Hi Al,

Interesting article, but I struggle to see the problem you are describing.

You stated: " Silverlight will try to access your database located at 192.168.1.1 without any success or the webservice at your 192.168.1.2 that now thanks to the ISA you can access by the name of mickey.corpnet.com " but Silverlight never connects to a database directly (it does not have the libraries); all access is via services (and to a much les popular extend: sockets). The services can be any flavour you want and will be over http. So how is this different from any client (ajax for example) requesting a service or web page? The actual url for the service can just be changed from the development server to the live one during deployment. ISA does not need to do any translation.

>> do not add anything in Silverlight that will compromise the solution as at the end of the request

This is correct (as it would be for any client solution); there are obfuscators available to help protect your IPR if required, but the key point is that Silverlight is a UI (UX) for your app, not the whole app, so when you say: "Do I need to add all my business logic in the ASP.NET app?", then that is not far from the truth. You DAL, and applogic, will typically sit behind the service, and you will return entities and validation logic to Silverlight, which will deal with the UI logic.

>> In other words, will Silverlight 3 XAP going to be able to be translated by ISA?

I think this is a non-issue, as stated above, I don't believe ISA (or any other perimiter firewall, or DMZ) has anything other to do than to allow a xap to be delivered, and allow http, port 80 access (typically) to a service url.

Silverlight 3 does however introduce a Binary binding for wcf services that Silverlight can consume (and does by default) - this could be any issue with firewall configuration; something I haven't tried yet and is worthy of further investigation

Hope that makes sense ;-)

Cheers

Ian

Pingback from IT Questions » Blog Archive » Is Silverlight 2 ready for the Enterprise solution?

Ian does a good job addressing some of your concerns. He did not address the last question that you posed “What about clustering, load balancing, session state?” These should rarely come into concern. When you program a Silverlight application you have to get into the mind set of developing a Smart Windows application. There is no notion of session in the sense of an ASP.net application because there is no notion of a post back. The Silverlight application is maintains its state and data is moved back and forth through web services (or sockets).

Load balancing and clustering do not come into play like you think. The user will hit the site and have the XAP downloaded. After that the user never has to touch your servers again accept through web service calls for data/business logic processing. This requires that you develop a Service Oriented Architecture to handle data/business processing. Your SOA implementation should be able to take advantage of load balancing and clustering. By only sending your presentation and validation logic to the client you reduce the chances that proprietary information is available on the client.

Here is an example of an enterprise level Silverlight application developed by Microsoft http://www.mscui.net/PatientJourneyDemonstrator/. So it can be done, it just requires a new way of thinking.

Ian,

Really good point, thanks for answering a few question, trying to see how other people are using Silverlight in their solutions as well as looking how does it work with existing technology, yet, I believe I failed to describe the architecture where I think there is no solution story described by Silverlight. Let me see if I can do it again or failed.

ASP.NET runs in the server and renders HTML to be serve to the client, so ISA can filter results if the intent of the HTML is to go outside the network, so consequent requests from that output will be delivered correctly back into ISA. So the ASP.NET application does not need any change, you can design it and the implementation is independent without having to worry about where is the customer going to install it.

A good example is Sharepoint, you can deploy Sharepoint on an intranet and the implementation can expose it in the DMZ or better using ISA to the Internet with minimal configuration.

Now and this is my question to you and why I wrote the blog post really, Silverlight needs to consume data, so needs to talk to web services, yes needs to consume data from a database as you said using a webservice, I really like creating REST web services from a database to get my data, so it’s a layer on top of the database server, so when you are designing the solution with ASP.NET and Silverlight you need to think about how different customers will deploy that solution I believe, as is not like ASP.NET that can be filtered and handled by any HTML filtering, Silverlight is not that configurable, that was my question and problem really, I would like to see a story from Microsoft how to expose it to those tools for a better deployment, I would like to hear from other people to see how they use Silverlight.

Still need to say that Silverlight allows me to support more users with less hardware as I can use the users CPU for a few processing that before I had to use my servers. I do believe that Silverlight 3 will provide me more tools to do customization as well as security. Because as I asked in the post, how do people secures the XAP file itself? SSL? How do they secure the requests coming from Silverlight to the server? How do they know what user is requesting those resources as well as how they handle role base security.

Again, thanks so much Ian for your post and contributing to the post. I would like to talk to you more about your ideas and expertise in Silverlight.

Cheers

Al

Dave,

Thanks so much the link, great finding I got to say. Please look at my reply to Ian above. I what to ask you a little bit more about your answer on clustering and load balancing. Silverlight still after being downloaded from the server to the client needs to make requests to the servers to get data and send data, so I do believe there is a session state as well if you are using Role base security you need to make sure to know what user is asking for that resource. Requests and response will go through firewalls, load balancing, ISA and cache engines.

I do not have an answer and my experience in a recent implementation let me a little worried. I think I need to wrap my brain around the concept better.

Thanks Dave, let’s me know there is homework for me to do.

Cheers

Al

Pingback from » Edifecs, Axway target innovative HIPAA 5010 migration solutions — 11:22:36(CDT)5-21-2009 imaginings

Plenty of support for .Net languages; Great ease of use; Compute speeds beat competition.