1. .NET Smart Client Development Stephen Turner Software Design Engineer sturner@microsoft.com Microsoft UK

2. Stuff we’ll talk about… Evolution of the client model Windows Forms  The.NET Framework smart client Code Access Security  Run applications safely from the Internet Smart Device Programmability  Pocket PC and Smartphone Office System 2003  The document-centric smart client Visual Studio Tools for Office

3. Evolution of the Client Model Traditional Rich Client Pros  Uncompromised user experience  Great interactivity  Flexible offline operation & storage  Strong integration with client-side APIs  Great developer tools support Cons  Difficult to deploy & administer apps  Global machine impact or “DLL hell”  Serious security issues, viruses, etc. Traditional Web Client Pros  Broad desktop reach  Easy administration Cons  Impaired or frustrating user experience  No offline operation or storage  Poor integration with client-side APIs  DHTML / scripting tools non-existent.NET Framework Smart Client To the metal performance  GDI+ & DirectX graphics  Direct Win32 & COM as needed “Real time” interactivity No mind-numbing “round trip” wait  Asynchronously web services Friction free deployment & versioning  Launch app from a URL  Embed control in a web page Safe and secure app execution  Code access security Automatic online / offline support  Application updater component

4. Gartner on.NET The “High Fidelity” (or Smart) Client Microsoft’s much-misunderstood.NET … strategy will lead a resurgence in rich-client … deployment. Despite the focus during the past five years on browser-enabled applications, the problems … (such as lack of richness and … server round-trip processing) have become all too well-known. … Microsoft’s.NET message has always been about so-called “smart” clients (synonymous with Gartner’s term “high-fidelity client”) and on experiences. By 2005, as much as 60 percent of new.NET applications will be designed with high-fidelity client deployment in mind.

5. Windows Forms The.NET Framework Smart Client Operating System Common Language Runtime (CLR) Base Class Libraries (BCL) ADO.NET and XML ASP.NET Web Forms Web Services WindowsForms Common Language Specification Visual Basic Basic C#J#… Visual Studio.NET C++

6. Windows Forms A Powerful Framework for Windows Apps Visual form and control inheritance  Runtime & design-time architecture Advanced support for layout and printing  Control anchoring & docking, auto-scroll, etc. Powerful data binding semantics  Bind any control property to any data source Easy internationalization & accessibility  Just set properties on forms & controls Extensive third-party control market  http://www.componentsource.com

7. “Friction Free” Deployment No-Touch Maintenance of the Client No “installation” necessary – just run it  Code downloads on-demand from any web server  Saved in cache and dynamically updated Copy to a folder and delete when done  No registry entries or other dependencies Side-by-side “isolation by default”  Different app versions in different folders  Share “strong named” assemblies in GAC Windows Installer technology  Self repairing installations, rollback, signing

8. Building & Running a.NET Client DataSets & data binding Visual Inheritance Internationalization

9. Issues of Code Security The enemy is among us – no perimeters Innocent but trusted code often plays host to malicious mobile code Malicious code can do anything that the user has permissions to do The user will always make the wrong security decision

10. LIBRARY Only people with a membership card can use books. LIBRARY Only people with a membership card can use books. Code Security in Pictures Security Policy Bob Alice Eve Alice, would you get a book for me? Bob, would you get a book for Eve? I would like to check out a book Are you and all who will handle this book members? Shared Library Luring attack Untrusted code Stack Walk Security Demand Call Chain MEMBER card Evidence MEMBER card MEMBER card

11. LIBRARY Only those who have a member card can check out a book. LIBRARY Only those who have a member card can check out a book. Bob Alice Eve Alice, would you get a book for me? Bob, would you get a book for Eve? I would like to check out a book Are you and all who will handle this book members? Eve is not a member, but I vouch for her. Stack Modifier: Assert() I don’t want to be responsibl e – won’t pass books promoting violence! Stack Modifier: Deny() I will only pass books printed after 1980 Stack Modifier: PermitOnly() Code Security in Pictures

12. Code Access Security Client Apps Run Safely from the Internet Evidence of code origin and credentials  Origin: IE zone, web site & URL  Credentials: strong name signature, Authenticode Security Permissions  Authorization to execute a protected operation  Restricted access to a machine resource Security Policy  Determines permissions based on evidence  Easily maintained by administrator & policy No security decision is ever made by the user!

13. Code Access Security Granular Permissions Protect Resources FileIOFileDialogIsolatedStorageEnvironmentRegistryUIPrintingReflectionSecuritySocketWebOleDbSQLClientMessageQueueEventLogDirectoryServices … extensible Execution, Assertion, Skip verification, Unmanaged code, Control evidence, Control policy, Control principal, Control threads

14. Code Access Security All Code in Call Chain is Evaluated MYAPP (INTRANET).... myComponent.ReadSetting(key); MYCOMPONENT (LOCALMACHINE).... Stream fileStream = FileStream.Open(“settings.xml”);.... Calls Got Permission? Exception CallsFRAMEWORK public FileStream (string name) { FileIOPermission fp = new FileIOPermission(name) fp.Demand().... } 

15. Code Access Security Stack Walk Stopped by Assert MYAPP (INTRANET).... myComponent.ReadSetting(key); MYCOMPONENT (LOCALMACHINE).... FileIOPermission fp = new FileIOPermission (FileIOPermissionAccess.Read, “settings.xml”); fp.Assert(); Stream fileStream = FileStream.Open(“settings.xml”); Calls Got Permission? CallsFRAMEWORK public FileStream (string name) { FileIOPermission fp = new FileIOPermission(name) fp.Demand().... } Returns Returns

16. Code Access Security Internet, Local Intranet & My Computer zones Windows Forms control within a browser page

17. Device Programmability Broad Reach vs. Smart Device ASP.NET Mobile Controls Mobile Web Browser Remote Web Pages Device Operating System Smart Device Programmability.NET Compact Framework Local Code Smart client

18. Smart Device Programmability VS.NET and.NET Compact Framework Common Language Runtime Base Class Libraries ADO.NET and XML ASP.NET Web Forms WebServicesWindowsForms Visual Basic C++C#J#… Visual Studio.NET Smart Device Programmability Targets.NET Compact Framework Targets.NET Compact Framework Integrated IDE Integrated IDE Emulators Emulators Remote debugging Remote debugging.NET Compact Framework Managed code Managed code Web services Web services Rich subset of.NET Framework Class Libraries Rich subset of.NET Framework Class Libraries

19. Smart Device Programmability Remote Debugging Same user experience as desktop  Compile application for device  Automatically deploys to selected device  Output Window used for deployment messages Supported features include  On-device debugging  Breakpoints  Multi-language debugging  Call Stack, Watch windows  Command window – Immediate

20. Smart Device Programmability SQL Server™ Windows® CE Edition 2.0 On-device data engine for Windows CE- powered devices Rich replication and synchronization with SQL Server Designed for high performance in resource- constrained environments Managed.NET Compact Framework provider

21. Smart Device Programmability Windows Mobile 2003 for Pocket PC

22. Office System 2003 The Document Centric Smart Client XML in Word & Excel 2003  Customer defined XML schema mapping Research Library Task Pane  Customized information search & actions Smart Documents Task Pane  User reactive guided solutions InfoPath 2003  Easy forms to gather and reuse XML data Visual Studio Tools for Office  New projects types for VS 2003

23. XML in Word & Excel 2003 Customer Defined XML Schema Mapping Work with data in a format that makes sense  Visually relate XML elements to document parts Open or save just the data you need  Apply XSLT to data input / output  Submit directly to a web service Fully supports the W3C XSD standard  But users do not have to know XML Word also supports full fidelity WordML  Apps can produce or consume Word documents

24. Smart Documents Task Pane User Reactive Guided Solutions Follows the user through the document  Tightly integrated with XML schema mapping  Provides contextual content, actions & help Customizable through VB6 or VS.NET  Extension of the Smart Tags 2.0 API Secure auto deployment & update  Highly secure, manifest-described deployment  Document only contains the URL of the manifest  Centralized versioning and self-maintaining

25. Research Library Task Pane Customized Information Search & Actions Search info sources from the document  Return rich content, forms and actions Open architecture via XML & web services  No client code required! Integrated across Office 2003  Word, Excel, PowerPoint, Outlook, Publisher, OneNote, Visio, and Internet Explorer (with IEAK) Out of the box & third party services  Dictionary, thesaurus, translation, encyclopedia, stock quotes, e-catalogue, etc.

26. InfoPath 2003 Easy Forms to Gather and Reuse XML Data A natural “end user” client for web services Dozens of ready-to-use sample forms  Flexible, dynamic authoring environment User friendly environment for entering data  Rich text editing, spell check, AutoComplete  Data validation, multiple views & forms Workflow & organizational processes  Online, offline & email support Web model for form deployment

27. Visual Studio Tools for Office New Projects Types for VS.NET 2003 Power and richness of the Office System  “Code behind” for Word & Excel 2003  Secure auto-deployment of.NET application code VS.NET developer productivity  Real languages – Visual Basic.NET and Visual C#  IntelliSense, code outlining, dynamic help, etc.  Advanced debugging environment  Visual designers for WinForms, XML, data, etc.  Power of the.NET Framework and web services Visual Studio Tools for Office Beta 1 can be downloaded from: http://msdn.microsoft.com/vstudio/office

28. Office System 2003 Visual Studio Tools for Office with Excel

29. TaskVision A “Best Practice” Windows Forms Sample Extensive high quality sample source code Smart client task management application  Authenticated users can add, view & modify shared projects and tasks Any number of scenarios  Customer service  Bug tracking  Create your own TaskVision 1.1 can be downloaded from: http://www.windowsforms.net

30. TaskVision Extensive Client & Server Requirements Offline / online model Auto-updating over HTTP (no-touch maintenance) Asynchronous web service calls Authentication ticket to prevent replay attacks Authorization to control access to features ADO.NET data access with stored procedures Data collision handling Printing with preview Integration with Win32 and COM components Localization (UI) and globalization (format) Accessibility support Dynamic properties Graphics development using GDI+ Windows XP Themes

31. .NET Smart Client Summary The Best of the Web… The Power of the PC Evolution of the client model Windows Forms  The.NET Framework smart client Code Access Security  Run applications safely from the Internet Smart Device Programmability  Pocket PC and Smartphone Office System 2003  The document-centric smart client Visual Studio Tools for Office

32. Useful Resources http://www.windowsforms.net  TaskVision, sample code, forum, articles, etc. Mobility and the.NET Compact Framework  http://msdn.microsoft.com/mobility http://msdn.microsoft.com/office  Visual Studio Tools for Office, etc. http://msdn.microsoft.com/community  Hundreds of active third party communities http://msdn.microsoft.com/newsgroups  dotnet.framework.windowsforms  vsnet.tools.office

33. © 2003 Microsoft Ltd. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.