{"id":1002,"date":"2008-07-09T17:09:50","date_gmt":"2008-07-10T01:09:50","guid":{"rendered":"\/?p=1002"},"modified":"2008-07-09T17:51:35","modified_gmt":"2008-07-10T01:51:35","slug":"getting-down-with-zermatt","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=1002","title":{"rendered":"Getting down with Zermatt"},"content":{"rendered":"

\"\"<\/p>\n

Zermatt is a destination<\/a> in Switzerland, shown above,\u00a0that benefits from what\u00a0Nietzsche\u00a0calls “the air at high altitudes, with which everything in animal being grows more spiritual and acquires wings”.<\/p>\n

It's therefore a good code name for\u00a0the new identity application development framework Microsoft has just released in Beta form<\/a>.\u00a0 We used to call it IDFX internally\u00a0 – who knows what it will be called when it is released in final form?\u00a0<\/p>\n

Zermatt is what you use to develop interoperable\u00a0identity-aware applications that run on the Windows platform.\u00a0 We are building\u00a0the future versions of\u00a0Active Directory Federation Services (ADFS) with it, and claims-aware Microsoft applications will all use it as a foundation.\u00a0 All capabilities of the platform are open to third party developers and enterprise customers working in Windows environments.\u00a0 Every aspect of the framework\u00a0works over the wire with other products on other platforms.<\/p>\n

\u00a0I can't stress enough how important it is to\u00a0make it easy for application developers to incororate the\u00a0kind of sensible and sophisticated capabilities that\u00a0this framework\u00a0makes available.\u00a0 And everyone should understand that\u00a0our intent is\u00a0for this platform to interoperate fully<\/em> with products and frameworks produced by other vendors and open source projects, and to help the capabilities we are developing to become universal.<\/p>\n

I also want to make it clear that this is a beta.\u00a0 The goal is to\u00a0involve our developer community\u00a0in driving this towards final release.\u00a0 The beta\u00a0also makes it easy for other vendors and projects to explore every nook and cranny of our implementation and advise us of problems or work to achieve interoperability.<\/p>\n

I've been doing my own little project\u00a0using the beta Zermatt framework and will write about\u00a0the experience and share\u00a0my code.\u00a0 As an architect, I can tell you already how happy I am about the extent to which this\u00a0framework realizes the metasystem architecture we've worked so hard to define.<\/p>\n

The product comes with\u00a0a good White Paper for Developers<\/a> by Keith Brown\u00a0of Pluralsight.\u00a0 Here's how\u00a0Zermatt's main ReadMe sets out the goals of the framework.<\/p>\n

Building claims-aware applications<\/strong><\/p>\n

Zermatt makes it easier to build identity aware applications. In addition to providing a new claims model, it provides applications with a rich set of API\u2019s to reason about the identity of a caller using claims.<\/p>\n

Zermatt also provides developers with a consistent programming experience whether they choose to build their applications in ASP.NET or in WCF environments.\u00a0<\/p>\n

ASP.NET Controls<\/strong><\/p>\n

ASP.NET controls simplify development of ASP.NET pages for building claims-aware Web applications, as well as Passive STS\u2019s.<\/p>\n

Building Security Token Services (STS)<\/strong><\/p>\n

Zermatt makes it substantially easier for building a custom security token service (STS) that supports the WS-Trust protocol. These STS\u2019s are also referred to as an Active STS.<\/p>\n

In addition, the framework also provides support for building STS\u2019s that support WS-Federation to enable web browser clients. These STS\u2019s are also referred to as a Passive STS.<\/p>\n

Creating Information Cards<\/strong><\/p>\n

Zermatt\u00a0includes classes\u00a0that you can use to\u00a0create Information Cards – as well as STS's that support them.<\/p>\n

There are a whole bunch of samples, and\u00a0for identity geeks they are\u00a0incredibly interesting.\u00a0 I'll discuss what they do in another post.<\/p>\n

Follow the installation instructions!<\/strong><\/p>\n

Meanwhile, go ahead and download<\/a>.\u00a0 I'll share one word of advice.\u00a0 If you want things to run right out of the digital box, then for now slavishly<\/strong> follow the installation instructions.\u00a0 I'm the type of person who never<\/em> really looks at the ReadMe's – and I was chastened<\/strong> by the experience of\u00a0not doing what I was told.\u00a0 I went back and behaved, and the experience was flawless, so don't make the same mistake I did.<\/p>\n

For example,\u00a0there is a master installation script in the \/samples\/utilities directory called “SamplesPreReqSetup.bat”.\u00a0This is a miraculous piece of work that sets up your machine certs automatically and takes care of a great number of security configuration details.\u00a0 I know it's miraculous because initially (having skipped the readme) I thought I had to do\u00a0this configuration\u00a0manually.\u00a0 Congratulations to everyone who got this to work.<\/p>\n

You will\u00a0also\u00a0find a script in each sample directory that creates the necessary virtual directory for you.\u00a0 You need this because of the way you are expected to use the visual studio debugger.<\/p>\n

Using the debugger<\/strong><\/p>\n

In order to show\u00a0how the framework really works, the projects all involve at least a couple of aspx pages (for example, one page that acts as a relying party, and another that acts as an STS).\u00a0 So you need the ability to debug\u00a0multiple pages at once.<\/p>\n

To do this, you run the pages from a virtual directory as though they were “production” aspx pages.\u00a0 Then you attach your debugger to the w3wp.exe process (under debug, select “Attach to a process” and make sure you can see all the processes from all the sessions.\u00a0 “Wake up” the w3wp.exe process by opening a page.\u00a0 Then you'll see it in the list).\u00a0<\/p>\n

For now it's best to compile the applications in the directory where they get installed.\u00a0 It's possible that if you move the whole\u00a0tree, they can be put somewhere else (I haven't tried this with my own hands).\u00a0 But if you move a single project, it definitely won't work unless you tweak the virtual directory configuration yourself (why bother?).<\/p>\n

Clear samples<\/strong><\/p>\n

I found the samples very clear, and uncluttered with a lot of “sample decoration” that makes it hard to understand the main high level\u00a0points.\u00a0 Some of the samples have a number of components working together – the delegation sample is totally amazing – and yet it is easy, once you run the sample, to understand how the pieces fit together.\u00a0 There could be more documentation and\u00a0this will appear as the beta progresses.\u00a0<\/p>\n

The Zermatt team is really serious about collecting questions, feedback and suggestions – and responding to them.\u00a0 I hope that if you are a developer interested in identity you'll take a look and send your feedback – whether you are primarily a Windows developer or not.\u00a0 After all, our goal remains the Identity Big Bang, and getting identity deployed and cool applications written on all the different platforms.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

I found the samples very clear, and uncluttered with a lot of “sample decoration”<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[67,37,19,32,8,7,4],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1002"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1002"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1002\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}