Wednesday, October 20, 2010

WCF, HTTP Server API, Namespace Reservations and Access Control List

Http server API or Http.sys is a kernel mode http driver with port sharing capabilities which means more than one application can listen on the same port.

Http server API enables applications to communicate over http, applications can register to receive http requests for specified URL's and send http responses. An application not hosted in IIS and in a non-administrator account cannot bind to the http namespace at run time without an administrator reserving the namespace. This is a requirement of http.sys.

A http namespace reservation allocates a part of the URL namespace to a user (or users), allowing the user to own that part of the namespace. An administrator can make this reservation for a specified URL on behalf of a user and their application. The application is then registered to receive and serve incoming service requests for the URL namespace .

The http server API does not allow users to register URL's from parts of the namespace they do not own. For namespace security ACL's (access control list) are applied to the part of the namespace reserved for each user.

Netsh.exe tool is used when manually configuring WCF using http/s. In windows 7 from an administrator account, to give a WCF web service called httpEchoService access rights to the namespace, launch a command window and enter the following


netsh http add urlacl url=http://+:80/httpEchoService/ user=<your local machine name>


A reservation has now been made for the specified URL, this allows the application to bind to the http namespace at run time.

A hierarchical structure is used with namespace reservations. If the following namespace 'http://anyname.com:80/' is reserved, so are all the subnamespaces, for eg.
'http://anyname.com:80/app1' is a reserved subnamespace.

When using Microsoft Visual Studio, to enable users without administrator privileges to develop WCF web services, an ACL is created for the following namespace http://+:8731/Design_Time_Addresses during installation of Visual Studio.

Administrators can add/remove users from this ACL, or open additional ports. This ACL allows users access to the WCF service auto host (wcfsvchost.exe) without granting them administrator privileges.

For more information on OS's, tools and commands see this link
http://msdn.microsoft.com/en-us/library/ms733768.aspx

More information on namespace reservations can be found at 
http://msdn.microsoft.com/en-us/library/aa364673%28VS.85%29.aspx%20