From 0e587f13bcf97dd91c9cb1cfc671ba091792ec5a Mon Sep 17 00:00:00 2001 From: NextTurn <45985406+NextTurn@users.noreply.github.com> Date: Tue, 25 Jun 2019 00:00:00 +0800 Subject: [PATCH 1/3] Replace IIS 6.0 tokens --- .../wcf/feature-details/choosing-a-transport.md | 2 +- .../delegation-and-impersonation-with-wcf.md | 2 +- ...internet-information-services-hosted-wcf-service.md | 4 ++-- .../hosting-in-a-windows-service-application.md | 2 +- .../hosting-in-internet-information-services.md | 6 +++--- .../hosting-in-windows-process-activation-service.md | 2 +- .../wcf/feature-details/http-transport-security.md | 4 ++-- ...rnet-information-services-hosting-best-practices.md | 2 +- .../wcf/feature-details/net-tcp-port-sharing.md | 2 +- .../wcf/feature-details/transport-security-overview.md | 10 +++++----- .../web-hosting-a-queued-application.md | 2 +- docs/framework/wcf/hosting-services.md | 8 ++++---- .../wcf/how-to-impersonate-a-client-on-a-service.md | 2 +- ...flow-service-registration-tool-wfservicesreg-exe.md | 2 +- 14 files changed, 25 insertions(+), 25 deletions(-) diff --git a/docs/framework/wcf/feature-details/choosing-a-transport.md b/docs/framework/wcf/feature-details/choosing-a-transport.md index 08a7bd281c611..2f5314256aff7 100644 --- a/docs/framework/wcf/feature-details/choosing-a-transport.md +++ b/docs/framework/wcf/feature-details/choosing-a-transport.md @@ -47,7 +47,7 @@ This topic discusses criteria for choosing among the three main transports that |Attribute|Description|Favored transports| |---------------|-----------------|------------------------| |Diagnostics|Diagnostics allow you to automatically detect transport connectivity problems. All transports support the ability to send back fault information that describes connectivity. However, WCF does not include diagnostic tools for investigating network issues.|None| -|Hosting|All WCF endpoints must be hosted inside an application. [!INCLUDE[iis601](../../../../includes/iis601-md.md)] and earlier support only hosting applications that use the HTTP transport. On [!INCLUDE[wv](../../../../includes/wv-md.md)], support is added for hosting all WCF transports, including TCP and named pipes. For more information, see [Hosting in Internet Information Services](../../../../docs/framework/wcf/feature-details/hosting-in-internet-information-services.md) and [Hosting in Windows Process Activation Service](../../../../docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md).|HTTP| +|Hosting|All WCF endpoints must be hosted inside an application. IIS 6.0 and earlier support only hosting applications that use the HTTP transport. On [!INCLUDE[wv](../../../../includes/wv-md.md)], support is added for hosting all WCF transports, including TCP and named pipes. For more information, see [Hosting in Internet Information Services](../../../../docs/framework/wcf/feature-details/hosting-in-internet-information-services.md) and [Hosting in Windows Process Activation Service](../../../../docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md).|HTTP| |Inspection|Inspection is the ability to extract and process information from messages during transmission. The HTTP protocol separates routing and control information from data, making it easier to build tools that inspect and analyze messages. Transports that are easy to inspect may also require less processing power in network appliances. The level of security used impacts whether messages can be inspected.|HTTP| |Latency|Latency is the minimum amount of time required to complete an exchange of messages. All network operations have more or less latency depending on the choice of transport. Using duplex or one-way communication with a transport whose native message exchange pattern is request-reply, such as HTTP, can cause additional latency due to the forced correlation of messages. In this situation, consider using a transport whose native message exchange pattern is duplex, such as TCP.|TCP, Named

Pipe| |Reach|The reach of a transport reflects how capable the transport is at connecting with other systems. The named pipe transport has very little reach; it can only connect to services running on the same machine. The TCP and HTTP transports both have excellent reach and can penetrate some NAT and firewall configurations. For more information, see [Working with NATs and Firewalls](../../../../docs/framework/wcf/feature-details/working-with-nats-and-firewalls.md).|HTTP, TCP| diff --git a/docs/framework/wcf/feature-details/delegation-and-impersonation-with-wcf.md b/docs/framework/wcf/feature-details/delegation-and-impersonation-with-wcf.md index b6f084bb5a6a9..3c1b9b2cf2858 100644 --- a/docs/framework/wcf/feature-details/delegation-and-impersonation-with-wcf.md +++ b/docs/framework/wcf/feature-details/delegation-and-impersonation-with-wcf.md @@ -51,7 +51,7 @@ ms.assetid: 110e60f7-5b03-4b69-b667-31721b8e3152 The extent to which the service can impersonate the client depends on the privileges the service account holds when it attempts impersonation, the type of impersonation used, and possibly the extent of impersonation the client permits. > [!NOTE] -> When the client and service are running on the same computer and the client is running under a system account (for example, `Local System` or `Network Service`), the client cannot be impersonated when a secure session is established with stateful Security Context tokens. A Windows Form or console application typically runs under the currently logged-in account, so that account can be impersonated by default. However, when the client is an ASP.NET page and that page is hosted in [!INCLUDE[iis601](../../../../includes/iis601-md.md)] or [!INCLUDE[iisver](../../../../includes/iisver-md.md)], then the client does run under the `Network Service` account by default. All of the system-provided bindings that support secure sessions use a stateless security context token (SCT) by default. However, if the client is an ASP.NET page, and secure sessions with stateful SCTs are used, the client cannot be impersonated. For more information about using stateful SCTs in a secure session, see [How to: Create a Security Context Token for a Secure Session](../../../../docs/framework/wcf/feature-details/how-to-create-a-security-context-token-for-a-secure-session.md). +> When the client and service are running on the same computer and the client is running under a system account (for example, `Local System` or `Network Service`), the client cannot be impersonated when a secure session is established with stateful Security Context tokens. A Windows Form or console application typically runs under the currently logged-in account, so that account can be impersonated by default. However, when the client is an ASP.NET page and that page is hosted in IIS 6.0 or [!INCLUDE[iisver](../../../../includes/iisver-md.md)], then the client does run under the `Network Service` account by default. All of the system-provided bindings that support secure sessions use a stateless security context token (SCT) by default. However, if the client is an ASP.NET page, and secure sessions with stateful SCTs are used, the client cannot be impersonated. For more information about using stateful SCTs in a secure session, see [How to: Create a Security Context Token for a Secure Session](../../../../docs/framework/wcf/feature-details/how-to-create-a-security-context-token-for-a-secure-session.md). ## Impersonation in a Service Method: Declarative Model Most impersonation scenarios involve executing the service method in the caller context. WCF provides an impersonation feature that makes this easy to do by allowing the user to specify the impersonation requirement in the attribute. For example, in the following code, the WCF infrastructure impersonates the caller before executing the `Hello` method. Any attempt to access native resources inside the `Hello` method succeed only if the access control list (ACL) of the resource allows the caller access privileges. To enable impersonation, set the property to one of the enumeration values, either or , as shown in the following example. diff --git a/docs/framework/wcf/feature-details/deploying-an-internet-information-services-hosted-wcf-service.md b/docs/framework/wcf/feature-details/deploying-an-internet-information-services-hosted-wcf-service.md index b61ba7827ffc4..15cdbc1588b54 100644 --- a/docs/framework/wcf/feature-details/deploying-an-internet-information-services-hosted-wcf-service.md +++ b/docs/framework/wcf/feature-details/deploying-an-internet-information-services-hosted-wcf-service.md @@ -37,7 +37,7 @@ The installation process for .NET Framework automatically registers WCF with IIS IIS-hosted WCF services must reside inside of an IIS application. You can create a new IIS application to host WCF services exclusively. Alternatively, you can deploy an WCF service into an existing application that is already hosting ASP.NET 2.0 content (such as .aspx pages and ASP.NET Web services [ASMX]). For more information about these options, see the "Hosting WCF Side-by-Side with ASP.NET" and "Hosting WCF Services in ASP.NET Compatibility Mode" sections in [WCF Services and ASP.NET](wcf-services-and-aspnet.md). -Note that [!INCLUDE[iis601](../../../../includes/iis601-md.md)] and later versions periodically restart an isolated object-oriented programming application. The default value is 1740 minutes. The maximum value supported is 71,582 minutes. This restart can be disabled. For more information about this property, see the [PeriodicRestartTime](https://go.microsoft.com/fwlink/?LinkId=109968). +Note that IIS 6.0 and later versions periodically restart an isolated object-oriented programming application. The default value is 1740 minutes. The maximum value supported is 71,582 minutes. This restart can be disabled. For more information about this property, see the [PeriodicRestartTime](https://go.microsoft.com/fwlink/?LinkId=109968). ## Create an .svc File for the WCF Service @@ -97,7 +97,7 @@ You must always use relative endpoint addresses for IIS-hosted service endpoints ### Available Transports -WCF services hosted in IIS 5.1 and [!INCLUDE[iis601](../../../../includes/iis601-md.md)] are restricted to using HTTP-based communication. On these IIS platforms, configuring a hosted service to use a non-HTTP binding results in an error during service activation. For [!INCLUDE[iisver](../../../../includes/iisver-md.md)], the supported transports include HTTP, Net.TCP, Net.Pipe, Net.MSMQ, and msmq.formatname for backwards compatibility with existing MSMQ applications. +WCF services hosted in IIS 5.1 and IIS 6.0 are restricted to using HTTP-based communication. On these IIS platforms, configuring a hosted service to use a non-HTTP binding results in an error during service activation. For [!INCLUDE[iisver](../../../../includes/iisver-md.md)], the supported transports include HTTP, Net.TCP, Net.Pipe, Net.MSMQ, and msmq.formatname for backwards compatibility with existing MSMQ applications. ### HTTP Transport Security diff --git a/docs/framework/wcf/feature-details/hosting-in-a-windows-service-application.md b/docs/framework/wcf/feature-details/hosting-in-a-windows-service-application.md index 411a859a209f4..914f1dc2581ba 100644 --- a/docs/framework/wcf/feature-details/hosting-in-a-windows-service-application.md +++ b/docs/framework/wcf/feature-details/hosting-in-a-windows-service-application.md @@ -14,7 +14,7 @@ Windows services (formerly known as Windows NT services) provide a process model - The process that hosts your application must remain running once started. Once started, a Windows service process remains running unless explicitly shut down by a server administrator using the service control manager. Applications hosted in IIS or WAS may be started and stopped dynamically to make optimal use of system resources. Applications that require explicit control over the lifetime of their hosting process should use Windows services instead of IIS or WAS. -- Your WCF service must run on Windows Server 2003 and use transports other than HTTP. On Windows Server 2003, the [!INCLUDE[iis601](../../../../includes/iis601-md.md)] hosting environment is restricted to HTTP communication only. Windows service applications are not subject to this restriction and can use any transport WCF supports, including net.tcp, net.pipe, and net.msmq. +- Your WCF service must run on Windows Server 2003 and use transports other than HTTP. On Windows Server 2003, the IIS 6.0 hosting environment is restricted to HTTP communication only. Windows service applications are not subject to this restriction and can use any transport WCF supports, including net.tcp, net.pipe, and net.msmq. ### To host WCF inside of a Windows service application diff --git a/docs/framework/wcf/feature-details/hosting-in-internet-information-services.md b/docs/framework/wcf/feature-details/hosting-in-internet-information-services.md index 1b5ba07091ef3..89cc5cf78659e 100644 --- a/docs/framework/wcf/feature-details/hosting-in-internet-information-services.md +++ b/docs/framework/wcf/feature-details/hosting-in-internet-information-services.md @@ -13,9 +13,9 @@ One option for hosting Windows Communication Foundation (WCF) services is inside - IIS 5.1 on [!INCLUDE[wxpsp2](../../../../includes/wxpsp2-md.md)]. This environment is useful for the design and development of IIS-hosted applications that are later deployed on a server operating system such as [!INCLUDE[ws2003](../../../../includes/ws2003-md.md)]. -- [!INCLUDE[iis601](../../../../includes/iis601-md.md)] on [!INCLUDE[ws2003](../../../../includes/ws2003-md.md)]. [!INCLUDE[iis601](../../../../includes/iis601-md.md)] provides an advanced process model that offers improved scalability, reliability, and application isolation. This environment is suitable for production deployment of WCF services that use HTTP communication exclusively. +- IIS 6.0 on [!INCLUDE[ws2003](../../../../includes/ws2003-md.md)]. IIS 6.0 provides an advanced process model that offers improved scalability, reliability, and application isolation. This environment is suitable for production deployment of WCF services that use HTTP communication exclusively. -- IIS 7.0 on [!INCLUDE[wv](../../../../includes/wv-md.md)] and [!INCLUDE[lserver](../../../../includes/lserver-md.md)]. IIS 7.0 provides the same advanced process model as [!INCLUDE[iis601](../../../../includes/iis601-md.md)], but uses the Windows Process Activation Service (WAS) to allow activation and network communication over protocols other than HTTP. This environment is suitable for the development of WCF services that communicate over any network protocol supported by WCF (including HTTP, net.tcp, net.pipe, and net.msmq). For more information about WAS, see [Hosting in Windows Process Activation Service](../../../../docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md). +- IIS 7.0 on [!INCLUDE[wv](../../../../includes/wv-md.md)] and [!INCLUDE[lserver](../../../../includes/lserver-md.md)]. IIS 7.0 provides the same advanced process model as IIS 6.0, but uses the Windows Process Activation Service (WAS) to allow activation and network communication over protocols other than HTTP. This environment is suitable for the development of WCF services that communicate over any network protocol supported by WCF (including HTTP, net.tcp, net.pipe, and net.msmq). For more information about WAS, see [Hosting in Windows Process Activation Service](../../../../docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md). - [Windows Server AppFabric](https://go.microsoft.com/fwlink/?LinkId=196496) works with [!INCLUDE[iisver](../../../../includes/iisver-md.md)] and Windows Process Activation Service (WAS) to provide a rich application hosting environment for NET4 WCF and WF services. These benefits include process life-cycle management, process recycling, shared hosting, rapid failure protection, process orphaning, on-demand activation, and health monitoring. For detailed information, see [AppFabric Hosting Features](https://go.microsoft.com/fwlink/?LinkId=196494) and [AppFabric Hosting Concepts](https://go.microsoft.com/fwlink/?LinkId=196495). @@ -30,7 +30,7 @@ One option for hosting Windows Communication Foundation (WCF) services is inside - WCF services hosted in IIS use the same dynamic compilation model as ASP.NET 2.0, which simplifies development and deployment of hosted services. - When deciding to host WCF services in IIS, it is important to remember that IIS 5.1 and [!INCLUDE[iis601](../../../../includes/iis601-md.md)] are limited to HTTP communication only. For more information about choosing a hosting environment, see [Hosting Services](../../../../docs/framework/wcf/hosting-services.md). + When deciding to host WCF services in IIS, it is important to remember that IIS 5.1 and IIS 6.0 are limited to HTTP communication only. For more information about choosing a hosting environment, see [Hosting Services](../../../../docs/framework/wcf/hosting-services.md). ## Deploying an IIS-Hosted WCF Service Developing and deploying an IIS-hosted WCF service consists of the following tasks: diff --git a/docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md b/docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md index acbed4cea93ea..11ac759f27ca6 100644 --- a/docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md +++ b/docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md @@ -6,7 +6,7 @@ helpviewer_keywords: ms.assetid: d2b9d226-15b7-41fc-8c9a-cb651ac20ecd --- # Hosting in Windows Process Activation Service -The Windows Process Activation Service (WAS) manages the activation and lifetime of the worker processes that contain applications that host Windows Communication Foundation (WCF) services. The WAS process model generalizes the [!INCLUDE[iis601](../../../../includes/iis601-md.md)] process model for the HTTP server by removing the dependency on HTTP. This allows WCF services to use both HTTP and non-HTTP protocols, such as Net.TCP, in a hosting environment that supports message-based activation and offers the ability to host a large number of applications on a given machine. +The Windows Process Activation Service (WAS) manages the activation and lifetime of the worker processes that contain applications that host Windows Communication Foundation (WCF) services. The WAS process model generalizes the IIS 6.0 process model for the HTTP server by removing the dependency on HTTP. This allows WCF services to use both HTTP and non-HTTP protocols, such as Net.TCP, in a hosting environment that supports message-based activation and offers the ability to host a large number of applications on a given machine. For more information about building a WCF service that runs in the WAS hosting environment, see [How to: Host a WCF Service in WAS](../../../../docs/framework/wcf/feature-details/how-to-host-a-wcf-service-in-was.md). diff --git a/docs/framework/wcf/feature-details/http-transport-security.md b/docs/framework/wcf/feature-details/http-transport-security.md index c8dbdfc766cf5..150a939018c70 100644 --- a/docs/framework/wcf/feature-details/http-transport-security.md +++ b/docs/framework/wcf/feature-details/http-transport-security.md @@ -37,9 +37,9 @@ When using HTTP as the transport, security is provided by a Secure Sockets Layer To configure certificates for use with [!INCLUDE[iisver](../../../../includes/iisver-md.md)], see [IIS 7.0 Beta: Configuring Server Certificates in IIS 7.0](https://go.microsoft.com/fwlink/?LinkID=88595). #### IIS 6.0 - To set up [!INCLUDE[iis601](../../../../includes/iis601-md.md)] as a secure host (using SSL), see [Configuring Secure Sockets Layer](https://go.microsoft.com/fwlink/?LinkId=88601). + To set up IIS 6.0 as a secure host (using SSL), see [Configuring Secure Sockets Layer](https://go.microsoft.com/fwlink/?LinkId=88601). - To configure certificates for use with [!INCLUDE[iis601](../../../../includes/iis601-md.md)], see [Certificates_IIS_SP1_Ops](https://go.microsoft.com/fwlink/?LinkId=88602). + To configure certificates for use with IIS 6.0, see [Certificates_IIS_SP1_Ops](https://go.microsoft.com/fwlink/?LinkId=88602). ### Using HttpCfg for SSL If you are creating a self-hosted WCF application, download the HttpCfg.exe tool, available at the [Windows XP Service Pack 2 Support Tools site](https://go.microsoft.com/fwlink/?LinkId=29002). diff --git a/docs/framework/wcf/feature-details/internet-information-services-hosting-best-practices.md b/docs/framework/wcf/feature-details/internet-information-services-hosting-best-practices.md index 4332ac02d3f37..9cc4e9a1764ce 100644 --- a/docs/framework/wcf/feature-details/internet-information-services-hosting-best-practices.md +++ b/docs/framework/wcf/feature-details/internet-information-services-hosting-best-practices.md @@ -10,7 +10,7 @@ This topic outlines some best practices for hosting Windows Communication Founda Implementing a WCF service as a DLL that is deployed to the \bin directory of a Web application allows you reuse the service outside of the Web application model, for example, in a test environment that may not have Internet Information Services (IIS) deployed. ## Service Hosts in IIS-Hosted Applications - Do not use the imperative self-host APIs to create new service hosts that listen on network transports not natively supported by the IIS hosting environment (For example, [!INCLUDE[iis601](../../../../includes/iis601-md.md)] to host TCP services, because TCP communication is not natively supported on [!INCLUDE[iis601](../../../../includes/iis601-md.md)]). This approach is not recommended. Service hosts created imperatively are not known within the IIS hosting environment. The critical point is that processing done by imperatively created services is not accounted for by IIS when it determines whether the hosting application pool is idle. The result is that applications that have such imperatively created service hosts have an IIS hosting environment that aggressively disposes of IIS host processes. + Do not use the imperative self-host APIs to create new service hosts that listen on network transports not natively supported by the IIS hosting environment (For example, IIS 6.0 to host TCP services, because TCP communication is not natively supported on IIS 6.0). This approach is not recommended. Service hosts created imperatively are not known within the IIS hosting environment. The critical point is that processing done by imperatively created services is not accounted for by IIS when it determines whether the hosting application pool is idle. The result is that applications that have such imperatively created service hosts have an IIS hosting environment that aggressively disposes of IIS host processes. ## URIs and IIS-Hosted Endpoints Endpoints for an IIS-hosted service should be configured using relative Uniform Resource Identifiers (URIs), not absolute addresses. This guarantees that the endpoint address falls within the set of URI addresses that belong to the hosting application and ensures that message-based activation happens as expected. diff --git a/docs/framework/wcf/feature-details/net-tcp-port-sharing.md b/docs/framework/wcf/feature-details/net-tcp-port-sharing.md index b1e1dfdcfdaa8..71ce0871dd6dc 100644 --- a/docs/framework/wcf/feature-details/net-tcp-port-sharing.md +++ b/docs/framework/wcf/feature-details/net-tcp-port-sharing.md @@ -16,7 +16,7 @@ Windows Communication Foundation (WCF) provides a new TCP-based network protocol The HTTP.SYS model in which traffic for many different HTTP applications is multiplexed onto a single TCP port has become standard on the Windows platform. This provides a common point of control for firewall administrators while allowing application developers to minimize the deployment cost of building new applications that can make use of the network. - The ability to share ports across multiple HTTP applications has long been a feature of Internet Information Services (IIS). However, it was only with the introduction of HTTP.SYS (the kernel-mode HTTP protocol listener) with [!INCLUDE[iis601](../../../../includes/iis601-md.md)] that this infrastructure was fully generalized. In effect, HTTP.SYS allows arbitrary user processes to share the TCP ports dedicated to HTTP traffic. This capability allows many HTTP applications to coexist on the same physical machine in separate, isolated processes while sharing the network infrastructure required to send and receive traffic over TCP port 80. The Net.TCP Port Sharing Service enables the same type of port sharing for net.tcp applications. + The ability to share ports across multiple HTTP applications has long been a feature of Internet Information Services (IIS). However, it was only with the introduction of HTTP.SYS (the kernel-mode HTTP protocol listener) with IIS 6.0 that this infrastructure was fully generalized. In effect, HTTP.SYS allows arbitrary user processes to share the TCP ports dedicated to HTTP traffic. This capability allows many HTTP applications to coexist on the same physical machine in separate, isolated processes while sharing the network infrastructure required to send and receive traffic over TCP port 80. The Net.TCP Port Sharing Service enables the same type of port sharing for net.tcp applications. ## Port Sharing Architecture The Port Sharing architecture in WCF has three main components: diff --git a/docs/framework/wcf/feature-details/transport-security-overview.md b/docs/framework/wcf/feature-details/transport-security-overview.md index d98173d70b8dd..511fd8dce7a77 100644 --- a/docs/framework/wcf/feature-details/transport-security-overview.md +++ b/docs/framework/wcf/feature-details/transport-security-overview.md @@ -41,19 +41,19 @@ Transport security mechanisms in Windows Communication Foundation (WCF) depend o The following sections discuss other client credential types. #### Basic - This corresponds to the Basic authentication method in IIS. When using this mode, the IIS server must be configured with Windows user accounts and appropriate NTFS file system permissions. For more information about [!INCLUDE[iis601](../../../../includes/iis601-md.md)], see [Enabling Basic Authentication and Configuring the Realm Name](https://go.microsoft.com/fwlink/?LinkId=88592). For more information about [!INCLUDE[iisver](../../../../includes/iisver-md.md)], see [IIS 7.0 Beta: Configure Basic Authentication](https://go.microsoft.com/fwlink/?LinkId=88593). + This corresponds to the Basic authentication method in IIS. When using this mode, the IIS server must be configured with Windows user accounts and appropriate NTFS file system permissions. For more information about IIS 6.0, see [Enabling Basic Authentication and Configuring the Realm Name](https://go.microsoft.com/fwlink/?LinkId=88592). For more information about [!INCLUDE[iisver](../../../../includes/iisver-md.md)], see [IIS 7.0 Beta: Configure Basic Authentication](https://go.microsoft.com/fwlink/?LinkId=88593). #### Certificate - IIS has an option to require clients to log on with a certificate. The feature also enables IIS to map a client certificate to a Windows account. For more information about [!INCLUDE[iis601](../../../../includes/iis601-md.md)], see [Enabling Client Certificates in IIS 6.0](https://go.microsoft.com/fwlink/?LinkId=88594). For more information about [!INCLUDE[iisver](../../../../includes/iisver-md.md)], see [IIS 7.0 Beta: Configuring Server Certificates in IIS 7.0](https://go.microsoft.com/fwlink/?LinkId=88595). + IIS has an option to require clients to log on with a certificate. The feature also enables IIS to map a client certificate to a Windows account. For more information about IIS 6.0, see [Enabling Client Certificates in IIS 6.0](https://go.microsoft.com/fwlink/?LinkId=88594). For more information about [!INCLUDE[iisver](../../../../includes/iisver-md.md)], see [IIS 7.0 Beta: Configuring Server Certificates in IIS 7.0](https://go.microsoft.com/fwlink/?LinkId=88595). #### Digest - Digest authentication is similar to Basic authentication, but offers the advantage of sending the credentials as a hash, instead of in clear text. For more information about [!INCLUDE[iis601](../../../../includes/iis601-md.md)], see [Digest Authentication in IIS 6.0](https://go.microsoft.com/fwlink/?LinkID=88443). For more information about [!INCLUDE[iisver](../../../../includes/iisver-md.md)], see [IIS 7.0 Beta: Configure Digest Authentication](https://go.microsoft.com/fwlink/?LinkId=88596). + Digest authentication is similar to Basic authentication, but offers the advantage of sending the credentials as a hash, instead of in clear text. For more information about IIS 6.0, see [Digest Authentication in IIS 6.0](https://go.microsoft.com/fwlink/?LinkID=88443). For more information about [!INCLUDE[iisver](../../../../includes/iisver-md.md)], see [IIS 7.0 Beta: Configure Digest Authentication](https://go.microsoft.com/fwlink/?LinkId=88596). #### Windows - This corresponds to integrated Windows authentication in IIS. When set to this value, the server is also expected to exist on a Windows domain that uses the Kerberos protocol as its domain controller. If the server is not on a Kerberos-backed domain, or if the Kerberos system fails, you can use the NT LAN Manager (NTLM) value described in the next section. For more information about [!INCLUDE[iis601](../../../../includes/iis601-md.md)], see [Integrated Windows Authentication in IIS 6.0](https://go.microsoft.com/fwlink/?LinkId=88597). For more information about [!INCLUDE[iisver](../../../../includes/iisver-md.md)], see [IIS 7.0 Beta: Configuring Server Certificates in IIS 7.0](https://go.microsoft.com/fwlink/?LinkId=88595). + This corresponds to integrated Windows authentication in IIS. When set to this value, the server is also expected to exist on a Windows domain that uses the Kerberos protocol as its domain controller. If the server is not on a Kerberos-backed domain, or if the Kerberos system fails, you can use the NT LAN Manager (NTLM) value described in the next section. For more information about IIS 6.0, see [Integrated Windows Authentication in IIS 6.0](https://go.microsoft.com/fwlink/?LinkId=88597). For more information about [!INCLUDE[iisver](../../../../includes/iisver-md.md)], see [IIS 7.0 Beta: Configuring Server Certificates in IIS 7.0](https://go.microsoft.com/fwlink/?LinkId=88595). #### NTLM - This enables the server to use NTLM for authentication if the Kerberos protocol fails. For more information about configuring IIS in [!INCLUDE[iis601](../../../../includes/iis601-md.md)], see [Forcing NTLM Authentication](https://go.microsoft.com/fwlink/?LinkId=88598). For [!INCLUDE[iisver](../../../../includes/iisver-md.md)], the Windows authentication includes NTLM authentication. For more information, see [IIS 7.0 Beta: Configuring Server Certificates in IIS 7.0](https://go.microsoft.com/fwlink/?LinkID=88595). + This enables the server to use NTLM for authentication if the Kerberos protocol fails. For more information about configuring IIS in IIS 6.0, see [Forcing NTLM Authentication](https://go.microsoft.com/fwlink/?LinkId=88598). For [!INCLUDE[iisver](../../../../includes/iisver-md.md)], the Windows authentication includes NTLM authentication. For more information, see [IIS 7.0 Beta: Configuring Server Certificates in IIS 7.0](https://go.microsoft.com/fwlink/?LinkID=88595). ## WsHttpBinding The class is designed for interoperation with services that implement WS-* specifications. The transport security for this binding is Secure Sockets Layer (SSL) over HTTP, or HTTPS. To create an WCF application that uses SSL, use IIS to host the application. Alternatively, if you are creating a self-hosted application, use the HttpCfg.exe tool to bind an X.509 certificate to a specific port on a computer. The port number is specified as part of the WCF application as an endpoint address. When using transport mode, the endpoint address must include the HTTPS protocol or an exception will be thrown at run time. For more information, see [HTTP Transport Security](../../../../docs/framework/wcf/feature-details/http-transport-security.md). diff --git a/docs/framework/wcf/feature-details/web-hosting-a-queued-application.md b/docs/framework/wcf/feature-details/web-hosting-a-queued-application.md index cb586af59b4f0..91d00f0e8809a 100644 --- a/docs/framework/wcf/feature-details/web-hosting-a-queued-application.md +++ b/docs/framework/wcf/feature-details/web-hosting-a-queued-application.md @@ -4,7 +4,7 @@ ms.date: "03/30/2017" ms.assetid: c7a539fa-e442-4c08-a7f1-17b7f5a03e88 --- # Web Hosting a Queued Application -The Windows Process Activation Service (WAS) manages the activation and lifetime of the worker processes that contain applications that host Windows Communication Foundation (WCF) services. The WAS process model generalizes the [!INCLUDE[iis601](../../../../includes/iis601-md.md)] process model for the HTTP server by removing the dependency on HTTP. This allows WCF services to use both HTTP and non-HTTP protocols, such as net.msmq and msmq.formatname, in a hosting environment that supports message-based activation and offers the ability to host a large number of applications on a given computer. +The Windows Process Activation Service (WAS) manages the activation and lifetime of the worker processes that contain applications that host Windows Communication Foundation (WCF) services. The WAS process model generalizes the IIS 6.0 process model for the HTTP server by removing the dependency on HTTP. This allows WCF services to use both HTTP and non-HTTP protocols, such as net.msmq and msmq.formatname, in a hosting environment that supports message-based activation and offers the ability to host a large number of applications on a given computer. WAS includes a Message Queuing (MSMQ) activation service that activates a queued application when one or more messages are placed in one of the queues used by the application. The MSMQ activation service is an NT service that is automatically started by default. diff --git a/docs/framework/wcf/hosting-services.md b/docs/framework/wcf/hosting-services.md index 35b96c8b49c77..f4c631cea7864 100644 --- a/docs/framework/wcf/hosting-services.md +++ b/docs/framework/wcf/hosting-services.md @@ -25,10 +25,10 @@ To become active, a service must be hosted within a run-time environment that cr #### Internet Information Services (IIS) The IIS hosting option is integrated with ASP.NET and uses the features these technologies offer, such as process recycling, idle shutdown, process health monitoring, and message-based activation. On the [!INCLUDE[wxp](../../../includes/wxp-md.md)] and [!INCLUDE[ws2003](../../../includes/ws2003-md.md)] operating systems, this is the preferred solution for hosting Web service applications that must be highly available and highly scalable. IIS also offers the integrated manageability that customers expect from an enterprise-class server product. This hosting option requires that IIS be properly configured, but it does not require that any hosting code be written as part of the application. For more information about how to configure IIS hosting for a WCF service, see [How to: Host a WCF Service in IIS](../../../docs/framework/wcf/feature-details/how-to-host-a-wcf-service-in-iis.md). - Note that IIS-hosted services can only use the HTTP transport. Its implementation in IIS 5.1 has introduced some limitations in [!INCLUDE[wxp](../../../includes/wxp-md.md)]. The message-based activation provided for an WCF service by IIS 5.1 on [!INCLUDE[wxp](../../../includes/wxp-md.md)] blocks any other self-hosted WCF service on the same computer from using port 80 to communicate. WCF services can run in the same AppDomain/Application Pool/Worker Process as other applications when hosted by [!INCLUDE[iis601](../../../includes/iis601-md.md)] on [!INCLUDE[ws2003](../../../includes/ws2003-md.md)]. But because WCF and [!INCLUDE[iis601](../../../includes/iis601-md.md)] both use the kernel-mode HTTP stack (HTTP.sys), [!INCLUDE[iis601](../../../includes/iis601-md.md)] can share port 80 with other self-hosted WCF services running on the same machine, unlike IIS 5.1. + Note that IIS-hosted services can only use the HTTP transport. Its implementation in IIS 5.1 has introduced some limitations in [!INCLUDE[wxp](../../../includes/wxp-md.md)]. The message-based activation provided for an WCF service by IIS 5.1 on [!INCLUDE[wxp](../../../includes/wxp-md.md)] blocks any other self-hosted WCF service on the same computer from using port 80 to communicate. WCF services can run in the same AppDomain/Application Pool/Worker Process as other applications when hosted by IIS 6.0 on [!INCLUDE[ws2003](../../../includes/ws2003-md.md)]. But because WCF and IIS 6.0 both use the kernel-mode HTTP stack (HTTP.sys), IIS 6.0 can share port 80 with other self-hosted WCF services running on the same machine, unlike IIS 5.1. #### Windows Process Activation Service (WAS) - Windows Process Activation Service (WAS) is the new process activation mechanism for the [!INCLUDE[lserver](../../../includes/lserver-md.md)] that is also available on [!INCLUDE[wv](../../../includes/wv-md.md)]. It retains the familiar [!INCLUDE[iis601](../../../includes/iis601-md.md)] process model (application pools and message-based process activation) and hosting features (such as rapid failure protection, health monitoring, and recycling), but it removes the dependency on HTTP from the activation architecture. [!INCLUDE[iisver](../../../includes/iisver-md.md)] uses WAS to accomplish message-based activation over HTTP. Additional WCF components also plug into WAS to provide message-based activation over the other protocols that WCF supports, such as TCP, MSMQ, and named pipes. This allows applications that use communication protocols to use the IIS features such as process recycling, rapid fail protection, and the common configuration system that were only available to HTTP-based applications. + Windows Process Activation Service (WAS) is the new process activation mechanism for the [!INCLUDE[lserver](../../../includes/lserver-md.md)] that is also available on [!INCLUDE[wv](../../../includes/wv-md.md)]. It retains the familiar IIS 6.0 process model (application pools and message-based process activation) and hosting features (such as rapid failure protection, health monitoring, and recycling), but it removes the dependency on HTTP from the activation architecture. [!INCLUDE[iisver](../../../includes/iisver-md.md)] uses WAS to accomplish message-based activation over HTTP. Additional WCF components also plug into WAS to provide message-based activation over the other protocols that WCF supports, such as TCP, MSMQ, and named pipes. This allows applications that use communication protocols to use the IIS features such as process recycling, rapid fail protection, and the common configuration system that were only available to HTTP-based applications. This hosting option requires that WAS be properly configured, but it does not require you to write any hosting code as part of the application. For more information about how to configure WAS hosting, see [How to: Host a WCF Service in WAS](../../../docs/framework/wcf/feature-details/how-to-host-a-wcf-service-in-was.md). @@ -39,7 +39,7 @@ To become active, a service must be hosted within a run-time environment that cr |-------------------------|----------------------|----------------------------------| |Managed Application ("Self-Hosted")|- Console applications used during development.
- Rich WinForm and WPF client applications accessing services.|- Flexible.
- Easy to deploy.
- Not an enterprise solution for services.| |Windows Services (formerly known as NT services)|- A long-running WCF service hosted outside of IIS.|- Service process lifetime controlled by the operating system, not message-activated.
- Supported by all versions of Windows.
- Secure environment.| -|IIS 5.1, [!INCLUDE[iis601](../../../includes/iis601-md.md)]|- Running a WCF service side-by-side with ASP.NET content on the Internet using the HTTP protocol.|- Process recycling.
- Idle shutdown.
- Process health monitoring.
- Message-based activation.
- HTTP only.| +|IIS 5.1, IIS 6.0|- Running a WCF service side-by-side with ASP.NET content on the Internet using the HTTP protocol.|- Process recycling.
- Idle shutdown.
- Process health monitoring.
- Message-based activation.
- HTTP only.| |Windows Process Activation Service (WAS)|- Running a WCF service without installing IIS on the Internet using various transport protocols.|- IIS is not required.
- Process recycling.
- Idle shutdown.
- Process health monitoring.
- Message-based activation.
- Works with HTTP, TCP, named pipes, and MSMQ.| |IIS 7.0|- Running a WCF service with ASP.NET content.
- Running a WCF service on the Internet using various transport protocols.|- WAS benefits.
- Integrated with ASP.NET and IIS content.| @@ -50,7 +50,7 @@ To become active, a service must be hosted within a run-time environment that cr |Managed Applications ("Self-Hosted")|[!INCLUDE[wxp](../../../includes/wxp-md.md)], [!INCLUDE[ws2003](../../../includes/ws2003-md.md)], [!INCLUDE[wv](../../../includes/wv-md.md)],

[!INCLUDE[lserver](../../../includes/lserver-md.md)]|HTTP,

net.tcp,

net.pipe,

net.msmq|No| |Windows Services (formerly known as NT services)|[!INCLUDE[wxp](../../../includes/wxp-md.md)], [!INCLUDE[ws2003](../../../includes/ws2003-md.md)], [!INCLUDE[wv](../../../includes/wv-md.md)],

[!INCLUDE[lserver](../../../includes/lserver-md.md)]|HTTP,

net.tcp,

net.pipe,

net.msmq|No| |IIS 5.1|[!INCLUDE[wxp](../../../includes/wxp-md.md)]|HTTP|Yes| -|[!INCLUDE[iis601](../../../includes/iis601-md.md)]|[!INCLUDE[ws2003](../../../includes/ws2003-md.md)]|HTTP|Yes| +|IIS 6.0|[!INCLUDE[ws2003](../../../includes/ws2003-md.md)]|HTTP|Yes| |Windows Process Activation Service (WAS)|[!INCLUDE[wv](../../../includes/wv-md.md)], [!INCLUDE[lserver](../../../includes/lserver-md.md)]|HTTP,

net.tcp,

net.pipe,

net.msmq|Yes| It is important to note that running a service or any extension from an untrusted host compromises security. Also, note that when opening a under impersonation, an application must ensure that the user is not logged off, for example by caching the of the user. diff --git a/docs/framework/wcf/how-to-impersonate-a-client-on-a-service.md b/docs/framework/wcf/how-to-impersonate-a-client-on-a-service.md index 8948e871b295b..d5bb5fedfecda 100644 --- a/docs/framework/wcf/how-to-impersonate-a-client-on-a-service.md +++ b/docs/framework/wcf/how-to-impersonate-a-client-on-a-service.md @@ -14,7 +14,7 @@ ms.assetid: 431db851-a75b-4009-9fe2-247243d810d3 Impersonating a client on a Windows Communication Foundation (WCF) service enables the service to perform actions on behalf of the client. For actions subject to access control list (ACL) checks, such as access to directories and files on a machine or access to a SQL Server database, the ACL check is against the client user account. This topic shows the basic steps required to enable a client in a Windows domain to set a client impersonation level. For a working example of this, see [Impersonating the Client](../../../docs/framework/wcf/samples/impersonating-the-client.md). For more information about client impersonation, see [Delegation and Impersonation](../../../docs/framework/wcf/feature-details/delegation-and-impersonation-with-wcf.md). > [!NOTE] -> When the client and service are running on the same computer and the client is running under a system account (that is, `Local System` or `Network Service`), the client cannot be impersonated when a secure session is established with stateful Security Context tokens. A WinForms or console application typically is run under the currently logged in account, so that account can be impersonated by default. However, when the client is an ASP.NET page and that page is hosted in [!INCLUDE[iis601](../../../includes/iis601-md.md)] or IIS 7.0, then the client does run under the `Network Service` account by default. All of the system-provided bindings that support secure sessions use a stateless Security Context token by default. However, if the client is an ASP.NET page and secure sessions with stateful Security Context tokens are used, the client cannot be impersonated. For more information about using stateful Security Context tokens in a secure session, see [How to: Create a Security Context Token for a Secure Session](../../../docs/framework/wcf/feature-details/how-to-create-a-security-context-token-for-a-secure-session.md). +> When the client and service are running on the same computer and the client is running under a system account (that is, `Local System` or `Network Service`), the client cannot be impersonated when a secure session is established with stateful Security Context tokens. A WinForms or console application typically is run under the currently logged in account, so that account can be impersonated by default. However, when the client is an ASP.NET page and that page is hosted in IIS 6.0 or IIS 7.0, then the client does run under the `Network Service` account by default. All of the system-provided bindings that support secure sessions use a stateless Security Context token by default. However, if the client is an ASP.NET page and secure sessions with stateful Security Context tokens are used, the client cannot be impersonated. For more information about using stateful Security Context tokens in a secure session, see [How to: Create a Security Context Token for a Secure Session](../../../docs/framework/wcf/feature-details/how-to-create-a-security-context-token-for-a-secure-session.md). ### To enable impersonation of a client from a cached Windows token on a service diff --git a/docs/framework/wcf/workflow-service-registration-tool-wfservicesreg-exe.md b/docs/framework/wcf/workflow-service-registration-tool-wfservicesreg-exe.md index 451cf57cbb8a3..4f41c5b9429db 100644 --- a/docs/framework/wcf/workflow-service-registration-tool-wfservicesreg-exe.md +++ b/docs/framework/wcf/workflow-service-registration-tool-wfservicesreg-exe.md @@ -50,7 +50,7 @@ WFServicesReg.exe [-c | -r | -v | -m | -i] The tool also registers .xoml and .rules scriptmaps and handlers in the IIS metabase. - On [!INCLUDE[ws2003](../../../includes/ws2003-md.md)] and [!INCLUDE[wxp](../../../includes/wxp-md.md)] machines (IIS 5.1 and [!INCLUDE[iis601](../../../includes/iis601-md.md)]), one set of .xoml and .rules scriptmaps are registered. + On [!INCLUDE[ws2003](../../../includes/ws2003-md.md)] and [!INCLUDE[wxp](../../../includes/wxp-md.md)] machines (IIS 5.1 and IIS 6.0), one set of .xoml and .rules scriptmaps are registered. On 64-bit machines, the tool registers WOW mode scriptmaps if the `Enable32BitAppOnWin64` switch is enabled, or native 64-bit scriptmaps if the `Enable32BitAppOnWin64` switch is disabled. From 46fced188b3c1acab62485dbd1a312797f9fa339 Mon Sep 17 00:00:00 2001 From: NextTurn <45985406+NextTurn@users.noreply.github.com> Date: Tue, 25 Jun 2019 00:00:00 +0800 Subject: [PATCH 2/3] Remove iis601-md.md --- includes/iis601-md.md | 1 - 1 file changed, 1 deletion(-) delete mode 100644 includes/iis601-md.md diff --git a/includes/iis601-md.md b/includes/iis601-md.md deleted file mode 100644 index b044e5e3f12db..0000000000000 --- a/includes/iis601-md.md +++ /dev/null @@ -1 +0,0 @@ -IIS 6.0 From 604e70102bb6eaa8e8e59961824b730d008f49d3 Mon Sep 17 00:00:00 2001 From: NextTurn <45985406+NextTurn@users.noreply.github.com> Date: Tue, 25 Jun 2019 00:00:00 +0800 Subject: [PATCH 3/3] earlier -> earlier versions --- docs/framework/wcf/feature-details/choosing-a-transport.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/framework/wcf/feature-details/choosing-a-transport.md b/docs/framework/wcf/feature-details/choosing-a-transport.md index 2f5314256aff7..8d45fa13f0115 100644 --- a/docs/framework/wcf/feature-details/choosing-a-transport.md +++ b/docs/framework/wcf/feature-details/choosing-a-transport.md @@ -47,7 +47,7 @@ This topic discusses criteria for choosing among the three main transports that |Attribute|Description|Favored transports| |---------------|-----------------|------------------------| |Diagnostics|Diagnostics allow you to automatically detect transport connectivity problems. All transports support the ability to send back fault information that describes connectivity. However, WCF does not include diagnostic tools for investigating network issues.|None| -|Hosting|All WCF endpoints must be hosted inside an application. IIS 6.0 and earlier support only hosting applications that use the HTTP transport. On [!INCLUDE[wv](../../../../includes/wv-md.md)], support is added for hosting all WCF transports, including TCP and named pipes. For more information, see [Hosting in Internet Information Services](../../../../docs/framework/wcf/feature-details/hosting-in-internet-information-services.md) and [Hosting in Windows Process Activation Service](../../../../docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md).|HTTP| +|Hosting|All WCF endpoints must be hosted inside an application. IIS 6.0 and earlier versions support only hosting applications that use the HTTP transport. On [!INCLUDE[wv](../../../../includes/wv-md.md)], support is added for hosting all WCF transports, including TCP and named pipes. For more information, see [Hosting in Internet Information Services](../../../../docs/framework/wcf/feature-details/hosting-in-internet-information-services.md) and [Hosting in Windows Process Activation Service](../../../../docs/framework/wcf/feature-details/hosting-in-windows-process-activation-service.md).|HTTP| |Inspection|Inspection is the ability to extract and process information from messages during transmission. The HTTP protocol separates routing and control information from data, making it easier to build tools that inspect and analyze messages. Transports that are easy to inspect may also require less processing power in network appliances. The level of security used impacts whether messages can be inspected.|HTTP| |Latency|Latency is the minimum amount of time required to complete an exchange of messages. All network operations have more or less latency depending on the choice of transport. Using duplex or one-way communication with a transport whose native message exchange pattern is request-reply, such as HTTP, can cause additional latency due to the forced correlation of messages. In this situation, consider using a transport whose native message exchange pattern is duplex, such as TCP.|TCP, Named

Pipe| |Reach|The reach of a transport reflects how capable the transport is at connecting with other systems. The named pipe transport has very little reach; it can only connect to services running on the same machine. The TCP and HTTP transports both have excellent reach and can penetrate some NAT and firewall configurations. For more information, see [Working with NATs and Firewalls](../../../../docs/framework/wcf/feature-details/working-with-nats-and-firewalls.md).|HTTP, TCP|