal Value As String)
ViewState("SuccessReturnUrl") = Value
End Set
End Property
Figure 4: This is an example of one of the properties from the
aspaypal_base class.
Figure 5: Visual Studio’s Select URL dialog box.
For example, their Instant Payment Notification System
(IPN) can post a special message to your server when a
transaction has been successfully completed. The Notify-
Url property of the controls can be used to specify the full
public Web address of the page that accepts such messages.
This and other types of automated and manual PayPal verifi-
cation systems are documented at https://www.paypal.com/
IntegrationCenter/ic_button-encryption.html.
How It Works
Because the Donate and Buy Now buttons have such a similar
design, it makes sense to have them inherit from the same
base class. This technique maximizes code reuse and reduces
maintenance. The custom abstract base class from which both
controls are inherited is named aspaypal_base. It, in turn,
inherits from the standard ASP.NET ImageButton Web control.
The aspaypal_base class primarily collects the previously
noted properties and renders them into the page as hidden
form fields that are recognized by PayPal. It then posts these
values into PayPal’s payment processing system. This requires
a few hundred lines of fairly boilerplate code, examples of
which are listed in Figure 4 and Listing One (on page 23).
22 October 2008 | www.aspnetPRO.com
Imports System.ComponentModel
Imports System.Web.UI
<DefaultProperty("Price"), _
ToolboxData("<{0}:Donate runat=server></{0}:Donate>")> _
Public Class Donate
Inherits aspaypal_base
Protected Overrides Sub OnInit(ByVal e As System.EventArgs)
MyBase.OnInit(e)
Dim u As String
u = "http://www.paypal.com/en_US/i/btn/btn_donate_LG.gif"
Me.ImageUrl = u
Me.cmd = "_donations"
End Sub
End Class
Figure 6: This is the complete code for the Donate class found in
the file Donate.vb.
Imports System.ComponentModel
Imports System.Web.UI
<DefaultProperty("Price"), _
ToolboxData("<{0}:BuyNow runat=server></{0}:BuyNow>")> _
Public Class BuyNow
Inherits aspaypal_base
Protected Overrides Sub OnInit(ByVal e As System.EventArgs)
MyBase.OnInit(e)
Dim u As String
u = "http://www.paypal.com/en_US/i/btn/btn_buynow_LG.gif"
Me.ImageUrl = u
Me.cmd = "_xclick"
End Sub
End Class
Figure 7: This is the complete code for the BuyNow class found in
the file BuyNow.vb.
The SuccessReturnUrl property listed in Figure 4 is a little
more interesting than most of the other properties because it
is decorated with the Editor attribute. This design-time feature
tells Visual Studio to show the ellipsis (...) button in the prop-
erties window for this property. When clicked, the standard
Visual Studio Select URL dialog box appears (see Figure 5).
Listing One lists the aspaypal_base class’ internal CreateHidden-
Fields subroutine, which is called from the Render method.
The actual Donate and BuyNow controls (listed in Figures 6
and 7, respectively) contain very little code, because most of
the functionality is implemented via inheritance.
As you can see by the code listings in Figures 6 and 7,
the controls differ only by a couple properties that have
distinctive default values set in their initialize events. The
underlying ImageButton’s ImageUrl property is assigned
a standard button image from PayPal’s site. Additionally,
the custom cmd property is set to a value that reflects the
button’s type to PayPal’s Web site.
Conclusion
Payment processing no longer needs to be an ominous If Me.Price > 0 Then
development chore. By dropping one of these free controls h = New HiddenField()
h.ID = "amount"
on a Web page, basic e-commerce functionality can be h.Value = Me.Price
enabled simply by setting a property or two. You’ve seen h.RenderControl(writer)
how easy it is to use these controls, examined their proper- End If

ties, and explored much of the source code. If Me.CurrencyCode.Trim.Length > 0 Then
h = New HiddenField()
I encourage you to download the complete source code, h.ID = "currency_code"
h.Value = Me.CurrencyCode
available in both VB.NET and C#, to more thoroughly h.RenderControl(writer)
explore their inner workings. With this knowledge you can End If
extend these controls with custom functionality, or create
If Me.CustomData.Trim.Length > 0 Then
entirely new controls of similar design. </> h = New HiddenField()
h.ID = "custom"
C# and VB.NET source code accompanying this article h.Value = Me.CustomData
h.RenderControl(writer)
is available for download to asp.netPRO subscribers at End If
www.aspnetPRO.com/download.
If Me.NotifyUrl.Trim.Length > 0 Then
h = New HiddenField()
h.ID = "notify_url"
Steve C. Orr is an ASPInsider, MCSD, Certified ScrumMaster, h.Value = Me.NotifyUrl
Microsoft MVP in ASP.NET, and author of Beginning ASP.NET 2.0 h.RenderControl(writer)
End If
AJAX by Wrox. He’s been developing software solutions for leading
companies in the Seattle area for more than a decade. When he’s not If Me.FailReturnUrl.Trim.Length > 0 Then
busy designing software systems or writing about them, he often can h = New HiddenField()
h.ID = "cancel_return"
be found loitering at local user groups and habitually lurking in the h.Value = Me.FailReturnUrl
ASP.NET newsgroup. Find out more about him at SteveOrr.net or h.RenderControl(writer)
e-mail him at Steve@SteveOrr.net. End If

If Me.SuccessReturnUrl.Trim.Length > 0 Then

h = New HiddenField()
h.ID = "return"
Begin Listing One — The aspaypal_base h.Value = Me.SuccessReturnUrl
class’ hidden field rendering h.RenderControl(writer)

Protected Sub CreateHiddenFields(ByVal _

If Me.PostReturn Then
writer As System.Web.UI.HtmlTextWriter)
h = New HiddenField()
'Create common hidden fields...
h.ID = "rm"
h.Value = "2"
Dim h As HiddenField
h.RenderControl(writer)
End If
h = New HiddenField()
End If
h.ID = "business"
h.Value = Me.BusinessEmail
If Me.RequireShippingAddress = False Then
h.RenderControl(writer)
h = New HiddenField()
h.ID = "no_shipping"
If Me.Invoice.Trim.Length > 0 Then
h.Value = "1"
h = New HiddenField()
h.RenderControl(writer)
h.ID = "invoice"
End If
h.Value = Me.Invoice
h.RenderControl(writer)
If Me.RequireNote = False Then
End If
h = New HiddenField()
h.ID = "no_note"
If Me.ItemName.Trim.Length > 0 Then
h.Value = "1"
h = New HiddenField()
h.RenderControl(writer)
h.ID = "item_name"
End If
h.Value = Me.ItemName
h.RenderControl(writer)
h = New HiddenField
End If
h.ID = "cmd"
h.Value = Me.cmd
If Me.ItemNumber.Trim.Length > 0 Then
h.RenderControl(writer)
h = New HiddenField()
End Sub
h.ID = "item_number"
h.Value = Me.ItemNumber End Listing One
h.RenderControl(writer)
End If

asp.netPRO | October 2008 23

 Exploring WCF Web Services
LANGUAGES: C# § TECHNOLOGIES: .NET 3.5 | WCF
Workflow Services
Exploring .NET Framework 3.5 Features for Better
Workflow and WCF Integration
T
his monthly column explores how to expose work-
flows as WCF services, and how to consume WCF
services from workflows using features introduced
with .NET Framework 3.5. If you have questions about
migrating your existing ASMX or WSE Web services to
WCF, or questions regarding WCF as it relates to Web ser-
vices, please send them to underthehood@aspnetpro.com!
Workflow Services were introduced with the release of .NET
Framework 3.5 to facilitate better communication between
WCF and Windows Workflow Foundation (Workflow or
WF). Before this release it was cumbersome at best to start
a workflow from a WCF service operation, or to call a WCF
service operation from an executing workflow. The term
“Workflow Services” describes a workflow that is exposed
as a WCF service and can more easily make calls to other
WCF services, thanks to a few new Workflow activities:
ReceiveActivity and SendActivity. Visual Studio templates
simplify the process of creating a new Workflow Service by
generating sample sequential or state machine workflows
along with related code and configuration.
In this article I’ll explain how Workflow Services can be
used to expose workflows as WCF services, and to consume
other WCF services — and why you would want to leverage
these features. I assume you have some basic understanding
of Workflow technology, so I won’t be introducing you to
Workflow concepts.
Why Workflow Services?
Workflow is useful for describing and executing long-
running and complex business processes. Typically, we see
Workflow technology implemented as part of the middle-
26 October 2008 | www.aspnetPRO.com
§ By Michele Leroux Bustamante
tier to automate the flow of messaging between users,
applications, and services. For client applications to reach
a workflow, it is helpful to expose it as a WCF service —
either behind the firewall or on the Internet. In a service-
oriented system, business functionality is typically exposed
through services (for this discussion I’ll assume services
are implemented in WCF) — which means that a workflow
is likely to coordinate access to that functionality by calling
those services.
Simply put, Workflow Services make it easy to expose a
workflow as a WCF service so that client applications can
reach it, and make it easy for workflows to call out to WCF
services to coordinate access to business logic in a service-
oriented system. The value Workflow Services bring to the
table is in the removal of overhead to set up communica-
tion between WCF and Workflow to accomplish these two
scenarios. Under the assumption you are employing work-
flow in the middle-tier, Workflow Services become a staple
item in your application.
Workflow Service Features and
Templates
Creating a Workflow Service involves leveraging several
.NET Framework 3.5 features, including:
§ ReceiveActivity: A new Workflow activity that imple-
ments a WCF service operation.
§ SendActivity: A new Workflow activity for calling WCF
services from an executing workflow instance.
§ Context-aware bindings: New WCF bindings specifically
for Workflow, which handle workflow instance manage-
ment between clients and Workflow Services.
§ WorkflowServiceHost: A new ServiceHost type that
facilitates communication between WCF services and the
Workflow Runtime.
Figure 1: Workflow Service templates.
For a Workflow developer less familiar with WCF, it might
seem daunting to figure out how to create a service con-
tract, select bindings and configure endpoints, configure
the ReceiveActivity and SendActivity accordingly, and
initialize the correct ServiceHost type. Fortunately, there
are two Visual Studio templates to simplify this process:
Sequential Workflow Service Library and State Machine
Workflow Service Library (see Figure 1). These templates
are only shown if you select .NET Framework 3.5 from the
Add New Project list.
Each template creates a new class library project with a
sample workflow (sequential or state machine) that has been
configured as a Workflow Service as follows:
§ Each workflow starts with a ReceiveActivity (shown in
Figures 2 and 3).
§ The ReceiveActivity is associated with a service opera-
tion from a sample WCF service contract. When clients
call the operation via proxy, that particular Receive-
Activity is executed.
§ The class library includes an app.config file with a
sample <system.serviceModel> configuration for the
Workflow Service.
§ The binding used for the Workflow Service endpoint
is WSHttpContextBinding, one of the context-aware
bindings.
Essentially, the template generates a project with the neces-
sary assembly references, a sample Workflow Service, and
the required configuration and set up so you can execute it.
To test the service, the class library is set up to use the two
WCF test tools released
with .NET Framework
3.5, WCF Service Host
(WcfSvcHost.exe)
and WCF Test Client
(WcfTestClient.exe).
However, in this article
I’ll explain how to
create your own host Figure 2: Sequential Workflow
and client. Service template results.
Figure 3: State machine Workflow Service template results.
Note: Visit msdn.microsoft.com/en-us/library/bb552363.aspx
and msdn.microsoft.com/en-us/library/bb552364.aspx for more
information about the test tools.
For sequential workflows, the ReceiveActivity is the first
activity in the workflow (as shown in Figure 2). For state
machine workflows, the ReceiveActivity is the first activ-
ity contained within an event-driven activity (as shown in
Figure 3). Both sample workflows created by the template
support clients calling a WCF service operation to initialize
the workflow, because the ReceiveActivity is configured to
support workflow initialization.
It is still possible to create Workflow Services without the help
of a Workflow Service template. You can add new sequential or
state machine workflows to a class library project and manu-
ally add the ReceiveActivity, create the WCF service contract
using dialogs provided, and add the required WCF configura-
tion settings for the Workflow Service endpoint.
ReceiveActivity
The most common use for Workflow Services is to expose a
workflow as a WCF service. The main benefit to the devel-
oper is that they no longer have to manually initialize the
Workflow Runtime or workflow instance from a WCF service
operation. Instead, the Workflow Service directly exposes a
WCF service operation via ReceiveActivity. This activity rep-
resents the implementation of a WCF service operation.
Consider the Workflow Service shown in Figure 4. This Work-
flow Service exposes three ReceiveActivity instances imple-
menting three WCF service operations: ReceiveOperation1,
ReceiveOperation2, and ReceiveOperation3. ReceiveOpera-
tion1 kicks off the workflow; ReceiveOperation2 and Receive-
Operation3 can be called only after the workflow has started.
Once a client calls one of the latter two operations, the work-
flow is completed.
Each ReceiveActivity has a number of properties that should
be initialized:
asp.netPRO | October 2008 27
 Exploring WCF Web Services | Workflow Services

����������������
������ ������������������������������������������������������������������

�����������������

������� ����� �������� �������������

����������������������������������������
����������������������������������
����������������������������������������
���������������������������
�������������������������������
��������������������������������������
�����������
������������������������������������������
���������������������������������������
��������������������� ��������������
�������������������������������������������
�������������������������

Figure 4: A Workflow Service with multiple ReceiveActivity instances.

§ ServiceOperationInfo: Indicates the service operation implemented by

ReceiveActivity. This is set through the Choose Operation dialog box.
§ CanCreateInstance: Indicates if the operation can be called to initialize the
workflow instance. If not, the workflow must already be initialized before
ReceiveActivity can accept calls.
§ (ReturnValue): Associates the ReceiveActivity return value with a field or
��������
����������� property of the workflow. Developers can set this field or property of the
���������
����������� workflow to provide a return from the service operation.
������� § FaultMessage: Associates the ReceiveActivity fault message with a field or
������������
property of the workflow. Developers can set this value to return a fault from
����������
�����
��� the service operation. The client receives this as a FaultException.
�����������
���������� ������ § [parameters]: These are dynamically generated properties based on the param-
����� eters to the service operation used to associate the parameter with a field or
�����������
property of the workflow so that developers have access to these parameters
throughout the ReceiveActivity sequence to implement service operation logic.
��������������������
�������������� ������������
Figure 5 illustrates the property values of the first ReceiveActivity instance.
�����������������������������������
��������������������������������������� Workflow-first Services
����������������������������������������
����������� The Choose Operation dialog box shown in Figure 6 is used to set the
ServiceOperationInfo property. From this dialog box you can either import an existing
��������������������������������������
�������������������������������������� service contract (Import) and select one of its operations, or define a contract for the
������������������� Workflow Service (Add Contract) and an operation (Add Operation) for the specific
���������������������������������������� ReceiveActivity instance being configured. A subsequent ReceiveActivity instance can
���������������������������������� select the same contract and define addi-
���������������������������������������� tional operations. Workflow-first services
������������������������������������ imply that the WCF service contract does
����������������������������������� not exist until the Workflow Service is
���������������������������������������� created. While designing the workflow,
������������� one or more service contracts can be
���������������������� defined with operations associated with
���������������������������� ReceiveActivity instances. Typically,
you’ll create a single service contract (as
�������������� shown in Figure 5) for the Workflow Ser- Figure 5: ReceiveActivity properties for
����������������� vice, with as many operations as Receive- ReceiveOperation1.

28 October 2008 | www.aspnetPRO.com

 ������� ����
����������������� ��������
��� ��������������������

�������������������������������������������������������
���������� �����������������������

���������・�����������������������・���������������� �����・�������� ��������������

��������������� ��������������� ��������������������������

��������������������������������������������������������������������������������
Exploring WCF Web Services | Workflow Services
Figure 6: The Choose Operation dialog box with a workflow-first
service contract.
Activity instances. Figure 6 illustrates a service contract named
IWFService with three service operations defined for the Work-
flow Service using the workflow-first approach.
Note: One drawback to creating workflow-first services is lack
of control over service contract properties, such as the target
namespace. I recommend importing a service contract created
specifically for the Workflow Service to overcome this limitation.
Workflow Service Configuration
Once the Workflow Service design is complete, and service
contracts and operations are defined and associated with
ReceiveActivity instances, it’s time to think about Workflow
Service configuration. Because a Workflow Service is imple-
mented as a WCF service, each service contract must have
at least one service endpoint defined so clients can com-
municate with the service. This is done with classic WCF
configuration settings — with the exception that it requires
the use of a special context-aware binding. The following
example illustrates a Workflow Service endpoint for the con-
tract defined in Figure 6 — using WSHttpContextBinding:
<service name="SequentialWFService.WFService">
<endpoint address="http://localhost:8000/WFService"
binding="wsHttpContextBinding"
contract="IWFService">
</endpoint>
</service>
There are three context-aware bindings introduced with .NET
Framework 3.5: BasicHttpContextBinding, WSHttpContext-
Binding, and NetTcpContextBinding. Each binding includes a
context binding element to enable communication between
clients and a specific workflow instance.
30 October 2008 | www.aspnetPRO.com
Workflow Service Context
Context-aware bindings facilitate passing the workflow
instance identifier in message headers between client and
service. When the first ReceiveActivity is called, the following
<Context> header is included in the response:
<Context u:Id="_4" xmlns="http://schemas.microsoft.com/
ws/2006/05/context">
<Property name="instanceId">0cb1d8a4-4484-4d19-b33e-
a3f7bdb856c6</Property>
</Context>
Because the client channel is configured to use the same
context-aware binding, the client channel is responsible
for caching this instanceId element for subsequent calls to
the Workflow Service. The same header is sent for all calls
from the same proxy instance to correlate the workflow
instance at the server.
Should the client channel be faulted, a new proxy can be gen-
erated and initialized with the same instanceId. First, save the
instanceId by retrieving its value through the context manager:
IContextManager ctxManager =
m_proxy.InnerChannel.GetProperty<IContextManager>;
IDictionary<string, string> ctx = ctxManager.GetContext;
m_instanceId = ctx["instanceId"];
If a new proxy is created and it is expected that the same
workflow instance be used, create a new context with this
value and assign it to the client channel:
m_proxy = new WinClient.localhost.WFServiceClient();
IContextManager ctxManager =
m_proxy.InnerChannel.GetProperty<IContextManager>();
IDictionary<string, string> ctx =
new Dictionary<string, string>();
ctx.Add("instanceId", this.m_instanceId);
ctxManager.SetContext(ctx);
Note: If the Workflow Service is configured to use Workflow
Persistence Services, the workflow instance state can be
reloaded from the database. This makes it possible to sur-
vive service channel faults and machine restarts.
ReceiveActivity Execution
The sequence contained within a ReceiveActivity is executed
synchronously as part of the WCF service operation. Param-
eters passed to the operation can be used by the activities
in the sequence, and before the sequence ends the activity’s
return value or FaultMessage should be set. Activities that
follow a ReceiveActivity in the workflow are executed
asynchronously to the client (because a response will have
already been sent back as the ReceiveActivity terminates).
For the Workflow Service defined in Figure 4, the CodeActivity
executes before sending a response to the client. The following
code inside the CodeActivity sets the return value:
����� ������ �������������������������
��� ��������������������

��������������������
���������� ������������������������

���������・�����������������������・���������������� �����・�������� ��������������

��������������� ��������������� ��������������������������

��������������������������������������������������������������������������������
Exploring WCF Web Services | Workflow Services

this.ReceiveOperation1Return = "ReceiveOperation1 called"; call out to WCF service operations without the hassle of
this.ReceiveOperation1Fault = null; prior techniques.

If an exception occurs and the workflow should be terminated,
a fault can be thrown by initializing the FaultMessage property
through its bound field:
this.ReceiveOperation1Fault =
new FaultException("ReceiveOperation1 has faulted.");
Activities that follow a ReceiveActivity continue to execute
on the same thread as the ReceiveActivity — although a
response has already been sent to the client.
Using SendActivity, a Workflow Service can be config-
ured to call a particular WCF service contract by simply
providing the service contract metadata, indicating the
operation to call, binding parameters to workflow fields
or properties, and providing a configuration for the cli-
ent proxy. The proxy is automatically generated based on
the information provided to the SendActivity, so it is not
necessary to write code to call the service unless you are
customizing the call to provide a dynamic address or spe-
cific security settings.

Note: Because activities placed within a ReceiveActivity are
executed synchronously to the client, care should be taken that
this sequence is not long running in order to avoid timeouts.
Only those activities that contribute directly to the operation
response need be part of the ReceiveActivity — the rest can be
executed asynchronously with the remainder of the workflow.
SendActivity
So far I’ve focused on Workflow Services as exposing WCF
service endpoints to clients so they can invoke operations
implemented by ReceiveActivity instances. Another impor-
tant feature of a Workflow Service is the ability to easily
�����������������
����������������
�����������������
Figure 7 illustrates the same Workflow Service from Figure
4 (modified to add a call to a WCF service operation within
each ReceiveActivity). Think of this as the Workflow Ser-
vice coordinating downstream service calls according to a
business process.
As with ReceiveActivity, developers can configure each
SendActivity by setting its properties. The key properties to
initialize are:
§ ServiceOperationInfo: Indicates the service operation to
be invoked when the SendActivity instance is executed.
This is set through the Choose Operation dialog box.
§ EndpointName: A child of the ChannelToken property
that specifies the WCF client configuration section to use
for proxy initialization. This can be shared by several
SendActivity instances by using the same ChannelToken.
§ (ReturnValue): Associates the SendActivity return value
with a field or property of the workflow. Developers can set

Do you love the FREE PDF version of asp.netPRO, but

want access to all the code, as well?

This is the perfect

complement to the
free asp.netPRO PDF.
Now get access to all
Premium Downloads
that accompany
feature articles. A
one-year online-
only subscription
to asp.netPRO
magazine is only
US$14.99.

To order your online subscription, please contact

Customer Service at customerservice@informant.com
and include your contact information:
•Name •E-mail
•Address •Daytime telephone number

We will then provide you your Customer Number so

you can set up your online account.
Microsoft, Visual Studio, Visual Basic, MSDN, and ASP.NET are registered trademarks or
trademarks of Microsoft Corportaion in the United States and/or other countries and are
used by ICG under license from owner, asp.netPRO and Informant are trademarks or
registered trademarks of Informant Communications Group, Inc. Figure 7: A Workflow Service calling out to downstream WCF
service operations.

32 October 2008 | www.aspnetPRO.com

 �����������
����������� ������������������
��� ��������������������

���������������������
���������� ���������������������������

���������・�����������������������・���������������� �����・�������� ��������������

��������������� ��������������� ��������������������������

��������������������������������������������������������������������������������
Exploring WCF Web Services | Workflow Services

this field or property of the workflow to share the return

from the service operation with the rest of the workflow.
§ [parameters]: These are dynamically generated proper-
ties based on the parameters to the service operation used
to associate the parameter with a field or property of the
workflow. This removes the need for code to initialize
parameters passed to the service operation.

Figure 8 illustrates
the property values of
the first SendActivity
instance.

To configure each
SendActivity requires
access to the service
contract and any
custom data types Figure 8: SendActivity properties for
Operation1.
relied upon by that
contract. The easiest way to gain access to this is to either
generate a proxy, or, if you own both projects, you can share
a metadata assembly between the Workflow Service project
and the service project(s). Once this metadata is available to
the project you can select the service contract and operation
to associate with a SendActivity instance. After importing the
service contract (see Figure 9) the same Choose Operation
dialog box from Figure 6 is presented to select the operation
for the SendActivity being configured.
SendActivity instances also require access to a <client>
configuration section specified in the EndpointName prop-
erty. This configuration, which is usually created through
proxy generation, must be part of the host process configu-
ration file. To set the address of the service to be called by a
SendActivity instance, set the CustomAddress property.
WorkflowServiceHost
WorkflowServiceHost is an extension to ServiceHost (the type
responsible for initializing WCF communication channels at
the service). WorkflowServiceHost adds functionality to facili-
tate communication between WCF and Workflow. When a
request is received at a ReceiveActivity, the WorkflowService-
Host ensures the Workflow Runtime is initialized, initializes a
new workflow instance if necessary (and if supported by the
ReceiveActivity), then handles activating the workflow. For
SendActivity instances, the WorkflowServiceHost constructs a
client channel (or proxy) to call the specified service operation.
To host a Workflow Service, construct the WorkflowService-
Host as follows:
WorkflowServiceHost hostWFService = new
WorkflowServiceHost(typeof(SequentialWFService.WFService));
hostWFService.Open();
If the workflow-first approach was used to generate
the WCF contract, the WorkflowServiceHost is smart
Figure 9: Selecting a service contract to be used for SendActivity
instances.
enough to reflect the workflow definition for this contract
(because it is not statically defined).
To host Workflow Services in IIS or WAS, use the Workflow-
ServiceHostFactory in the .svc declaration (full name required):
<%@ ServiceHost Service="SequentialWFService.
WFService" Factory="System.ServiceModel.Activation.
WorkflowServiceHostFactory" %>
Next Up: Workflow Services and Security
In this article I introduced the Workflow Service, explained how
to set up ReceiveActivity and SendActivity, and explained how
the hosting model ties it all together. I have purposely left out
security features for Workflow Services as that topic requires an
article of its own. So, stay tuned to the next issue for the contin-
uation of this discussion of Workflow Services as I explain your
options for securing ReceiveActivity and SendActivity. </>
Download the samples for this article from www.dasblonde.net/
downloads/aspprooct08.zip.
Michele Leroux Bustamante is Chief Architect of IDesign Inc., Microsoft
Regional Director for San Diego, and Microsoft MVP for Connected
Systems. At IDesign Michele provides training, mentoring, and high-
end architecture consulting services focusing on Web services, scalable
and secure architecture design for .NET, federated security scenarios,
Web services, interoperability, and globalization architecture. She is
a member of the International .NET Speakers Association (INETA),
a frequent conference presenter, conference chair for SD West, and is
frequently published in several major technology journals. Michele
also is on the board of directors for IASA (International Association
of Software Architects), and a Program Advisor to UCSD Extension.
Her latest book is Learning WCF (O’Reilly, 2007); visit her book blog
at www.thatindigogirl.com. Reach her at mlb@idesign.net, or visit
www.idesign.net and her main blog at www.dasblonde.net.

34 October 2008 | www.aspnetPRO.com

������������ ����������
�������� ������������������
��� ��������������������

�������������������������������
���������� �����������������������

���������・�����������������������・���������������� �����・�������� ��������������

��������������� ��������������� ��������������������������

��������������������������������������������������������������������������������
 a s p: F ea t u re
LANGUAGES: C# | VB.NET § ASP.NET VERSIONS: 3.5
Convention Over
Configuration
Creating Applications Using ASP.NET MVC,
jQuery, and AJAX: Part II
A
s is the nature of working with bleeding-edge
“preview” technology, you are bound to bleed
once in a while. A lot has changed since Part
I of this article was written. Preview 4 of ASP.NET MVC
was released and now we have to change some of our
code. The code changes are minor, but the new project
template includes views and code to log in, register, and
log out. Although these pages don’t use AJAX, it would
be easy to AJAX-enable them. For the sake of simplic-
ity, I am going to start with a new project using the new
template (see end of article for download details).
Let’s say we are building a classifieds Web site similar to
craigslist. The first thing we’ll do is enable the user to list
an item for sale. A listing is made up of a title, description,
and, optionally, an image. First, let’s create a new control-
ler named ListingController and add a “New” action. This
action only needs to render the view for creating a new
listing (see Figure 1).
Notice that we don’t tell it which view to render; instead,
it will automatically look for the view with the same
name as the action (“new”). It will look for new.aspx or
new.ascx in the Views | Listing folder, then it will look
in the Views | Shared folder. Alternatively, you could call
View(“new”). Also note the Authorize attribute; this is
new to Preview 4 and it’s the quickest way to authorize
an action. By adding this attribute, only a logged-in user
will be allowed to run it. If you are not logged in, you’ll
be directed to the log-in page. All this is done automati-
cally, starting with the Preview 4 version.
36 October 2008 | www.aspnetPRO.com
§ By Emad Ibrahim
Let’s create the view by adding a new MVC View Content
Page and using the Site.Master page in the Views | Shared
folder as the master. Run the project (Ctrl+F5) and navigate
to http://localhost:9055/listing/new (you should get a blank
content page). We need to collect a title, description, and
image on this page, so let’s add all the necessary controls
and a Submit button. The HTML is shown in Figure 2; the
form is shown in Figure 3.
When the user clicks the Submit button, we want to
perform some basic validation on the client (JavaScript),
submit the request using AJAX to create the listing, then
upload the image.
<Authorize()> _
Public Function [New]() As ActionResult
Return View()
End Function
Figure 1: Controller action to render the new listing view.
<fieldset>
<div class="label">Title <span class="validation"
id="valTitle"></span></div>
<%=Html.TextBox("txtTitle", New With {.style =
"width:300px"})%>
<div class="label">Description <span class="validation"
id="valDescription"></span></div>
<%= Html.TextArea("txtDescription","",8,50) %>
<div class="label">Images <span class="validation"
id="valImage"></span></div>
<form enctype="multipart/form-data" method="post"
name="formImage" id="formImage">
<input type="file" id="fileImage" name="fileImage"/>
</form><br />
</fieldset>
<p><input type="button" id="btnSubmit" name="btnSubmit"
onclick="submit();" value="Submit" /> </p>
Figure 2: HTML for the create listing view.
Validation is pretty
function isValid()
straightforward; title
{
and description are $("span.validation").hide();
required, and if an var isvalid = true;
if (!imageIsValid()) {
image is selected, it
$("#valImage").html("Invalid image. Use jpg.").show();
should have a jpg or var isvalid = false;
jpeg extension. The }

validation method
if($("#txtTitle").val().length == 0) {
is shown in Figure 4 $("#valTitle").html("* Title is required").show();
(the image validation var isvalid = false;
Figure 3: The create new list page. }
method is shown in
Figure 5); note the use if($("#txtDescription").val().length == 0) {
of the jQuery methods: $("#valDescription").html("* Description is
required").show();
§ val to get the value of the element
var isvalid = false;
§ hide to hide the matching elements }
§ html(“some html string”) to set the html of the element return isvalid;
}
§ show to display the matching elements
Figure 4: JavaScript to validate a page.
As discussed in Part I, we are using jQuery to select and
manipulate DOM elements. We first hide all spans with line will select the element named “aDiv”, change its HTML
a validation class, then check the title, description, and content to “hello world”, then hide it slowly, then show it
image and display the appropriate error message. If every- fast. Each method basically returns an object that the follow-
thing checks out, we return true. Note the method chaining ing method acts upon to create a chain of method calls.
that makes jQuery very powerful and easy to use. Chaining
allows you to do things like $(“aDiv”).html(“hello world”).- Now that the form is valid, we need to submit it (see Figure
hide(“slow”).show(“fast”). This seemingly simple JavaScript 6). We’ll submit the form to /listing/create, so we’ll need

ORDER Your Copy Now for ONLY US$39.99*

2007 asp.netPRO Complete Works CD-ROM
• More than 700 technical articles, as well as product reviews, book
reviews, and other content appearing in asp.netPRO and asp.netNOW!
• Supporting code and sample files that you can use in your
applications immediately.
• Easily searchable CD-ROM — find what you need, when you need it.
• FREE shipping!*

Visit us online at
Co-Sponsored by: www.aspnetPRO.com/cd
or Call Toll-free in the U.S.
(800) 884-6367
Outside the U.S. dial (916) 379-0609

* Free Shipping and Handling to US and Canada! All other countries US$10.00 for shipping and handling. Applicable sales tax will be added for California residents. Payment must
be in US dollars drawn on a US bank. Your purchase may be tax deductible if used for business purposes. Please check with your tax advisor.

Microsoft and ASP.NET are registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries
and are used by ICG under license from owner. asp.netPRO and Informant are trademarks or registered trademarks of Informant
Communications Group, Inc.

asp.netPRO | October 2008 37

asp:Feature | Convention Over Configuration

call it DB. You

function imageIsValid()
can simply drag
{
var filename = $("#fileImage").val().toLowerCase(); the two tables
if (filename.length == 0) return true; created above
if ((filename.lastIndexOf(".jpg") == -1) &&
from the Server
(filename.lastIndexOf(".jpeg") == -1)) Figure 8: The LINQ to SQL class diagram.
return false; Explorer pane
return true; into the design
}
surface. The model is shown in Figure 8.
Figure 5: JavaScript to validate a file extension.
This looks similar to the database diagram — with one
minor exception: the entity names are singular. Listing and
function submit()
{ ListingImage are now classes in your project that model an
if (!isValid()) return; entity. Let’s get back to creating the Create action using the
var title = $("#txtTitle").val();
newly created model entities (see Figure 9).
var description = $("#txtDescription").val();
$("#btnSubmit").attr("disabled","disabled");
//create the listing This method creates a record in the database using the
$.ajax({
type: "POST",
model created above and then returns the Id of the record
dataType: "json", in a JSON object. There are a few things to note here. First,
url: "/listing/create", the return type is JsonResult, which returns a JSON object
data: {title : title,
description : description
to the browser. The returned JSON object is an anonymous
}, object, the Json method is part of the MVC Framework and
success: function(result) { knows how to serialize the anonymous object back to the
if (result.success){
if ($("#fileImage").val().length > 0 ) { browser. Also note that the action is decorated with the
$("#formImage").attr("action", Authorize attribute, as previously explained.
"/listing/upload/" + result.id);
$("#formImage").submit();
} else { JSON stands for JavaScript Object Notation. As defined on
window.location = "/listing/list"; www.json.org, it “... is a lightweight data-interchange format.
}
}else {
It is easy for humans to read and write.”
alert("Failed to create listing");
} Now that the record is created, the submit method shown
},
error: function(error) { in Figure 6 will submit the form containing the image to the
/listing/upload/Id. So let’s create the upload action to save
}
the file and create the database record (see Figure 10).
});
$("#btnSubmit").removeAttr("disabled");
} In a real-world application you’ll probably have a service
layer abstracting the model, but because this article is not
Figure 6: JavaScript to submit the form.
about data layer design patterns, and for the sake of simplic-
a new action in the listing controller named Create. This ity, we are directly using the SQL to Entity classes.
action will create the record in the database and then return
a JSON object, which includes the Id of the inserted record.
If the creation action works, we’ll then upload the file using
<Authorize()> _
the Id sent back to us. Public Function Create(ByVal title As String, ByVal description
As String) As JsonResult
Model Interruption Try
Dim db = New DB
Before we can write code to create the listing, let’s take a Dim listing = New Listing With { _
quick break to create the model. We need a table for the list- .Title = title, _
ing and another for the image. Although we are only adding .Description = description, _
.Username = User.Identity.Name.ToLower _
one image, it is reasonable to assume that we’ll be adding }
the ability to post multiple images in the near future; the db.Listings.InsertOnSubmit(listing)
database diagram is shown in Figure 7. db.SubmitChanges()
Return Json(New With {.success = True, .id = listing.Id})
Catch ex As Exception
We’ll now cre- Return Json(New With {.success = False, _
ate a LINQ to .message = ex.Message})
End Try
SQL model in End Function
the Models
folder and Figure 7: The database diagram. Figure 9: The controller action to create a new listing.

38 October 2008 | www.aspnetPRO.com

asp:Feature | Convention Over Configuration
<Authorize()> _
Public Function Upload(ByVal id As Long) As ActionResult
If (Request.Files.Count = 0) Then
Return RedirectToAction("List")
End If
Dim db = New DB
If (db.Listings.Where(Function(l)
(l.Id = id)).Count = 1) Then
Dim filename As String = UploadFile()
Dim listingImage = New ListingImage With _
{.ListingId = id, _
.Filename = filename}
db.ListingImages.InsertOnSubmit(listingImage)
db.SubmitChanges()
End If
Return RedirectToAction("List")
End Function
Figure 10: Controller action to upload a file.
Figure 11: A grid displaying the listings.
<% For Each item In ViewData.Model.Items%>
<div id="div<%= item.Id %>" class="listingRow">
<span>
<%=Html.ActionLink(Of ListingController)(Function(c)
c.Edit(item.Id), "edit")%>
<a href="#" onclick="deleteItem('<%= item.Id %>')
">delete</a> </span>
<%= item.Title%>
</div>
<% Next%>
Figure 12: Markup to render the listings grid.
After a successful post, we redirect the user to the /listing/
list page, which will display all the items listed by the user.
We need to repeat the same steps performed above: create
a List action in the controller and a list.aspx view. When all
is done, we’ll end up with the view shown in Figure 11. The
List view (list.aspx) markup is shown in Figure 12.
In the markup, we loop through the list of items and
display links and a title for each one. One important dif-
ference between other views we’ve created is that the
ViewData.Model is strongly typed and has full IntelliSense,
as shown in Figure 13. This is because we changed the code-
behind file to inherit ViewPage<ListingController.ListModel>
instead of ViewPage. So the class definition is the public par-
tial class List : ViewPage
<ListingController.ListModel>.
As you can see from this code,
the ListModel class is defined in
the ListingController class (see
Figure 14). Currently, this class
only contains an Items property Figure 13: IntelliSense on a
of type List<Listing>. strongly typed view model.
40 October 2008 | www.aspnetPRO.com
Public Class ListModel
Public Items As List(Of Listing)
End Class
Figure 14: A class representing a view model.
Public Function List() As ViewResult
Dim model = New ListModel
Dim db = New DB
If User.Identity.IsAuthenticated Then
model.Items = db.Listings.Where(Function(l) _
l.Username.ToLower = _
User.Identity.Name.ToLower).Take(20).ToList
Else
model.Items = db.Listings.Take(20).ToList
End If
Return View(model)
End Function
Figure 15: The controller action to render the list of listings view.
$(document).ready(function() {
$("div.listingRow").hover(
function(){$(this).css("backgroundColor", "yellow");},
function(){$(this).css("backgroundColor", "");}
);
});
Figure 16: The JavaScript function to initialize the page.
To render a view with a strongly typed model, call
View(“list”, model) instead of View(“list”). If the view name
is the same as the action, you can simply call View(model).
To see it how it all works together, take a look at the List
action in Figure 15.
If you haven’t fallen in love with jQuery yet, take a look
at Figure 16 to see how we change the background of the
row to yellow when hovering over it (as shown in Figure
11). As mentioned in Part I, the “$” is a shorthand to
the jQuery API and the $(document).ready method runs
as soon as the DOM is ready, but before the content is
displayed, so it’s the perfect place to apply styles and
add event listeners. The code in Figure 16 adds a jQuery
hover event listener to any div with the listingRow class.
The hover event takes two functions as arguments: one
runs when the mouse is over the element and another
when the mouse leaves. We set the CSS background color
property to yellow when the mouse is over the row and
clear it when the mouse leaves. How many lines of code
would you have to write to accomplish the same task
without jQuery?
Let’s add some more jQuery magic to the grid. We want
to delete the item when the user clicks the delete link, but
we want to use AJAX and also fade out the row on a suc-
cessful deletion. The first thing we need to do is prompt
the user to confirm the delete action. Let’s replace the
Html.ActionLink line with <a href=“#” onclick=
“deleteItem(‘<%=item.Id %>’)”>delete</a> and
asp:Feature | Convention Over Configuration
function deleteItem(id)
{ _listingDisplay.ascx", item) %>
if(!confirm("Are you sure you want to delete this listing?"))
return;
$.ajax({
type: "POST",
dataType: "json",
url: "/listing/delete/" + id,
success: function(result) {
if (result.success){
$("#div" + id) .css("backgroundColor", "red").slideUp(1000);
}else {
alert("Failed to delete listing");
} <%= ViewData.Model.Title%>
},
error: function(error) {
alert("An error occurred while deleting the listing");
}
});
}
Figure 17: The JavaScript function to delete a listing.
create the deleteItem function (see Figure 17). The trick
is in the line $(“#div” + id) .css(“backgroundColor”,
“red”).slideUp(1000); which changes to red the background
color of the row being deleted and hides it using a slide up
animation. Trying different values, experiment with slide-
Down, fadeOut, and hide. The 1000 tells it to perform the
animation over a duration of 1000 milliseconds (1 second).
User Controls
One more thing we should talk about is user controls. User
controls make your code more useable and maintainable.
For example, we can easily refactor the listing display into
its own user control, which will allow us to reuse it in other
views such as a search results page. It is very easy to create
a user control in ASP.NET MVC. Right-click on the Views |
Listing folder and click Add | New Item, then select Web |
MVC | MVC View User Control and name it _ListingDisplay
(it is a convention to prefix partial pages [user controls]
with an underscore). Switch to the user code and change
the class definition to inherit from the generic ViewUser-
Control<Models.Listing>. This means that the user control
expects the data passed to it to be of type Listing, just as
we did with the List view earlier. All we have to do is cut
and paste the markup inside the For Each loop in Figure 12
into the user control and replace any reference to “item”
with “ViewData.Model”. Remember: The ViewData.Model is
strongly typed as “Listing”. Then replace the code inside the
For Each loop in list.aspx page with one line: <%= Html.-
RenderUserControl(“~/views/listing/_listingDisplay.ascx”,
item) %>. The RenderUserControl helper method, as the
name suggests, renders a user control. Note that we are
passing “item” to the RenderUserControl method; “item” is
of type Listing and will be mapped to the ViewData.Model
of the user control — exactly what it expects. The modified
list.aspx page is shown in Figure 18 and the _ListingDisplay
user control markup is shown in Figure 19.
42 October 2008 | www.aspnetPRO.com
<% For Each item In ViewData.Model.Items%>
<%= Html.RenderUserControl("~/views/listing/
<% Next%>
Figure 18: Refactored list view.
<div id="div<%= ViewData.Model.Id %>" class="listingRow">
<span>
<%=Html.ActionLink(Of ListingController)(Function(c)
c.Edit(ViewData.Model.Id), "edit")%>
<a href="#" onclick="deleteItem('<%=ViewData.Model.Id %>')
">delete</a> </span>
</div>
Figure 19: User control to display a listing.
Keep in mind that this user control code requires the page
reference for the JavaScript file containing the deleteItem
method — otherwise, you will get a script error. In a pro-
duction application, you would refactor your scripts into
logical script files that get referenced where needed.
Conclusion
We’ve looked at strongly typed view pages and view user
controls using generics. We’ve seen how data is passed from
the controller to the view. We talked to the server using
AJAX and enhanced the usability and user experience by
adding visual cues and animation.
jQuery is a very simple, powerful, and extensible Java-
Script library that will get you up and running in no time.
It’s difficult to cover the entire library in one article. Hope-
fully this whets your appetite enough to give it a try. You
can get more information at www.jquery.com, as well as
download a ton of open source extensions that let you do
a multitude of things, from creating tabs, to popup mes-
sages, to image effects, etc. We also looked at some of the
new features of the MVC Framework introduced in the
Preview 4 release. You can download the preview from
www.codeplex.com/aspnet. </>
Source code accompanying this article is available for down-
load to asp.netPRO subscribers at www.aspnetPRO.com.
Emad Ibrahim, MCSD, has been a professional developer for nine
years and has worked with .NET since the first beta. He has held
titles ranging from architect to senior developer to consultant. He
quit his job with Avanade to start playing around with new stuff and
catch up with technology. Since then he created an open source twitter
clone at yonkly.com. He also is an active blogger and mostly blogs
about software development and technology-related stuff. His blog is
at www.emadibrahim.com.
 C l o s er L o ok
DXperience Universal
How Suite It Is
M
any companies have released a range of
products rolled into a .NET suite for
Windows and Web development. These
products not only simplify programming tasks, they
also provide components that can be used to deliver
cutting-edge interfaces and instantly modify the look
and feel of an entire application. DXperience Universal
from Developer Express (DevExpress) is one such prod-
uct (www.devexpress.com/Products/NET/DXperience/
editionUniversal.xml). DXperience includes a plethora
of components for developing highly powerful Windows
and ASP.NET applications. I reviewed the first build of
the 2008 series, which contains tons of feature enhance-
ments, focusing mainly on the components meant for
ASP.NET applications.
I tested the product on a machine loaded with Windows XP
Service Pack 2 with 512 MB of RAM. The installation pack-
age was around 150 MB; I downloaded it within 20 minutes
using a broadband connection. DevExpress deserves special
credit as they have created a user-friendly installer with
easy to understand instructions. It automatically creates the
required items on the Start menu and adds the controls to
the Visual Studio Toolbox.
DXperience ships with numerous controls that can be used
not only to develop Windows and Web-based projects, but
also to include libraries for developing applications that
make use of reports and charts in addition to IDE produc-
tivity and ORM tools — CodeRush and eXpressPersistent
Objects, which I hope will be useful for advanced develop-
ers. DevExpress also provides a product named eXpressApp
Framework (www.devexpress.com/xaf) that leverages and
exploits their rich set of presentation and reporting compo-
44 October 2008 | www.aspnetPRO.com
§ By Anand Narayanaswamy
Rating: 
Web Site: www.devexpress.com
Price: US$1,999.99
nents, and allows developers to build and maintain business
applications with ease, thereby drastically reducing time to
develop solutions for end users.
The ASP.NET components are bundled into various suites:
ASPxGridView, ASPxperience, ASPxScheduler, ASPxSpell,
and ASPxHTML Editor. The ASPxperience suite includes a
set of 20 controls. A notable feature is the inclusion of a
cloud/tag control, which I hope will be useful during the
development of a knowledge base or a content manage-
ment application.
DXperience ships with a new rich text editor for ASP.NET
2.0, built entirely with the ASPxperience Suite with the
integration of ASPxUploadControl for embedding images.
It includes the newly released AJAX-based ASPxTreeList
control, which has numerous performance optimization
features. It enables developers to render paged and hierar-
chical TreeLists, along with many other options (see Figure
1). The data loads quickly because of the powerful built-in
AJAX capabilities.
The latest build includes improve-
ments for the ASPxGridView,
ASPxPivotGrid, and ASPxScheduler
suites, in addition to several suites
oriented for the development of
Windows-based applications. A
complete list of all the new features
is located at www.devexpress.com/
Products/NET/DXperience/
WhatsNew2008v1. Moreover,
DevExpress has made available
for the entire ASP.NET product
line more than 10 popular theme
styles, which I feel is a big bonus
for developers, as they can develop Figure 1: Easily select
applications with a uniform an item using the
look and feel. TreeList control.
I’m a big fan of the charts (www.devexpress.com/Products/NET/WinForms/
GridView control, so I XtraCharts) and reports (www.devexpress.com/Products/
was eager to test the NET/WinForms/XtraReports) into ASP.NET applications.
ASPxGridView control
using Visual Studio The chart control includes a wizard you can use to custom-
2005. I was able to ize the look and feel. For guidance purposes, I would sug-
populate the control gest DevExpress include the progress of the wizard (such
with the data using the as Step 4 of 15) at the top of the window. A key feature of
various options from the XtraCharts is its ability to render different types of 2D and
smart tag and custom- Figure 2: The ASPxGridView control 3D charts, such as Bar, Gantt, Point, Line, Area, Pie, Radar,
before selecting the Header Filter
ize the look and feel feature.
Polar, Candle Stick, Stock, and Manhattan Bar. Moreover,
of it by changing the it provides full support for True OpenGL Rendering, Full
theme without a single line Anti-Aliasing, Perspective Projection, Gradient Fill, and
of code. Developers should Texture and Transparency. An interesting point to note is
learn the use of the various that the chart demo application included with the product
properties included with provides a snapshot of each and every chart view, with
each of the controls so they Figure 3: The ASPxGridView the required explanation and customization features (see
control after selecting the
can make efficient use of Figure 4). This should help developers in making decisions
Header Filter feature.
them easily. during the development stage.

The column headers can now be displayed as filter drop-
down buttons with the help of the Header Filter feature
included with the current build. This feature enables a user
to dynamically filter a column based on a unique value
(see Figures 2 and 3). It also reduces the search time for
locating specific data from the Grid for large databases. I
was amazed to see that I was able to implement this func-
tionality directly from the Properties window.
There is absolutely no need for developers to write a sin-
gle line of code for performing standard tasks. However,
coding may be required for advanced projects (depending
on the nature of the application being developed). The
next component in my pipeline was Menus. I was able to
design a simple menu by making use
of the various styles. A key feature
is that menu items and correspond-
ing URLs can be directly added from
within the smart tag, and the required
changes are reflected immediately.
XtraReports comes with a full-blown designer, as well as the
ability to create subreports. It seamlessly integrates with Visual
Studio, with support for Mail Merge, Master-Detail, Data Filter-
ing, and Grouping. It ships with lots of native controls, such
as Label, Line, BarCode, CheckBox, PageInfo, Panel, Picture-
Box, PageBreak, Table, and ZipCode, along with an enhanced
RichText control and Report Explorer. XtraReports enables you
to integrate your reporting applications with the XtraReports
Toolbar from within the Visual Studio IDE, as well as preview
the generated report before its distribution. A notable feature is
that it ships with a report wizard that guides you in the report-
creation activities.
“DXperience Universal” continued on page 47

I also tested a few other controls, and

was able to work with them very easily.
DevExpress’ main goal was to simplify
programming time; they have achieved
this through the components included
in the DXperience suite.

And although my main objective was

to measure the performance of the
components designed for ASP.NET,
I also tested a few of the controls
oriented for Windows Forms; they
all worked like a charm. As men-
tioned, the product is bundled with
components designed for integrating Figure 4: Chart demo in action.

asp.netPRO | October 2008 45

 B o o k Re p or t
ADO.NET 3.5 Cookbook
O
ne reason I often buy a book is because it solves
a particular problem I am having writing an
application; solving one problem in the middle of
a project can easily be worth the price of a book (which is
why I like the whole O’Reilly series of Cookbooks).
For example, let’s look at the first “recipe” in Bill Hamilton’s
ADO.NET 3.5 Cookbook, “Storing Connection Strings.” If
you are new to .NET database programming (and maybe
even if you are not so new), you need to know how to store
database connection strings. In .NET you have a number of
options as to where to store connection strings. What are
they, and which one is right for your situation? This recipe
covers storing connection strings in the application, the reg-
istry, Universal Data Link files (UDL), and custom files. This
section explains the advantages and disadvantages, security
ramifications, and ease of modifying each; it also provides
detailed instructions on how to use each of the preferred
options. The book continues to do this for more than two
hundred recipes divided into twelve chapters.
The first chapter covers connecting to databases, including
connecting to databases using Excel and text files, and how
to use connection pooling. Chapter 2 details working with
disconnected data objects. Chapter 3 goes over retrieving
data from databases, including hierarchical data; reading
data from databases, text files, and Excel worksheets; and
querying using LINQ. Chapter 4 explains how to search
and analyze data, including sorting, filtering, recursive
queries, and even how to access deleted rows (but only
before AcceptChanges is called). Chapter 5 covers adding
and modifying data.
Chapter 6 details copying and transferring data. It covers
moving data between data tables, as well as between data
tables, data sets, and data readers. It also explains how to
serialize and deserialize data. It shows how to export the
results of a query to a string or an array. As a bonus, it shows
how to read and write from and to legacy ADO databases.
Chapter 7 details maintaining database integrity using trans-
actions, checking for concurrency conflicts, resolving data
conflicts, and using column expressions to enforce business
46 October 2008 | www.aspnetPRO.com
§ By Dennis Hayes
rules. Chapter 8 has complete coverage of data binding in
both Web Forms and Windows Forms. Chapter 9 covers XML
data, including schemas, XPath, and SQL Server XML data.
Chapter 10 shows how to optimize data access in .NET
with examples of executing multiple commands on a single
connection, bulk loading and copying, batch updates, and
working with large data from Oracle databases.
Chapter 11 explains how to work with database metadata,
including retrieving metadata, and information on columns
(length, default types, etc.). It details how to retrieve a SQL
Server query plan (I didn’t know you could do that with
software). It shows how to create new databases and add
tables and relationships to a database. It continues with how
to enumerate different types of data providers (.NET, OLE
DB, ODBC, SQL), and closes by showing how to program-
matically change SQL Server passwords.
The final chapter covers CLR integration, which allows the
use of .NET inside SQL Server, such as using C# or other
.NET-compatible languages to create stored procedures.
The book ends with an appendix that lists the changes in
ADO.NET since version 1.0.
This Cookbook has an incredible 900+ pages of short
examples showing how to perform specific tasks. If you are
an experienced ADO.NET programmer, this book will pay
for itself many times over by speeding you through every-
day tasks. If you are learning ADO.NET, the best way is
by writing ADO.NET code — this book will keep you from
getting stuck by showing not only the how, but the why
of coding ADO.NET. Regardless of your skill level, this is a
book you cannot afford to be without. </>
ADO.NET 3.5 Cookbook
Bill Hamilton
Rating: 
Publisher: O’Reilly
ISBN: 978-0-596-10140-4
Web Site: www.oreilly.com
Price: US$54.99
Page Count: 980
 Advertising Index DXperience Universal
(continued from page 45)
/n software ................................................................................ 41
Altova GmbH............................................................................. 11 DevExpress constantly provides updates and new products as
aspDotNetStoreFront.com........................................................ 21 and when a new technology/framework is released. At the
ASPOSE ...................................................................................... 7 time of this writing they were scheduled to release and show-
asp.netPRO ............................................................................... 32 case the beta of a new grid control for WPF and Silverlight,
asp.netPRO CD Works .............................................................. 37 which promises new features for these new platforms. With
ceTe Software.................................................. Inside Back Cover this new control, developers can use the grid to develop appli-
ComponentArt.......................................................................... 4-5 cations powered by Silverlight and/or WPF technology.
ComponentOne, LLC .................................. Outside Back Cover
DevConnections........................................................................ 17
DevExpress provides standard controls such as Button, Label,
Developer Express.................................................. 29, 31, 33, 35
TextBox, RadioButton, and many more, which enables you
DiscountASP ............................................................................. 39
to develop applications completely using the product without
dotNetVideos.net ...................................................................... 18
depending on the controls included with the .NET Framework.
dtSearch.................................................................................... 28
This enables you to develop applications with a uniform look
FarPoint Technologies ................................................................ 3
and feel. You also can develop and integrate your own themes
Infragistics ................................................... Inside Front Cover, 1
Syncfusion ................................................................................ 43 if you are an advanced developer.
Telerik ................................................................................... 24-25
Text Control ................................................................................. 9 I am very much impressed by the support provided By
DevExpress. They reply to all queries very systematically,
depending on the severity of the problem. In fact, they have
ASP.NET Crossword Puzzle (Answers) developed a dedicated support portal (www.devexpress.com/
(continued from page 6) Support/) that lists all the available options, including a com-
prehensive knowledge base, documentation, and online video
1
demonstrations presented by the support team and other
T
product team members. They also manage a blog, from which
H
2
M A
3
S T E R P A G E F I L E you can learn tips and tricks included with each product.
E S
S
4
O
5
S H O W M E S S A G E B O X
The entire product line is very extensive and it may take a
U I
6
H couple of days for a developer to become accustomed with it
7

8
T O
9 10
S E L E C T E D I T E M (depending on their skill level). Depending on the creativity
P A N E L I M
U R
11
X H T
12
M L L
and imagination, a developer can build any type of applica-
T
13
P R O X Y T A
14
B I R E A K P O I N T S tion, be it pure Windows-based word processing software or
C
15
O T I U
16
E
an ASP.NET-based online invoicing system. </>
A P R E C O M P I L A T I O N L X
C M H L I T
17 18 19
H E T R A C E D A T A S E T W Anand Narayanaswamy, a Microsoft Most Valuable Professional
E S N T E R
20
(MVP), works as an independent consultant based in Trivandrum,
S D I S P O S E D E X I
21
L O C A L S L N T T
India. Anand also works as chief technical editor for ASPAlliance.com.
22
G R E S O U R C E E M E He is the author of Community Server Quickly (www.packtpub.com/
23 R O
O D E D O M R R
C
community-server/book). He runs www.learnxpress.com,
S D
E www.dotnetalbum.com, www.csharpfaq.com, www.computerbook-
reviews.org, and www.devreviews.com. Find out more about him at
www.visualanand.net. He can be reached at visualanand@gmail.com.

asp.netPRO is published monthly by Informant Communications Group, Inc., 5105
Florin-Perkins Road, Sacramento, California, 95826-4817. Basic one-year subscription
rates: U.S. $34.99, Canada $44.99, all other countries $79.99, must be prepaid in U.S.
dollars drawn on a U.S. bank. Printed in the USA.
Postage paid at Elk Grove, CA and additional mailing offices. POSTMASTER: Send
address changes to asp.netPRO, 5105 Florin-Perkins Road, Sacramento, California,
95826-4817. Post International Publications Mail Product (Canadian Distribution) Sales
Agreement No. 40028783. Subscription inquiries and orders should be directed to the
Circulation Department, asp.netPRO, 5105 Florin-Perkins Road, Sacramento, California,
95826-4817, Phone 916-379-0609, Fax 916-379-0610. Code listings may be downloaded
from the asp.netPRO Web site at www.aspnetPRO.com.
Informant Communications Group, Inc. assumes no responsibility whatsoever for
the uses made of any software code in this issue, whether modified or not. Informant
Communications Group, Inc. will not be liable for special, incidental, consequential,
indirect, or other similar damages, even if we have been advised of the possibility of such
damages. In no event will our liability for any damages to you or any other person ever
exceed the price paid for your subscription to asp.netPRO, regardless of any form of the
claim. Editorial contained within does not necessarily reflect the opinions of Informant
Communications Group, Inc. Informant Communications Group, Inc. assumes no respon-
sibility for the products or services advertised within this publication.
Copyright©2008 Informant Communications Group, Inc. All rights reserved. No part of
this publication may be reproduced in any way without the written consent of Informant
Communications Group, Inc. asp.netPRO is a publication of Informant Communications
Group, Inc. and is not sponsored by or affiliated with Microsoft Corporation. Microsoft is
not responsible in any way for the editorial policy or other contents of this publication.
We welcome your comments and suggestions about the content of asp.netPRO, as
well as your commentary on the subject of ASP.NET development. We reserve the right
to edit all submissions. Letters should include your name and address. Please direct all
letters to asp.netPRO, ATTN: Letters, 5105 Florin-Perkins Road, Sacramento, California,
95826-4817. Letters may also be sent via e-mail to letters@aspnetPRO.com.
Informant is a registered trademark of Informant Communications Group, Inc., Elk
Grove, California. Microsoft and Visual Basic are trademarks of Microsoft Corporation
and asp.netPRO is used by Informant Communications Group, Inc. under license from
owner. Windows is a trademark of Microsoft Corporation. All other products men-
tioned within are trademarks of their respective owners.
Microsoft, Visual Basic, Visual Studio, MSDN, ASP.NET, and the Visual Studio, .NET,
Microsoft Office, and Visual Basic Logos are registered trademarks or trademarks of
Microsoft Corporation in the United States and/or other countries and are used by
LICENSEE under license from owner. asp.netPRO, C# PRO, Informant, Microsoft Office
Solutions Conference, and ASP.NET and XML Web Services Solutions Conference are
trademarks or registered trademarks of Informant Communications Group, Inc.
Writers interested in having works published in asp.netPRO may obtain a style guide
by e-mailing David Riggs at driggs@informant.com. For direct mailings/e-mailings to
our subscriber list please contact Rich Parker at rich@directmedia.com.

asp.netPRO | October 2008 47

 B a c k D r a f t
Spreading the Word
U
nless you’ve been living in Antarctica for the
past year or so, you’ve undoubtedly heard of
Microsoft’s dynamic new cross-platform Web
development and video streaming technology, Silverlight,
which is based on Windows Presentation Foundation
(WPF). I’ve noted several times in this column that
Silverlight stands to play an important role in the future
of Web development. That is, if it catches on.
What do I mean, “if it catches on”? We’re all on board,
right? I agree that Microsoft is beginning to make great
strides in attracting Silverlight developers (much more
so than for its big brother, WPF, but that’s a whole differ-
ent topic). Regardless of how compelling it is to us devel-
opers, though, Silverlight will only reach critical mass if
the runtime that is required to be installed on the client
goes mainstream.
Enter the Summer Olympics. In a brilliant move, Microsoft
and NBC teamed up to create NBCOlympics.com, a Web site
that offers thousands of hours of Olympics video footage,
available on-demand. All you need to do is download and
install the Silverlight runtime. Perfect! As I write this, millions
of users are installing Silverlight. We win!
Well, not exactly. The big problem is that NBC only pur-
chased the broadcast rights to the Olympics in the United
States. So, they have been forced to restrict access to the
NBCOlympics.com Web site to IP addresses originating in
the United States. So, aside from a few clever folks (names
omitted to protect the guilty) who are playing some VPN
tricks to gain access to the site from abroad, the big Silver-
light coming out party is pretty much restricted to those of
us who are States-side.
I’ve been accused in the past of being a bit of an ethno-
centrist, but even I can see that Microsoft needs a break-out
application that has international visibility to push Silver-
light out to the rest of the world (which, as it turns out, is a
48 October 2008 | www.aspnetPRO.com
§ By Jonathan Goodyear
lot bigger than the United States). Microsoft is doing a pretty
decent job of putting Silverlight applets on many of their
Web properties, but most of those don’t have broad appeal
beyond software developers and business users. What
surprises me greatly is that MSN Video (e.g., SoapBox) is
still powered by Flash. In my opinion, Microsoft should be
pushing to re-deploy MSN Video powered by Silverlight as
soon as possible. Even though Silverlight 2.0 is still in beta,
if it can power NBCOlympics.com, I’m confident that MSN
Video won’t be any trouble.
An even bigger win would be if Microsoft could convince
the big social network Web sites to utilize Silverlight
applets. Given Microsoft’s large ownership stake in Face-
book, I think that it would be the most logical target. A
few enterprising folks have created small Silverlight Face-
book applications and games, which (if any of them catch
on) could help tremendously on the Silverlight adoption
front. Mass adoption, however, will only come with the
implementation of Silverlight-based banner advertise-
ments that appear site-wide.
Regardless of how Silverlight does among the masses, it will
likely gain appeal quickly in the controlled environments
of corporations who will immediately see the benefit of
more powerful Web applications with frictionless deploy-
ment. With huge sites like YouTube still using Flash, though,
Microsoft has a very difficult task ahead of them when it
comes to driving end-user adoption of Silverlight. Microsoft
always seems to have a few tricks up their sleeve, though,
so I never count them out. </>
Jonathan Goodyear is president of ASPSOFT (www.aspsoft.com), an
Internet consulting firm based in Orlando, FL. Jonathan is Microsoft
Regional Director for Florida, an ASP.NET MVP, a Microsoft Certified
Solution Developer (MCSD), and co-author of ASP.NET 2.0 MVP
Hacks (Wrox). Jonathan also is a contributing editor for asp.netPRO.
E-mail him at jon@aspsoft.com or through his angryCoder eZine at
www.angryCoder.com.
 ����������������������������������������������������

��������������� �����������������
���������������������������� �����������������
������������������ ����������������������������������������������������������������������������
����������������������������������������������������������
�����������������������������������������������������������������������������������������
����������������������������������
��������������������������������������
������������������������������ ������������������������������������������������
��������������������������������������������� ����������������������������������������������
���������������������������������������������� ������������������������������������
������������������������������������������ ����������������������������������������������������
�������������������������������������
�����������������������������������������
��������������������
�������������������������������
����������������������������������������������������
���������������������������������������������������
��������������������������������������������������������������

�������������������������������������
������������������������������������������������������������
���������������������������������������������������������
�������������������������������������������������
��������������������������������������������������

���������������������������������������������������������������������

������������������������������������������������������������������������������������������������������������������������
������������������������������������������������������������������������������������������������������������������
�����������������������������������������������������������������������������������������������������������������������
�����������������������������������������������������������������������
 ����������������������������������������������������
��������������������������������������������������������������
�����������������������������
� ���������������������������������������������������������������

� ��������������������������������������������������������

� ����������������������������������������������������
�����������������
� �����������������������������������������������
����������������������������
������ ��� �����������������������
������������� ����
� �����������������������������������������������������������������

����������������������������
������������������������� �������������������������
�������������������������������������������������
���������������������

�������� ����������� ������������ ������������� ��������������������� ��������� ������������� ����������� ���

������������������ ��� ���������������������� ���� ���� ����� �

�������������� ����������������������������
�����������������
�������� � �������� � ���� � ����������� � ��������� �������
�����������������������������������������������������������������������������������������������������������