Extemporaneous Mumblings

Calculating the Size of Your SQL Azure Database

Ryan Dunn — Fri, 05 Mar 2010 06:05:13 GMT

In Episode 3 of Cloud Cover, I mentioned the tip of the week was how to measure your database size in SQL Azure. Here is the exact queries you can run to do it:

 

select 


      sum(reserved_page_count) * 8.0 / 1024 


from 


      sys.dm_db_partition_stats 


GO 


select 


      sys.objects.name, sum(reserved_page_count) * 8.0 /
1024 


from 


      sys.dm_db_partition_stats, sys.objects 


where 


      sys.dm_db_partition_stats.object_id = sys.objects.object_id 


group by sys.objects.name

The first one will give you the size of your database in MB and the second one will do the same, but break it out for each object in your database.

Hat tip to David Robinson and Tony Petrossian on the SQL Azure team for the query.

WASM Cmdlets Updated

Ryan Dunn — Wed, 17 Feb 2010 22:30:45 GMT

I am happy to announce the updated release of the Windows Azure Service Management (WASM) Cmdlets for PowerShell today. With these cmdlets you can effectively automate and manage all your services in Windows Azure. Specifically,

Deploy new Hosted Services
- Automatically upload your packages from the file system to blob storage.
Upgrade your services
- Choose between automatic or manual rolling upgrades
- Swap between staging and production environments
Remove your Hosted Services
- Automatically pull down your services at the end of the day to stop billing. This is a critical need for test and development environments.
Manage your Storage accounts
- Retrieve or regenerate your storage keys
Manage your Certificates
- Deploy certificates from your Windows store or the local filesystem
Configure your Diagnostics
- Remotely configure the event sources you wish to monitor (Event Logs, Tracing, IIS Logs, Performance Counters and more)
Transfer your Diagnostics Information
- Schedule your transfers or Transfer on Demand.

Why did we build this?

The WASM cmdlets were built to unblock adoption for many of our customers as well as serve as a common underpinning to our labs and internal tooling. There was an immediate demand for an automation API that would fit into the standard toolset for IT Pros. Given the adoption and penetration of PowerShell, we determined that cmdlets focused on this core audience would be the most effective way forward. Furthermore, since PowerShell is a full scripting language with complete access to .NET, this allows these cmdlets to be used as the basis for very complicated deployment and automation scripts as part of the application lifecycle.

How can you use them?

Every call to the Service Management API requires an X509 certificate and the subscription ID for the account. To get started, you need to upload a valid certificate to the portal and have it installed locally to your workstation. If you are unfamiliar with how to do this, you can follow the procedure outlined on the Windows Azure Channel9 Learning Center here.

Here are a few examples of how to use the cmdlets for a variety of common tasks:

Common Setup

Each script referenced below will refer to the following variables:

 

Add-PSSnapin AzureManagementToolsSnapIn


#get your local certificate for authentication


$cert = Get-Item cert:\CurrentUser\My\<YourThumbPrint>


#subID from portal


$sub = 'c9f9b345-7ff5-4eba-9d58-0cea5793050c'


#your service name (without .cloudapp.net)


$service = 'yourservice'


#path to package (can also be http: address in blob storage)


$package = "D:\deploy\MyPackage.cspkg"


#configuration file


$config = "D:\deploy\ServiceConfiguration.cscfg"

Listing My Hosted Services

 

Get-HostedServices -SubscriptionId $sub -Certificate $cert

View Production Service Status

 

Get-HostedService $service -SubscriptionId $sub -Certificate $cert | 


Get-Deployment 'Production' | 


select RoleInstanceList -ExpandProperty RoleInstanceList | 


ft InstanceName, InstanceStatus -GroupBy RoleName

Creating a new deployment

 

#Create a new Deployment


Get-HostedService $service -SubscriptionId $sub -Certificate $cert |


New-Deployment -Slot Production -Package $package -Configuration $config -Label 'v1'
|


Get-OperationStatus -WaitToComplete


#Set the service to 'Running'


Get-HostedService $service -SubscriptionId $sub -Certificate $cert |


Get-Deployment 'Production'|


Set-DeploymentStatus 'Running' |


Get-OperationStatus -WaitToComplete

Removing a deployment

 

#Ensure that the service is first in Suspended mode


Get-HostedService $service -SubscriptionId $sub -Certificate $cert |


Get-Deployment 'Production'|


Set-DeploymentStatus 'Suspended' |


Get-OperationStatus -WaitToComplete |


#Remove the deployment


Get-HostedService $service -SubscriptionId $sub -Certificate $cert |


Get-Deployment 'Production'|


Remove-Deployment

Upgrading a single Role

 

Get-HostedService $servicename -Certificate $cert -SubscriptionId $sub |


Get-Deployment -Slot Production | 


Set-Deployment -mode Auto -roleName 'WebRole1' -package $package -label 'v1.2' |


Get-OperationStatus -WaitToComplete


 


Adding a local certificate


$deploycert = Get-Item cert:\CurrentUser\My\CBF145B628EA06685419AEDBB1EEE78805B135A2


Get-HostedService $service -SubscriptionId $sub -Certificate $cert |


Add-Certificate -CertificateToDeploy $deploycert |


Get-OperationStatus -WaitToComplete

Configuring Diagnostics - Adding a Performance Counter to All Running Instances

 

#get storage account name and key


$storage = "yourstorageaccount"


$key = (Get-StorageKeys -ServiceName $storage -Certificate $cert `


    -SubscriptionId $sub).Primary


 


$deployId = (Get-HostedService $service -SubscriptionId $sub `


    -Certificate $cert | Get-Deployment Production).DeploymentId


 


$counter = '\Processor\(_Total)\% Processor Time'


$rate = [TimeSpan]::FromSeconds(5)


 


Get-DiagnosticAwareRoles -StorageAccountName $storage -StorageAccountKey $key `


-DeploymentId $deployId |


foreach {


    $role = $_


    Get-DiagnosticAwareRoleInstances $role -DeploymentId $deployId
`


    -StorageAccountName $storage -StorageAccountKey $key |


    foreach {


        $instance = $_


        $config = Get-DiagnosticConfiguration -RoleName
$role -InstanceId $_ `


            -StorageAccountName
$storage -StorageAccountKey $key `


            -BufferName PerformanceCounters
-DeploymentId $deployId 


        $perf = New-Object Microsoft.WindowsAzure.Diagnostics.PerformanceCounterConfiguration
`


            -Property @{CounterSpecifier=$counter;
SampleRate=$rate}


        $config.DataSources.Add($perf)


        $config.DataSources | 


         foreach { 


             Set-PerformanceCounter
-PerformanceCounters $_ -RoleName $role `


             -InstanceId
$instance -DeploymentId $deployId -StorageAccountName $storage `


             -StorageAccountKey
$key


         }


    }    


}

More Examples

You can find more examples and documentation on these cmdlets by typing 'Get-Help <cmdlet> -full' from the PowerShell cmd prompt.

If you have any questions for feedback, please send it directly to me through the blog (look at right hand navigation pane for Contact Ryan link).

The Collectible Edition of Our Book

Ryan Dunn — Wed, 17 Feb 2010 22:01:54 GMT

Occasionally, I will check online to see the reviews for our book. It is now almost 4 years old and a bit outdated with respect to the changes that came with .NET 3.5. The website and forums however has been trucking along (thanks Joe!) these years. We never sold a ton of books about this particular niche topic, but for the audience size, it wasn't too shabby. Joe and I are not about to retire on our royalties, however.

I was a bit surprised to see this online however at Amazon:

Now, it is a bit silly for two reasons, a.) our book as a collectible, really? Who would actually collect it? and b.) It says it was signed by both authors. Now, there is a slight chance it is authentic as I think Joe and I signed maybe 2 books together ever. However, the odds of it being authentic are exceedingly slim. Who knows. it's funny regardless.

ADAM on Windows 7

Ryan Dunn — Wed, 17 Feb 2010 21:29:07 GMT

One of my most popular posts to this day is the hack to install ADAM (now called AD LDS) on Vista. It is the source of numerous emails as well. So today, I am happy to say that AD LDS (aka ADAM) is available for Windows 7 officially - no hacks needed.

Download it here

Now, I fully realize this doesn't help those that are using Vista today, but there are quite a few folks that are using Windows 7 or upgrading from Vista or XP to 7. LDAP directories are fabulous tools and AD LDS is a great one. Enjoy.

Sharing Blobs in Windows Azure

Ryan Dunn — Sat, 13 Feb 2010 01:29:47 GMT

Windows Azure storage makes use of a symmetric key authentication system. Essentially, we take a 256-bit key and sign each HTTP request to the storage subsystem. In order to access storage, you have to prove you know the key. What this means of course is that you need to protect that key well. It is an all-or-nothing scenario, if you have the key, you can do anything. If you don't possess the key, you can do nothing*.

The natural question for most folks when they understand this model is, how can I grant access to someone without compromising my master key? The solution turns out to be something called Shared Access Signatures (SAS) for Windows Azure. SAS works by specifying a few query string parameters, canonicalizing those parameters, hashing them and signing the hash in the query string. This creates a unique URL that embeds not only the required access, but the proof that it was created by someone that knew the master key. The parameters on the query string are:

st - this is the start time of when the signature becomes valid. It is optional. If not supplied, then now is implied.
se - this the the expiration date and time. All signatures are timebound and this parameter is required.
sr - this is the resource that the signature applies to and will be either (b)lob or (c)ontainer. This is required.
sp -this is the permission set that you are granting - (r)ead, (w)rite, (d)elete, and (l)ist. This is required.
si - this is a signed identifier or a named policy that can incorporate any of the previous elements. Optional.
sig - this is the signed hash of the querystring and URI that proves it was created with the master key. It is required.

There is one other caveat that is important to mention here. Unless you use a signed identifier - what I refer to as a policy - there is no way to create a signature that has a lifetime longer than an hour. This is for good reason. A SAS URL that was mistakenly created with an extremely long lifetime and without using the signed idenifier (policy) could not be revoked without changing the master key on the storage account. If that URL was to leak, your signed resource would be open to abuse for a potentially long time. By making the longest lifetime of a signature only an hour, we have limited the window in which you are exposed.

If you want to create a longer-lived SAS, you must create a policy. The policy is very interesting. Because this policy contains any of those parameters mentioned above and is stored at the service, it means that we can revoke those permission or completely change them instantly.

Let's walk through an example using MyAzureStorage.com, where it is trivial to create a SAS. Once I login to the site, I am going to select the BLOBs option from the navigation tabs on top. Here I will see a list of all my containers. I can select a container's Actions menu and click Manage Policies.

Next, I am going to create two policies (signed identifiers), called Read and Write. These will have different expirations dates and permission sets. Notice I am not specifying a Start Date, so they are immediately valid.

Next, I am going to select the Actions menu for one of the blobs under this container and click Share. I am going to apply one of the policies (shared access signature) that I just created by selecting it from the dropdown.

You will notice that the value that I created in the policy fill in the values in the Share BLOB UI and disable you from changing them. The reason is that a policy is like a template. If you don't set a value, then you can set (or must set it if it is required). However, if the policy states one of the parameters, you cannot supply that parameter. In this case, the 'read' policy that was created specified the expiration (se) and permissions (sp). It is implied from the dialog selection that the resource (sr) is a (b)lob. The only value that could be supplied here outside of the policy is the start time (st), which I am not supplying as it is optional.

When I click the Get URL button, I get back a URL that looks like this:

http://<account>.blob.core.windows.net/shared/blobname?sr=b&si=read&sig=hIbD%.%3D

Now, if that URL was to leak and I no longer wanted to provide read access to the blob, I could simply delete the 'read' policy or change the expiration date. It would instantly be invalidated. Compare this to the the same signature created without a policy:

http://<account>.blob.core.windows.net/shared/blobname?se=2010-02-13T02%3A17%3A46Z&sr=b&sp=r&sig=bYfBBb1yf.%3D

This signature could not be revoked until it either expired or I regenerated the master key.

If you want to see how the SAS feature works or easily share blobs or containers in your Windows Azure storage account, give it a try at MyAzureStorage.com and see how easy it is to do.

* assuming the key holder has not marked the container as blob- or container-level public access already, in which case it is public read-only.

Do you Incarnate?

Ryan Dunn — Wed, 10 Feb 2010 21:19:16 GMT

It wasn't too long ago when Karsten Januszewski came to my office looking for a Windows Azure token (back when we were in CTP). I wondered what cool shenanigans the MIX team had going. Turns out it was for the Incarnate project (explained here). In short, this service finds all the different avatars you might be using across popular sites* and allows you to select an existing one instead of having to upload one again and again.

You will note that there is another 'dunnry' somewhere on the interwebs, stealing my exclusive trademark. I have conveniently crossed them out for reference. ;)

Since the entire Incarnate service is running in Windows Azure, I was interested in Karsten's experience:

We chose Windows Azure to host Incarnate because there was a lot of uncertainty in traffic. We didn't know how popular the service would be and knowing that we could scale to any load was a big factor in choosing it.

I asked him how the experience was, developing for Windows Azure

There is a ton of great documentation and samples. I relied heavily on the Windows Azure Platform Kit as well as the samples in the SDK to get started. Once I understood how the development environment worked and how the deployment model functioned, I was off and running. I'd definitely recommend those two resources as well as the videos from the PDC for people who are getting started.

I love it when I hear that. Karsten was able to get the Incarnate service up and running on Windows Azure easily and now he is scale-proof in addition to the management goodness that is baked into Windows Azure.

Checkout more about Incarnate and Karsten's Windows Azure learning on the MIX blog.

*turns out you can extend this to add a provider for any site (not just the ones that ship in source).

How Do I Stop the Billing Meter in Windows Azure?

Ryan Dunn — Wed, 03 Feb 2010 20:00:11 GMT

This might come as a surprise to some folks, but in Windows Azure you are billed when you deploy, not when you run. That means we don't care about CPU hours - we care about deployed hours. Your meter starts the second you deploy, irrespective of the state of the application. This means that even if you 'Suspend' your service so it is not reachable (and consumes no CPU), the meter is still running.

Visually, here is the meter still running:

Here is when the meter is stopped:

Right now, there is a 'free' offering of Windows Azure that offers a limited # of hours per month. If you are using MSDN benefits for Windows Azure, there is another offering that offers some bucket of 'free' hours. Any overage and you start to pay.

Now, if you are like me and have a fair number of hosted services squirreled around, you might forget to go to the portal and delete the deployments when you are done. Or, you might simply wish to automate the removal of your deployments at the end of day. There are lots of reasons to remove your deployments, but the primary one is to turn the meter off. Given that re-deploying your services is very simple (and can also be automated), this is not a huge issue to remove the deployment when you are done.

Automatic Service Removal

For those folks that wish an automated solution, it turns out that this is amazingly simple when using the Service Management API and the Azure cmdlets. Here is the complete, deployment-nuking script:

 

$cert = Get-Item cert:\CurrentUser\My\<cert thumbprint> 


$sub = 'CCCEA07B. your sub ID' 


$services = Get-HostedServices -Certificate $cert -SubscriptionId $sub 


$services | Get-Deployment -Slot Production | Set-DeploymentStatus 'Suspended' | Get-OperationStatus
-WaitToComplete 


$services | Get-Deployment -Slot Staging | Set-DeploymentStatus 'Suspended' | Get-OperationStatus
-WaitToComplete 


$services | Get-Deployment -Slot Production | Remove-Deployment 


$services | Get-Deployment -Slot Staging | Remove-Deployment

That's it - just 6 lines of Powershell. BE CAREFUL. This script will iterate through all the services in your subscription ID, stop any deployed service, and then remove it. After this runs, every hosted service will be gone and the billing meter has stopped (for hosted services anyway).

Supporting Basic Auth Proxies

Ryan Dunn — Mon, 25 Jan 2010 23:52:35 GMT

A few customers have asked how they can use tools like wazt, Windows Azure MMC, the Azure Cmdlets, etc. when they are behind proxies at work that require basic authentication. The tools themselves don't directly support this type of proxy. What we are doing is simply relying on the fact that the underlying HttpRequest object will pick up your IE's default proxy configuration. Most of the time, this just works.

However, if you are in an environment where you are prompted for your username and password, you might be on a basic auth proxy and the tools might not work. To work around this, you can actually implement a very simple proxy handler yourself and inject it into the application.

Here is one that I wrote to support wazt. To use this, add the following to your app.config and drop the output assembly from this project into your execution directory. Note, this would work with any tool in .NET that uses HttpWebRequest under the covers (like csmanage for instance).

<configSections>
<sectionGroup name="proxyGroup">
<section name="basicProxy"
type="Proxy.Configuration.CustomProxySection, Proxy" />
</sectionGroup>
</configSections>

<system.net>
<defaultProxy enabled="true" useDefaultCredentials="false">
<module type="Proxy.CustomProxy, Proxy"/>
</defaultProxy>
</system.net>

Download the source here.

Neat Windows Azure Storage Tool

Ryan Dunn — Mon, 25 Jan 2010 22:41:05 GMT

I love elegant software. I knew about CloudXplorer from Clumsy Leaf for some time, but I hadn't used it for awhile because the Windows Azure MMC and MyAzureStorage.com have been all I need for storage for awhile. Also, I have a private tool that I wrote awhile back to generate Shared Access signatures for files I want to share.

I decided to check out the progress on this tool and noticed in the change log that support for Shared Access signatures is now included. Nice! So far, this is the only tool* that I have seen handle Shared Access signatures in such an elegant and complete manner. Nicely done!

Definitely a recommended tool to keep on your shortlist.

*My tool is complete, but not nearly as elegant.

LINQPad supports SQL Azure

Ryan Dunn — Tue, 12 Jan 2010 02:31:14 GMT

Some time back, I put in a request to LINQPad's feature request page to support SQL Azure. I love using LINQPad for basically all my quick demo programs and prototypes. Since all I work with these days is the Windows Azure platform, it was killing me to have to go to SSMS to do anything with SQL Azure.

Well, my request was granted! Today, you can use the beta version of LINQPad against SQL Azure and get the full LINQ experience. Behold:

In this case, I am querying the firewall rules on my database using LINQ. Hot damn. Nice work Joe! If you pay a few bucks, you get the intellisense version of the tool too, which is well worth it. This tool has completely replaced SnippetCompiler for me and continues to get better and better. Now, if Joe would add F# support.

LINQPad Beta

PDC 2009 Windows Azure Resources

Ryan Dunn — Mon, 23 Nov 2009 17:51:28 GMT

For those of you that made PDC, this will serve as a reminder and for those of you that missed PDC this year (too bad!), this will serve as a guide to some great content.

PDC Sessions for the Windows Azure Platform

Getting Started

Windows Azure

Codename "Dallas"

Enrich your Applications with Data from Microsoft Project Code Name "Dallas"

SQL Azure

Identity

Customer & Partner Showcases

Channel 9 Learning Centers

Coinciding with PDC, we have released the first wave of learning content on Channel 9. The new Ch9 learning centers features content for both the Windows Azure Platform, as well as a course specifically designed for the Identity Developer. The content on both these sites will be continued to be developed by the team over the coming weeks and months. Watch out for updates and additions.

Downloadable Training Kits

To complement the learning centers on Ch9, we still continue to maintain the training kits on the Microsoft download center, which allows you to download and consume the content offline. You can download the Windows Azure Platform training kit here, and the Identity training kit here. The next update is planned for mid-December.

Windows Azure Service Management CmdLets

Ryan Dunn — Mon, 26 Oct 2009 16:26:16 GMT

As I write this, I am sitting on a plane headed back to the US from a wonderful visit over to our UK office. While there, I got to meet a number of customers working with Windows Azure. It was clear from the interaction that these folks were looking for a way to simplify how to manage their deployments and build it into an automated process.

With the release of the Service Management API, this is now possible. As of today, you can download some Powershell cmdlets that wrap this API and make managing your Windows Azure applications simple from script. With these cmdlets, you can script your deploys, upgrades, and scaling operations very easily.

The cmdlets mirror the API quite closely, but since it is Powershell, we support piping which cuts down quite a bit on the things you need to type. As an example, here is how we can take an existing deployment, stop it, remove it, create a new deployment, and start it:

 

Get-HostedService $servicename -Certificate $cert -SubscriptionId $sub | 


    Get-Deployment -Slot Production | 


    Set-DeploymentStatus 'Suspended' | 


    Get-OperationStatus -WaitToComplete | 


Get-HostedService $servicename -Certificate $cert -SubscriptionId $sub | 


    Get-Deployment -Slot Production | 


    Remove-Deployment | 


    Get-OperationStatus -WaitToComplete


Get-HostedService $servicename -Certificate $cert -SubscriptionId $sub | 


    New-Deployment Production $package $config -Label 'v.Next' | 


    Get-OperationStatus -WaitToComplete


Get-HostedService $servicename -Certificate $cert -SubscriptionId $sub | 


    Get-Deployment -Slot Production | 


    Set-DeploymentStatus 'Running' | 


    Get-OperationStatus -WaitToComplete

Notice that in each case, we are first getting our service by passing in the certificate and our subscription ID. Again, since this is Powershell, we can get the certificate quite easily:

$cert = Get-Item cert:\CurrentUser\My\D6BE55AC428FAC6CDEBAFF432BDC0780F1BD00CF

You will find your Subscription ID on the portal under the 'Account' tab. Note that we are breaking up the steps by using the Get-OperationStatus cmdlet and having it block until it completes. This is because the Service Management API is an asynchronous model.

Similarly, here is a script that will upgrade a single role or the entire deployment depending on the arguments passed to it:

 

$label = 'nolabel' 


$role = '' 


if ($args.Length -eq 2) 


{ 


    $role = $args[0] 


    $label = $args[1] 


} 


if ($args.Length -eq 1) 


{ 


    $label = $args[0] 


} 


if ($role -ne '') 


{ 


    Get-HostedService $servicename -Certificate $cert -SubscriptionId
$sub | 


    Get-Deployment -Slot Production | 


    Set-Deployment -mode Auto -roleName $role -package $package -label
$label | 


    Get-OperationStatus -WaitToComplete 


} 


else 


{ 


    Get-HostedService $servicename -Certificate $cert -SubscriptionId
$sub | 


    Get-Deployment -Slot Production | 


    Set-Deployment -mode Auto -package $package -label $label | 


    Get-OperationStatus -WaitToComplete 


}

Download the cmdlets from Code Gallery and leave me some feedback if you like them or if they are not working for you.

Launching MyAzureStorage.com

Ryan Dunn — Wed, 07 Oct 2009 00:27:41 GMT

Things are getting crazy here at Microsoft getting ready for PDC. I haven't had much time to blog or tweet for that matter. However, I am taking a break from the grind to announce something I am really excited about - a sample TableBrowser service we are hosting for developers at MyAzureStorage.com.

We built this service using ASP.NET MVC on a rich AJAX interface. The goals of this service were to provide developers to an easy way to create, query, and manage their Windows Azure tables. What better way to host this than on a scalable compute platform like Windows Azure?

Create and Delete Tables

If you need to create or manage your tables, you get a nice big list of the ones you have.

Create, Edit, and Clone your Entities

I love being able to edit my table data on the fly. Since we can clone the entity, it makes it trivial to copy large entities around and just apply updates.

Query Entities

Of course, no browser application would be complete without being able to query your data as well. Since the ADO.NET Data Services syntax can be a little unfamiliar at first, we decided to go for a more natural syntax route. Using simple predicates long with OR, AND, and NOT operations, you can easily test your queries.

Display Data

Lastly, we have tried to make showing data in Windows Azure as convenient as possible. Since data is not necessarily rectangular in nature in Windows Azure tables, we have given you some options: First, you can choose the attributes to display in columns by partition. Next, you expand the individual entity to show each attribute.

Please note: during login you will need to supply your storage account name and key. We do not store this key. It is kept in an encrypted cookie and passed back and forth on each request. Furthermore, we have SSL enabled to protect the channel.

The service is open for business right now and will run at least until PDC (and hopefully longer). Enjoy and let me know through the blog any feedback you have or issues you run into.

Upgrading Your Service in Windows Azure

Ryan Dunn — Fri, 18 Sep 2009 21:15:14 GMT

Windows Azure has been in CTP since PDC 08 in October of last year. Since that time, we have had a fairly simple, yet powerful concept for how to upgrade your application. Essentially, we have two environments: staging and production.

The difference between these two environments is only in the URI that points to any web exposed services. In staging, we give you an opaque GUID-like URI (e.g. <guidvalue>.cloudapp.net) that is hard to publically discover and in production, we give you the URI that you chose when you created the hosted service (e.g. <yourservice>.cloudapp.net).

VIP Swaps, Deploys, and Upgrades

When you wanted to upgrade your service, you needed to deploy the updated service package containing all your roles into one of the environments. Typically, this was in the staging environment. Whenever you were ready, you would then click the big button in the middle to swap environments. This re-programmed the load balancers and suddenly staging was production and vice versa. If anything went wrong in your upgrade, you could hit the button again and you were back to the original deployment in seconds. We called this model a "VIP Swap" and it is easy to understand and very powerful.

We heard from some customers that they wanted more flexibility to upgrade an individual role without redeploying the entire service. Typically, this can be because there might be some state or caching going on in one of the other roles that a VIP swap would cause to be lost.

The good news is that now you can upgrade individual roles (or even the whole service) using the in place upgrade. When you click the new 'Upgrade' button on the portal, you will see a screen very similar to the 'Deploy' screen that you would be used to from before, but this time you have two new options.

Upgrade Domains

The first new option allow you to choose if you want the upgrade to be 'Automatic' or 'Manual' across the upgrade domains. To understand this option, you would probably want to understand what an 'Upgrade Domain' is all about. You can think of upgrade domains as vertical slices of your application, crossing roles. So, if I had a service with a single web role using 10 instances with 2 worker roles, each with 4 instances, then with 2 upgrade domains, I would have a 5 web role instance, and 2 + 2 worker roles instances in each upgrade domain. Illustrated:

If I choose 'Automatic', it simply means that each upgrade domain will be sequentially be brought down and upgraded in turn. If I choose 'Manual', then I need to click another button between each upgrade domain update in order to proceed.

Note: in the CTP today, 2 upgrade domains are automatically defined and set. In the future, you will be able to specify how many upgrade domains you would like to have.

Role Upgrades

Next, we have a radio button that specifies if you want to update the whole service, or a specific role with in the service. Most folks will likely use the role specific update.

It is important to note that these upgrades are for the services where the topology has not changed. That is, you cannot update the Service Definition (e.g. adding, removing roles or configuration options). If you want to change the topology, you would need to use the more familiar VIP swap model.

Once you click Deploy, the selected role will be upgraded according to the upgrade mode you specified.

More information about in-place upgrades and update domains can be found here. Lastly, you can of course eschew the portal and perform all of these actions using the new Service Management API. Happy upgrading!

Instant Windows Azure Tokens

Ryan Dunn — Wed, 02 Sep 2009 16:44:09 GMT

I am on vacation right now, but I read this over at Steve's blog and I just had to make sure everyone knows about it. Right now, when you register at Microsoft Connect for Windows Azure, you will get an instant token. No more 1 or 2 days wait!

Deploying Applications on Windows Azure

Ryan Dunn — Thu, 27 Aug 2009 18:55:38 GMT

There has been a bit of interest in an application called 'myTODO' that we built for the World Partner Conference (WPC) event back in July. It is a simple, yet useful application. The application allows you to create and share lists very easily. It integrates with Twitter, so if you decide to share your lists, it will tweet them and their updates automatically. You can also subscribe to lists using standard RSS if Twitter isn't your thing.

The funny thing is that we only built this app because we wanted something more interesting than the standard "Hello World" application. The entire purpose of the app was to show how easily you can deploy an application (in just mins) on Windows Azure.

You can learn more about this application in 3 ways:

Get the deployment package and deploy this yourself using our demo script from the Windows Azure Platform Training Kit. You will find it in the Demos section and called "Deploying Windows Azure Services".
Watch me show how the app works and how to deploy it by watching my screencast.
Download the source code and see how we built the rich dynamic UI and how we modeled the data using tables.

Federation on Windows Azure

Ryan Dunn — Wed, 05 Aug 2009 00:20:38 GMT

My teammate Vittorio has put out some new guidance and a great new toolkit that shows how to use federation today with Windows Identity Foundation (WIF or Geneva) on Windows Azure. I know this has been a very common request, especially as services move outside of the private datacenters and into the cloud and as vendors try to build true SaaS applications that need to integrate seamlessly into the customer's experience.

As the technologies evolve, the guidance will be kept up to date. For now, this is a great piece of work that gets us past some of the early roadblocks we encountered.

Windows Azure SDK update for July

Ryan Dunn — Mon, 20 Jul 2009 23:19:27 GMT

You can download the new SDK and Windows Azure Tools for Visual Studio right now. The big feature in this release is the support for multiple roles per deployment (instead of a single web and worker role). This is surfaced as a new wizard UI in the tools. Additionally, there is new support for any type of web app to be associated to the project. Previously this was limited to a specific project type (but now it supports MVC directly!).

Download Windows Azure Tools for Visual Studio (includes SDK)
Download Windows Azure SDK

Windows Azure June Round-up

Ryan Dunn — Tue, 02 Jun 2009 00:53:04 GMT

Ahh, it is the start of a glorious June and here in Washington the weather is starting to really get nice. The previous cold and rainy spring must have made the product group more productive as Windows Azure has continued adding features since the last major update at MIX.

Given that Windows Azure is a service and not a boxed product, you can expect updates and features to roll-out over the coming months. In this round-up, we have a number of features that have gone live in the last month or two.

New Feature: Geo-Location support

Starting in May, a new option was added to the portal to support geo-locating your code and data. In order to use this most effectively, the idea of an 'Affinity Group' was created. This allows you to associate various services under an umbrella label for the location.

Read more about this feature here and see a complete provisioning walk-through.

New Feature: Storage API updates

I briefly mentioned this last week, but on Thursday (5/28), new features were released to the cloud for Windows Azure storage. The long awaited batch transaction capability for tables as well as a new blob copying capability were released. Additionally, the GetBlockList API was updated to return both committed and uncommitted blocks in blob storage.

One more significant change of note is that a new versioning mechanism has been added. New features will be versioned by a new header ("x-ms-version"). This versioning header must be present to opt-in to new features. This mechanism is in place to prevent breaking changes from impacting existing clients in the future. It is recommended that you start including this header in all authenticated API calls.

Rounding out these updates were some changes to how property names are stored in table storage as well as the size for Partition and Row keys. Unicode chars and up to 1K key size are supported, respectively. Finally, the timeout values for various storage operations were updated as well.

For more details, please read the announcement.

Please note: There currently is no SDK support for these new storage features. The local developer fabric does NOT currently support these features and the StorageClient SDK sample has not been updated yet. At this point, you need to use the samples provided on Steve Marx's blog. A later SDK update will add these features officially.

Windows Azure SDK Update

The May CTP SDK update has been released to the download center. While this release does NOT support the new storage features, it does add a few new capabilities that will be of interest to the Visual Studio 2010 beta testers. Specifically:

Support for Visual Studio 2010 Beta 1 (templates, local dev fabric, etc.)
Updated support for Visual Studio 2008 - you can now configure settings through the UI instead of munging XML files.
Improved reliability of the local dev fabric for debugging
Enhanced robustness and stability (aka bug fixes).

Download the Windows Azure Tools for Visual Studio (includes both SDK and tools).

New Windows Azure Applications and Demos

Windows Azure Management Tool (MMC)

The Windows Azure Management Tool was created to manage your storage accounts in Windows Azure. Developed as a managed MMC, the tool allows you to create and manage both blobs and queues. Easily create and manage containers, blobs, and permissions. Add and remove queues, inspect or add messages or empty queues as well.

Bid Now Sample

Bid Now is an online auction site designed to demonstrate how you can build highly scalable consumer applications. This sample is built using Windows Azure and uses Windows Azure Storage. Auctions are processed using Windows Azure Queues and Worker Roles. Authentication is provided via Live Id.

If you know of new and interesting Windows Azure content that would be of broad interest, please let me know and I will feature it in later updates.

Relevant Blog Postings

http://blog.smarx.com/posts/sample-code-for-new-windows-azure-blob-features

http://blogs.msdn.com/jnak/archive/2009/05/28/may-ctp-of-the-windows-azure-tools-and-sdk-now-supports-visual-studio-2010-beta-1.aspx

http://blogs.msdn.com/jnak/archive/2009/04/30/windows-azure-geo-location-is-live.aspx

http://dunnry.com/blog/CreateAndDeployYourWindowsAzureServiceIn5Steps.aspx

New Windows Azure Storage Features

Ryan Dunn — Thu, 28 May 2009 22:28:18 GMT

Some new features related to blob and table storage were announced on the forum today. The key features announced were:

Transactions support for table operations (batching)
Copy Blob API (self explanatory)
Updated GetBlockList API now returns both committed and uncommitted block lists

There are some more details around bug fixes/changes and timeout updates as well. Refer to the announcement for more details.

The biggest impact to developers at this point is that to get these new features, you will need to include a new versioning header in your call to storage. Additionally, the StorageClient library has not been updated yet to reflect these new APIs, so you will need to wait for some examples (coming from Steve) or an update to the SDK. You can also refer to the MSDN documentation for more details on the API and roll your own in the meantime.

Create and Deploy your Windows Azure Service in 5 Steps

Ryan Dunn — Fri, 22 May 2009 16:38:12 GMT

Step 1: Obtaining a token

Sign up through http://dev.windowsazure.com to get a token for the service. Turnaround is pretty quick, so you should have one in about a day or so. If you don't see it in a day, make sure you check your SPAM folder to ensure that the message we send you is not trapped in purgatory there.

Step 2: Redeeming the token

Navigate to the Windows Azure Portal and sign-in with the LiveID that you would like to use to manage your Windows Azure applications. Today, in the CTP, only a single LiveID can manage your Windows Azure project and we cannot reassociate the token with another LiveID once redeemed. As such, make sure you use the LiveID that you want long term to manage the solution.

The first time you login to the portal, you will be asked to associate your LiveID.

Click 'I Agree' to continue and once the association has been successful click 'Continue' again. At this point, you will be presented with an option to redeem a token. Here is where you input the token you received in Step 1.

Enter the token and click 'Next'. You will then be presented with some EULAs to peruse. Read them carefully (or don't) and then click 'Accept'. You will get another confirmation screen, so click 'Continue'.

Step 3: Create your Hosted Service

At this point, you can now create your first hosted solution. You should be on the main Project page and you should see 2 and 1 project(s) remaining for Storage Account and Hosted Services, respectively.

Click 'Hosted Services' and provide a Project label and description.

Click 'Next' and provide a globally unique name that will be the basis for your public URL. Click 'Check Availability' and ensure that the name hasn't been taken. Next, you will need to create an Affinity Group in order to later get your storage account co-located with your hosted service.

Click the 'Yes' radio button and the option to create a new Affinity Group. Give the Affinity Group a name and select a region where you would like this Affinity Group located. Click 'Create' to finish the process.

Step 4: Create your Storage account

Click the 'New Project' link near the left corner of the portal and this time, select the Storage Account option.

Similar to before, give a project label and description and click Next.

Enter a globally unique name for your storage account and click 'Check Availability'. Since performance is best when the data is near the compute, you should make sure that you opt to have your storage co-located with your service. We can do this with the Affinity Group we created earlier. Click the 'Yes' radio button and use the existing Affinity group. Click 'Create' to finish.

At this time, you should note that your endpoints have been created for your storage account and two access keys are provided for you to use for authentication.

Step 5: Deploying an application.

At this point, I will skip past the minor detail of actually building an application for this tutorial and assume you have one (or you choose to use one from the SDK). For Visual Studio users, you would want to right click your project and select 'Publish' to generate the service package you need to upload. Alternatively, you can use the cspack.exe tool to create your package.

Using either method you will eventually have two files: the actual service package (cspkg) and a configuration file (cscfg).

From the portal, select the hosted service project you just created in Step 3 and click the 'Deploy' button.

Browse to the cspkg location and upload both the package and the configuration settings file (cscfg). Click 'Deploy'.

Over the next minute or so, you will see that your package is deploying. Hold tight and you will see it come back with the status of "Allocated". At this point, click the 'Configure' button**.

In order to use your storage account you created in Step 4, you will need to update this information from the local development fabric settings to your storage account settings. An easy way to get this is to right click your Storage Account project link in the left hand navigation tabs and open it in a new tab. With the storage settings in one tab and the configuration in another, you can easily switch between the two and cut & paste what you need.

Inside the XML configuration, replace the 'AccountName' setting with your storage account name. If you are confused, teh account name is the one that is part of the unique global URL, i.e. <youraccountname>.blob.core.windows.net. Enter the 'AccountSharedKey' using the primary access key found on the storage project page (in your new tab). Update the endpoints from the loop-back addresses to the cloud settings: https://blob.core.windows.net, https://queue.core.windows.net, https://table.core.windows.net respectively. Note that the endpoints here do not include your account name and we are using https. Set the 'allowInsecureRemoteEndpoints' to either false or just delete that XML element.

Finally, update the 'Instances' element to 2 (the limit in the CTP today). It is strongly recommended that you run at least 2 instances at all times. This ensures that you always have at least one instance running at all times if something fails or we need to do updates (we update by fault zones and your instances are automatically placed across fault zones). Click 'Save' and you will see that your package is listed as 'Package is updating'.

When your package is back in the 'Allocated' state (a min later or so), click the 'Run' button. Your service will then go to the 'Initializing' state and you will need to wait a few mins while it gets your instances up and running. Eventually, your app will have a 'Started' status. Congratulations, your app is deployed in the Staging environment.

Once deployed to staging, you should click the staging hyperlink for your app (the one with the GUID in the DNS name) and test your app. If you get a hostname not found error, wait a few more seconds and try again - it is likely that you are waiting for DNS to update and propagate your GUID hostname. When you are comfortable, click the big circular button in between the two environments (it has two arrows on it) and promote your application to the 'production' URL.

Congratulations, you have deployed your first app in Windows Azure.

** Note, this part of the process might be optional for you. If you have already configured your developer environment to run against cloud storage or you are not using the StorageClient sample at all, you might not need to do this as the uploaded configuration file will already include the appropriate cloud settings. Of course, if you are not using these options, you are already likely a savvy user and this tutorial is unnecessary for you.

Netflix on Media Center

Ryan Dunn — Wed, 20 May 2009 16:44:43 GMT

Finally! I have been using some great plugins for VMC that gave me Netflix streaming support. However, for the last few weeks all of my computers have been unable to use Netflix streaming because of DRM issues with the older (non-Silverlight) mechanism. I didn't want to upgrade my account to use the Silverlight capability until someone got it working on VMC. Now, I finally can. I can't wait to try it out - it's the main reason I have Netflix.

Windows Azure MMC

Ryan Dunn — Thu, 14 May 2009 21:26:22 GMT

Available immediately from Code Gallery, download the Windows Azure MMC. The Windows Azure Management Tool was created to manage your storage accounts in Windows Azure.

Developed as a managed MMC, the tool allows you to create and manage both blobs and queues. Easily create and manage containers, blobs, and permissions. Add and remove queues, inspect or add messages or empty queues as well..

Features

Manage multiple storage accounts
Easily switch between remote and local storage services
Manage your blobs
- Create containers and manage permissions
- Upload files or even entire folders
- Read metadata or preview the blob contents
Manage your queues
- Create new queues
- Monitor queues
- Read (peek) messages
- Post new messages to the queue
- Purge queues

Known Issues

The current release does not work with Windows 7 due to a bug in the underlying PowerShell version. All other OS versions should be unaffected. We will get this fixed as soon as possible.

PHP SDK for Windows Azure

Ryan Dunn — Thu, 14 May 2009 17:57:41 GMT

I tweeted this earlier (really never thought I would say that.). Anyhow, a first release of the PHP SDK for Windows Azure has been released on CodePlex. Right now, it works with blobs and helps with the authentication pieces, but if you look on the roadmap you will see both queue support and table support coming down the road this year.

This is a great resource to use if you are a PHP developer looking to host your app in Windows Azure and leverage the native capabilities of the service (i.e. namely storage).

PHP Azure Project Site

NoScript and the mysterious updates

Ryan Dunn — Mon, 04 May 2009 21:21:28 GMT

I use AdBlock Plus and I use NoScript from Firefox (when I am not running IE8). I selectively enable ads on sites where I care about the advertising (usually technical sites). I absolutely loathe the ads I see on most mainstream sites (usually some idiotic dancing baby/man/woman/thing hawking predatory loans), so I don't feel bad in the slightest about blocking them. That might seem strange given that I run ads on my blog site. However, I honestly don't care if folks block them. My ads happen to be targeted at technical folks so they should be largely relevant to the vast majority of my visitors. Given that a huge proportion of my visits are via RSS readers, most folks never even see the ads anyway.

Over the last few months I have noticed that NoScript has been updating basically every time I open and close the browser. I thought, "wow, these guys must have found new and interesting exploits almost daily". Nope, turns out it was a spat between the author of NoScript and the maintainers of AdBlock Plus.

It seems clear to me that NoScript was in the wrong on this one. People who have enabled AdBlock Plus want it because they don't want to see ads. It really doesn't matter if NoScript likes it or not. It is not their settings to mess with. Respect your users's choice - end of story. It also doesn't bode well for the security architecture of Firefox that these things can mess with each other, but that is another story.

Overlooking the Obvious

Ryan Dunn — Mon, 27 Apr 2009 16:49:42 GMT

I was trying to troubleshoot a bug in my worker role in Windows Azure the other day. To do this, I have a very cool tool (soon to be released) that lets me peek messages. The problem was that I couldn't get ahold of any messages, it was like they were disappearing right from under my nose. I would see them in the count, but couldn't get a single one to open. I was thinking that I must have a bug in the tool.

Suddenly, the flash of insight came: something was actually popping the messages. While I remembered to shut down my local development fabric, I forgot all about the version I had running in the cloud in the staging environment. Since I have been developing against cloud storage, it is actually a shared environment now. My staging workers were popping the messages, trying to process them and failing (it was an older version). More frustrating, the messages were eventually showing up again, but getting picked up before I could see them in the tool.

So, what is the lesson here: when staging, use a different account than your development accounts. In fact, this is one of the primary reasons we have the cscfg file: don't forget about it.

Why does Windows Azure use a cscfg file?

Ryan Dunn — Thu, 16 Apr 2009 18:50:28 GMT

Or, put another way: why don't we just use the web.config file? This question was recently posed to me and I thought I would share an answer more broadly since it is a fairly common question.

First, the web.config is part of the deployed package that gets loaded into a diff disk that in turn is started for you app. Remember, we are using Hypervisor VM technology to run your code. This would mean any change to this file would require a new diff disk and a restart. We don't update the actual diff disk (that would be hard with many instances) without a redeploy.

Second, the web.config is special only because IIS knows to look for it and restart when it changes. If you did that with a standard app.config (think worker roles) that doesn't work. We want a mechanism that works for any type of role.

Finally, we have both staging and production. If you wanted to hold different settings (like a different storage account for test vs. production), you would need to hold these values outside the diff disk again or you would not be able to promote between environments.

The cscfg file is 'special' and is held outside the diff disk so it can be updated. The fabric code (RoleManager and its ilk) know when this file is updated, so it will trigger the app restart for you. There is some short period of time between when you update this file and when the fabric notices. Only the RoleManager and fabric are aware of this file - notice that you can't get to the values reading it from disk for instance.

And that is why in a nutshell, we have the cscfg file and we don't use web.config or app.config files.

All that being said, I don't want to give you the impression that you can't use web.config application settings in Windows Azure - you definitely can. However, any update to the web.config file will require a redeploy, so just keep that in mind and choose the cscfg file when you can.

Azure Training Kit and Tools Update

Ryan Dunn — Thu, 09 Apr 2009 20:35:26 GMT

Are you looking for more information about Azure Services (Windows Azure, SQL Services, .NET Services, etc.)? How about some demos and presentations? What about a great little MMC tool to manage all your .NET Services? Great news - it's here:

Azure Services Training Kit - April Update

Today we released an updated version of the Azure Services Training Kit. The first Azure Services Training Kit was released during the week of PDC and it contained all of the PDC hands-on labs. Since then, the Azure Services Evangelism team has been creating new content covering new features in the platform.

The Azure Services Training Kit April update now includes the following content covering Windows Azure, .NET Services, SQL Services, and Live Services:

· 11 hands-on labs - including new hands-on labs for PHP and Native Code on Windows Azure.

· 18 demo scripts - These demo scripts are designed to provide detailed walkthroughs of key features so that someone can easily give a demo of a service

· 9 presentations - the presentations used for our 3 day training workshops including speaker notes.

The training kit is available as an installable package on the Microsoft Download Center. You can download it from http://go.microsoft.com/fwlink/?LinkID=130354

Azure Services Management Tools - April Update

The Azure Services Management Tools include an MMC SnapIn and Windows PowerShell cmdlets that enable a user to configure and manage several Azure Services including .NET Access Control Services, and the .NET Workflow Service. These tools can be helpful when developing and testing applications that use Azure Services. For instance, using these tools you can view and change .NET Access Control Rules, and deploy and view workflows.

You can download the latest management tools from http://code.msdn.microsoft.com/AzureManagementTools.

Windows Azure and Geneva

Ryan Dunn — Thu, 02 Apr 2009 17:37:48 GMT

I don't like to basically re-blog what others have written, but I will make a minor exception today, as it is important enough to repeat. My friend and colleague, Vittorio has explained the current status of the Geneva framework running on Windows Azure today.

The short and sweet is that we know it is not working 100% today and we are working on a solution. This is actually the main reason that you do not see a Windows Azure version of Azure Issue Tracker today.

Quickly put PHP on Windows Azure without Visual Studio

Ryan Dunn — Thu, 19 Mar 2009 20:25:47 GMT

The purpose of this post is to show you the command line options you have to first get PHP running locally on IIS7 with fastCGI and the to get it packaged and running in the Windows Azure local development fabric.

First, download the Windows Azure SDK and the latest version of PHP (or whatever version you wish). I would recommend getting the .zip version and simply extracting to "C:\PHP" or something like that. Now, configure your php.ini file according to best practices.

Next, create a new file called ServiceDefinition.csdef and copy the following into it:

<?xml version="1.0" encoding="utf-8"?>


<ServiceDefinition name="MyPHPApp" xmlns="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceDefinition">


<WebRole name="WebRole" enableNativeCodeExecution="true">


<InputEndpoints>


<!-- Must use port 80 for http and port 443 for https
when running in the cloud -->


<InputEndpoint name="HttpIn" protocol="http" port="80" />


</InputEndpoints>


</WebRole>


</ServiceDefinition>

You will need this file in order to describe your application in the cloud. This definition models what your application should look like in the cloud. For this example, it is a simple web role listening to port 80 over HTTP. Notice as well that we have the 'enableNativeCodeExecution' attribute set as well. This is required in order to use fastCGI.

Then, create a .bat file for enabling fastCGI running locally. I called mine PrepPHP.bat:

@echo off



set phpinstall=%1

set appname=%2

set phpappdir=%3



echo Removing existing virtual directory...

"%windir%\system32\inetsrv\appcmd.exe" delete
app "Default Web Site/%appname%"




echo.

echo Creating new virtual directory...

"%windir%\system32\inetsrv\appcmd.exe" add
app /site.name:"Default Web Site" /path:"/%appname%" /physicalPath:"%phpappdir%"




echo.

echo Updating applicationHost.config file with recommended
settings...

"%windir%\system32\inetsrv\appcmd.exe" clear
config -section:fastCGI

"%windir%\system32\inetsrv\appcmd.exe" set
config -section:fastCgi /+"[fullPath='%phpinstall%\php-cgi.exe']



echo.

echo Setting PHP handler for application

"%windir%\system32\inetsrv\appcmd.exe"
clear config "Default Web Site/%appname%"
-section:system.webServer/handlers

"%windir%\system32\inetsrv\appcmd.exe"
set config "Default Web Site/%appname%"
-section:system.webServer/handlers /+[name='PHP_via_FastCGI',path='*.php',verb='*',modules='FastCgiModule',scriptProcessor='%phpinstall%\php-cgi.exe',resourceType='Unspecified']



echo.

echo Setting Default Document to index.php

"%windir%\system32\inetsrv\appcmd.exe"
clear config "Default Web Site/%appname%"
-section:defaultDocument

"%windir%\system32\inetsrv\appcmd.exe"
set config "Default Web Site/%appname%"
-section:defaultDocument /enabled:true /+files.[@start,value='index.php']



echo.

echo Done...

Create one more .bat file to enable PHP running in the local dev fabric:

@echo off



set phpinstall=%1

set appname=%2

set phpappdir=%3



echo.

echo Setting PHP handler for application

"%windir%\system32\inetsrv\appcmd.exe" set
config "Default Web Site/%appname%" -section:system.webServer/handlers
/[name='PHP_via_FastCGI'].scriptProcessor:%%RoleRoot%%\php\php-cgi.exe



echo.

echo Outputting the web.roleconfig file

del "%phpappdir%\web.roleconfig" /q



echo ^<;?xml version="1.0" encoding="utf-8"
?^> > "%phpappdir%\web.roleconfig"


echo ^<;configuration^> >> "%phpappdir%\web.roleconfig"


echo ^<;system.webServer^> >> "%phpappdir%\web.roleconfig"


echo ^<;fastCgi^> >> "%phpappdir%\web.roleconfig"


echo ^<;application fullPath="%%RoleRoot%%\php\php-cgi.exe"
/^> >> "%phpappdir%\web.roleconfig"


echo ^<;/fastCgi^> >> "%phpappdir%\web.roleconfig"


echo ^<;/system.webServer^> >> "%phpappdir%\web.roleconfig"


echo ^<;/configuration^> >> "%phpappdir%\web.roleconfig"




echo Copying php assemblies and starting fabric



md %appname%_WebRole

md %appname%_WebRole\bin



robocopy %phpappdir% %appname%_WebRole\bin /E

robocopy %phpinstall% %appname%_WebRole\bin\php /E



"%programfiles%\windows azure sdk\v1.0\bin\cspack.exe" "%~dp0ServiceDefinition.csdef" /role:WebRole;"%~dp0%appname%_WebRole\bin"
/copyOnly /generateConfigurationFile:"%~dp0ServiceDefinition.csx\ServiceConfig.cscfg"


"%programfiles%\windows azure sdk\v1.0\bin\csrun.exe" "%~dp0ServiceDefinition.csx" "%~dp0ServiceDefinition.csx\ServiceConfig.cscfg" /launchBrowser



echo.

echo Done...

Open a command prompt as an Administrator and make sure that the ServiceDefinition.csdef file you created is in the same directory as the .bat files you created.

From the command line, type:

PrepPHP.bat "path to php binaries directory" "myiis7appname" "path to my php app"

If I had installed PHP to "c:\php" and my PHP application was located at "c:\webroot\myphpapp", I would type:

prepphp.bat "c:\php" "myphpapp" "c:\webroot\myphpapp"

Now, I can launch IE and type in: http://localhost/myphpapp and the index.php page will launch.

To get this running in Windows Azure local dev fabric, you would type:

prepforazure.bat "c:\php" "myphpapp" "c:\webroot\myphpapp"

The dev fabric will launch as well as IE and you will be looking at your PHP application running in the dev fabric. If you wish to deploy to the cloud, simply change the command line call for cspack.exe to remove the 'copyOnly' option. Next, comment out the csrun.exe and you have a package ready to upload to the cloud. When you deploy at the portal, make sure you update the number of instances on the portal to at least 2 in order to get fault tolerance.

Changes to SDS Announced

Ryan Dunn — Thu, 19 Mar 2009 19:27:44 GMT

Well, it is a bit of old news at this point: the SDS team has broken the silence and announced the change from SOAP/REST to a full relational model over TDS. First, I wanted to say I am super-excited about this change (and I really mean 'super', not in the usual Microsoft sense). I believe that this will be a net-positive change for the majority of our customers. I can't tell you how many times I have heard customers say, "well, SDS is great. but, I have this application over here that I want to move to the cloud and I don't want to re-architect to ACE". Or, "my DBAs understand SQL - why can't you just give me SQL?". We listen, really. The feedback was loud and clear.

It may be a tiny bit contentious that this change comes with the removal of the SOAP and REST interfaces. However, if you really love that flex model, you can get it in Windows Azure tables.

I know I have been pinged a few times to ask if the announcement is the reason for my change from SDS to Windows Azure. The honest answer is not really. The real reason for my change is that my group had a small re-org and the former Windows Azure tech evangelist moved up and took on higher level responsibilities (he is now my manager). That, combined with the changes to SDS made it a natural transition point to move. Zach Owens has now moved into my group and is looking after SDS - as the former SQL Server evangelist, it makes perfect sense for Zach to take this role now as SDS is now SQL Server in the cloud.

I would expect to see close collaboration between Windows Azure and SDS as this is the killer combination for so many applications. If you want to know more about the changes and specific details, I would try to catch Nigel Ellis' talk at MIX09 this year or watch it online afterwards. I will update this post with a specific link once Nigel gives his talk.

Updated: Nigel's talk is here.

Changing My Focus

Ryan Dunn — Mon, 02 Mar 2009 02:43:30 GMT

I am officially back from parental leave and it was a wonderful time. I had thought that I would have a lot more time to get some side projects done that I have had simmering for some time now. However, that really didn't happen. What can I say? My daughter took a lot more of my time than I had planned. I don't regret it in the least.

Shortly after I started my leave, I discovered that my group was undergoing a small re-organization (nothing to do with the recent layoffs at Microsoft, incidentally). As part of this re-org, I have a new manager these days and a new role. I am now the technical evangelist for Windows Azure as opposed to SQL Services. As such, the content of this blog and my demos will obviously start to change to reflect my new role.

Part of me is sad to leave the SDS fold. There is some great work happening there and I would have liked to see it through. However, another part of me is happy to take on new challenges. Windows Azure is certainly a key part of the overall Azure Services Platform and there is an incredible body of work happening in this area.

Incidentally, this reunites me with Steve Marx. Steve and I used to work together on web evangelism (AJAX specifically) - he's an entertaining guy, so it should be fun to work with him again.

SuperBowl XLIII

Ryan Dunn — Sun, 01 Feb 2009 23:10:18 GMT

I am getting ready to watch the SuperBowl again this year. Last year was surprisingly entertaining, so I have high hopes. It will be interesting to see if the Stealers can win this one on their own this time or if the referees will hand them the game again like last time with another litany of unbelievably - shady calls (two of them enough to make the top 10 for the season). It will also be interesting to see if the coverage will be nearly as biased as last time.

I still remember the stupid black and white montages of an individual player that would be shown at timeouts and other events. It was telling that the entire first half was Steelers players and coaches and fully half of the montages during the second half were Steelers players as well.

Well, it is about to start - let's see how much the media sucks up to the Steelers again. Maybe without Jerome to retire they will officiate honestly this time.

First Day of Parental Leave

Ryan Dunn — Mon, 26 Jan 2009 23:55:11 GMT

We had our first child in October and my wife stayed home the first three months. I only stayed the first week after delivery and started back to work. It was hard to go back to work so soon, but I knew that my wife would be fine with her parents helping out. We wanted to maximize the time that she stayed at home with family, so we decided to take our leave separately with no overlap. Even though I felt like I missed a bit with her at first, I knew also that babies get a lot more fun a few months down the road so I wasn't too broken up to wait awhile.

Well, the time has come for the wife to head back to work. As such, I decided to take advantage of the generous parental leave policy from Microsoft. For the next 4 weeks, I will be exclusively focusing on non-cloud related matters during the day and spending my time with with my super-cute (super-turd) daughter.

What a joy. and quite a handful. She is all smiles most of the time and has recently discovered the joy of her own voice in squeals and shouts. I am really excited right now about spending this time with her, let's see how that turns out in 4 weeks however. :)

Azure Issue Tracker Released

Ryan Dunn — Thu, 22 Jan 2009 20:51:38 GMT

I am happy to announce the immediate release of the Azure Issue Tracker sample application. I know. I know. the name is wildly creative. This sample application is a simple issue tracking service and website that pulls together a couple of the Azure services: SQL Data Services and .NET Access Control Service.

This demo is meant to show a realistic SaaS scenario. As such, it features federation, claims-based authorization, and scalable data storage.

In this post, I will briefly walk through the application such that you can see how it is meant to work and how you might implement something similar. Over the coming weeks, I will dig into features more deeply to demonstrate how they work. I would also encourage you to follow Eugenio, who will be speaking more about this particular demo and the 'Enterprise' version over the coming weeks.

Let's get started:

Make sure you have a .NET Services account (register for one here)
Download and extract the 'Standard' version from the Codeplex project page
Run the StartMe.bat file. This file is the bootstrap for the provisioning process that is necessary to get the .NET Services solution configured as well as things like websites, certificates, and SDS storage.
Open the 'Readme.txt' from the setup directory and follow along for the other bits

Once you have the sample installed and configured, navigate to your IssueTracker.Web site and you will see something like this:

Click the Join Now and then select the 'Standard' edition. You will be taken to the 'Create Standard Tenant' page. This is how we register our initial tenant and get them provisioned in the system. The Windows LiveID and company name put into this page is what will be used for provisioning (the other information is not used right now).

Once you click 'Save', the provisioning service will be called and rules will be inserted into the Access Control service. You can view the rules by looking using the .NET Services portal and viewing the Access Control Service (use the Advanced View) and select the 'http://localhost/IssueTracker.Web' scope.

We make heavy use of the forward chaining aspect of the rules transformation here. Notice that Admin will be assigned the role of both Reader and Contributor. Those roles have many more operations assigned to them. The net effect will be that an Admin will have all the operations assigned to them when forward chaining is invoked.

Notice as well that we have 3 new rules created in the Access Control service (ACS). We have a claim mapping that sets the Windows LiveID to the Admin role output claim, we have another that sets an email mapping claim, and finally one that sets a tenant mapping claim. Since we don't many input claims to work with (only the LiveID really), there is not too much we can do here in the Standard edition. This is where the Enterprise edition that can get claims from AD or any other identity provider is a much richer experience.

Once you have created the tenant and provisioned the rules, you will be able to navigate to a specific URL now for this tenant: http://localhost/IssueTracker.Web/{tenant}

You will be prompted to login with your LiveID and once you are authenticated with Windows LiveID, you will be redirected back to your project page. Under the covers, we federated with LiveID, got a token from them, sent the token to ACS, transformed the claims, and sent back a token containing the claims (all signed by the ACS). I will speak more about this later, but for now, we will stick to the visible effects.

From the Project page, you should click 'New Project' and create a new project.

Give it a name and invite another Windows LiveID user (that you can login as later). Make sure you invite a user with a different Windows LiveID than the one you used to initially provision the tenant (i.e. what you are logged in as currently).
Choose the 'Reader' role for the invited user and click the Invite button.
Add any custom fields you feel like using. We will likely expand this functionality later to give you more choices for types and UI representation.
Click Save (make sure you added at least 1 user to invite!)

Once you click Save, additional rules are provisioned out to the ACS to handle the invited users. From the newly created project, create an issue. Notice that any additional fields you specified are present now in the UI for you to use for your 'custom' issue.

Once you have saved a new issue, go ahead and try the edit functionality for the Issue. Add some comments, move it through the workflow by changing the status, etc.

Next, open a new instance of IE (not a new tab or same IE) and browse to the tenant home page (i.e. http://localhost/IssueTracker.Web/{tenant}). This time however, login as the invited Windows LiveID user. This user was assigned the 'Reader' role. Notice the new browser window can read the projects for this tenant and can read any issue, but they cannot use the Edit functionality.

Now, I will make two comments about this. First, so what? We are checking claims here on the website and showing you a 'Not Authorized' screen. While we could have just turned off the UI to not show the 'Edit' functionality, we did this intentionally in the demo so you can see how this claim checking works. In this case, we are checking claims at the website using a MVC route filter (called ClaimAuthorizationRouteFilterAttribute).

One key point of this demo is that the website is just a client to the actual Issue Tracker service. What if we tried to hit the service directly?

Let's check. I am going to intentionally neuter the web site claims checking capabilities:

By commenting out the required claims that the Reader won't have, I can get by the website. Here is what I get:

The Issue Tracker service is checking claims too. whoops. No way to trick this one from a client. So, what are the implications of this design? I will let you noodle on that one for a bit. You should also be asking yourself, how did we get those claims from the client (the website), to the service? That is actually not entirely obvious and so I will save that for another post. Enjoy for now!