MSDN Magazine - August 2008 - (Page 51)

NorthwindService.svc/Customers, we return all of the customers in the Customers Entity Set, in this case all of the Customers in the Northwind database. If, on the other hand, we want to return a single customer entity from the Northwind service, we could use the entity’s key value, since Customer is a single-key entity. By requesting the URI / /NorthwindService.svc/Customers(‘ALFKI’), we return the single Customer with the key “ALFKI.” The navigation property is appended to a single entity query URI in a similar manner. By appending /Customers(‘ALFKI’)/Orders, we navigate the relationship in our model between Customers and Orders, returning all of the Orders associated with the Customer identified by the key “ALFKI.” The URI format described above allows for basic query and traversal of the entities in our store, but does not account for the need to further control the output of queries or place constraints on them. To accomplish those goals, we’ll use a set of optional query string parameters supported by ADO.NET Data Services that include $filter, $expand, $orderby, $skip and $top. Query string parameters are appended to the URI following the ? character. For example, to query all customers in London, we would append the service URI with /Customers?$filter=City eq ‘London’. To query a specific customer (with key ‘ALFKI’) and retrieve the related sales orders, we would append the service URI with /Customers(‘ALFKI’) ?$expand=Orders. To sort results by City in ascending (asc) order, we would append the service URI with /Customers?$orderby=City asc (or desc for descending order). For a complete list of the URI formats supported by ADO.NET Data Services, check out the Data Services documentation, accessible from go.microsoft.com/fwlink/?LinkId=120539. Figure 3 Setting Service-Wide Access Policy public class MyService : DataService { public static void InitializeService( IDataServiceConfiguration config) { // '/Customers' entities are enabled for all read and write // operations config.SetEntitySetAccessRule("Customers", EntitySetRights.All); // URI '/Orders' is disabled, but '/Orders(1)' is enabled for read // only config.SetEntitySetAccessRule("Orders", EntitySetRights.ReadSingle); // Can insert and update, but not delete Products config.SetEntitySetAccessRule("Products", EntitySetRights.WriteInsert | EntitySetRights.WriteUpdate); } } Data Service Security Security is always the first concern when discussing a Web-based technology, especially one that provides access to and manipulation of critical data. Therefore, security has been a primary consideration throughout the development cycle of data services. To provide authentication, ADO.NET Data Services leverages much of the existing ASP.NET and WCF authentication infrastructure to allow for an integrated authentication experience across applications and through the service. If you have an ASP.NET site that uses authentication (either one of the built-in authentication providers or a custom provider that sets the HTTP context principal appropriately), ADO.NET Data Services can leverage your chosen mechanism to establish the current identity (principal) for any given request. Similarly, if your data service is hosted outside ASP.NET (WCF or via a custom host) the host may also choose to use any authentication mechanism so long as it provides APIs for a data service author to access the principal of the request. By default, any new ADO.NET Data Service is fully locked down, with all entities, Service Operations, and metadata being inaccessible with no read or write access. That said, there are a number of mechanisms for controlling authorization policy and performing per-request validations against your data service. One of the first steps that a data service developer will take is to open up access to resources exposed by the data service. In our msdnmagazine.com examples, we have shown a simple case of setting read/write access policy for the entire service. This is done for each service using the InitializeService method. The policies set were EntitySet policies allowing or restricting access to the Entity Sets in the model and setting which Entity Sets and related associations are available from the metadata endpoint of the service. Although both policies shown in those examples opened access to the entire model for reading and writing, we could have been much more specific, setting different policy for different EntitySets and including composite policies when necessary, as shown in Figure 3. In many scenarios, data services will also be required to run validation logic when entities enter the data service (for inserts, updates, or deletes) and restrict access to entities on a per-request basis. For these scenarios, you can make use of interceptors, enabling a data service developer to plug in custom validation or access policy logic into the request/response processing pipeline of a data service. For example, if we want to enable customers to retrieve only their orders and not orders placed by other customers, we would need to implement a query interceptor, as seen in Figure 4. The query interceptor returns a predicate to be appended to the query that is then pushed to the data store, eliminating the need for additional trips to the data store to retrieve access control information. Similarly, interceptors can also be added for inserts, updates, and Figure 4 Query Interceptor Method public class nw : DataService { public static void InitializeService(IDataServiceConfiguration config) { config.SetEntitySetAccessRule("Orders", EntitySetRights.All); } [QueryInterceptor("Orders")] public Expression<Func > OnQueryOrders() { return o => o.Customer.ContactName == HttpContext.Current.User.Identity.Name } } August 2008 51 http://go.microsoft.com/fwlink/?LinkId=120539 http://msdnmagazine.com

Table of Contents Feed for the Digital Edition of MSDN Magazine - August 2008

MSDN Magazine - August 2008 Toolbox CLR Inside Out Basic Instincts Cutting Edge Patterns in Practice Data 2.0 - Expose And Consume Data In A Web Services World Biztalk EDI - Build A Robust EDI Solution With BizTalk Server Silverlight - Create Animations With XAML And Expression Blend Write On! - Create Web Apps You Can Draw On With Silverlight 2 Wicked Code - Craft Custom Controls For Silverlight 2 Team System Foundations Windows With C++ Concurrent Affairs Going Places { End Bracket }

MSDN Magazine - August 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.