Microsoft Certified Professional

Should I get certified?

The value of Microsoft certifications has split opinion for years, and both camps feel very passionate about their side of the argument.  In this post I’ll try and look constructively at the value of Microsoft certifications, so you can make the decision for yourself.  I’m specifically talking about Microsoft developer certifications here, but the concepts/points could likely be applied to any certifying body.

1. What are the current Microsoft Certification paths (for developers)?

There is a route for just about every job role in the industry, I have to narrow the criteria quite a bit just to stop this post from becoming long and boring.  Here is a high level overview;

MTA (Microsoft Technology Associate)
This is a foundation level certification targeting people getting started in their career.  There are 3 main routes; IT Infrastructure (up to 4 exams), Database (1 exam) and Developer (8 exams).  Reading the overview of each route shows that each exam is meant as an introduction to that particular field.

MCSD (Microsoft Certified Solutions Developer)
This is a middle-level (most developers will probably fall into this band) certification with several different routes; Web, Windows Store (JS, CSS, HTML), Windows Store (C’#) and Application Lifecycle Management.

MCPD (Microsoft Certified Professional Developer)
Now all but defunct (replaced by MCSD). this was a more advanced path, again with several routes available including; Desktop, Windows Phone and Silverlight.  The desktop route had a strong focus on WPF, WCF, and Entity Framework, as well as developing applications for the enterprise.

So many paths

The fact that there are so many paths available targeting all developers from novice to seasoned professional forms the basis of the first argument against getting certified.

The facts are quite simple.  Each exam costs around £99 to sit, and there may be up to 4 exams in any certificate route (usually no less than 2).  This price does not include between £20-£40 for an official Microsoft training guide and subscriptions to third party training providers, such as PluralSight, which will set you back another $29 a month.  If you opt for classroom training, you could easily be looking at £5000 for a 5 day intensive course with no guarantee that you’ll pass at the end.

Microsoft would probably argue that they are trying to provide useful training to developers of all skill levels, and that £99 is cheap compared to something like CISCO CCNA, costing between $150-$295.

Conclusion: Microsoft offer exams to make money plain and simple.  Whilst not the most expensive, Microsoft and their partners make money from the exam itself, and supporting training material such as books.

2. Will getting certified help me get a job/earn more money?

The answer is not simple, “Yes with an if, no with a but”.

According to Mutually Human, employers hire developers based on the following criteria;

  • Experience
  • Skills
  • Education

When a company is looking to match a candidate to a role, they favour experience and skills over education.  Don’t be fooled, Microsoft certifications fall under the education banner, and aren’t necessarily “proof” that you are highly skilled.  This is true for all but the most junior positions.

Yes, if you are at the very beginning of your career.
Having a decent Microsoft certification will give you a good edge over your competition.  At worst, it shows that you know how to study training material and that you had the drive and determination to do so.  It’s also a couple of extra lines on your CV and a little “something extra” to chat about when you get invited to interview.

No, but exams like the ones offered by Microsoft will highlight areas that you are most passionate about.
If you can identify where your skills are strongest, you may become a specialist.  If your specialist skill is in high demand (a good SQL developer is always a good example) you will certainly be able to demand higher rates if you are a contractor/freelancer/consultant.

3. Is it worth the time/effort?

If you are serious about sitting a Microsoft exam, and I mean without cheating then you will be required to make a significant time investment.

If you are already an experienced software developer looking to sit the MCSD Web Applications route, I estimate that it should take about 90 days to complete (30 days per exam [70-480, 70-486, 70-487]).  And really that is for developers who have already been actively using/developing code using those technologies on a daily basis for at least a year.  If you are not using these technologies regularly, you would have to at least double or triple the amount of time/effort required.

So it is?

Another incredibly tough question to answer.  Honestly, it depends.  It all depends on your motives.

If you want to complete a Microsoft certification because you believe it will get you a promotion or a pay rise FORGET IT.  Don’t waste your time because it probably won’t happen.  And if you get lucky, you will truly be in the minority.  I’m speaking from personal experience because this was my motivation once upon a time.

If, say, you are a desktop developer looking to make the transition into web development then ABSOLUTELY.  You will gain valuable insight into a wide range of technologies, and gain some hands on experience.  The Microsoft exams tend to be at quite a high level, but they will certainly give you a taste for what you can expect from a full time position.  And for a couple of hundred quid, you can get a nice shiny certificate to show your current/next employer.

Summary

Microsoft offers a wide range of courses, from novice (MTA) to more advanced (MCPD), targeting desktop, mobile, and web developers.  Microsoft offers certifications because it generates revenue, not only from the exams but from books and supporting training material.  Getting certified likely wont help you get a promotion or a pay rise, but they probably will help you get your foot in the door if you are at a more junior level.  Microsoft exams, however, may help you decide on an area on specialise, and specialists usually get paid more money (especially if you’re a contractor/freelancer/consultant).  Microsoft exams are a big commitment no matter what level you’re at, so be prepared to have to invest significant amounts of your time into them.

I’m 70/30 in favour of sitting Microsoft exams, as long as you’re doing it for the right reasons.

Microsoft

How to pass Microsoft Exam 70-487 (Developing Microsoft Azure and Web Services) in 30 days

Before you continue reading this blog post, you need to be aware of the following; This is not a “quick fix” or an “easy solution”.  I have not discovered some secret formula to guarantee you pass with 100% marks every time.  The exam is genuinely challenging and the only way you are going to pass is by working hard!  You will not find any brain dumps here!  If you’re afraid of working hard to achieve your goals, you best leave now …

Still Here? Congratulations, you are taking your first steps towards passing the exam.  The purpose of this post is to link to all the resources that I used when revising for the exam myself. So why 30 days? Well its important to set yourself a target.  Setting yourself a target motivates you.  If you are paying for this exam yourself (like I did), you’ll really want to make sure you give the exam your best shot (after all, £99 is a hefty amount of money!)

Know the exam objectives

Probably the most important thing you should do before starting studying for any exam is to find out what the exam objectives are.  Basically the exam objectives tell you what to study for! There is not much point in learning material that is of no relevance! You can find the exam objectives under the “Skills Measured” section on the official 70-487 exam page.

Books

Books aren’t for everybody, some people find it hard to sit down and read a book … I get that, but you should at least try. Have a look at Exam Ref 70-487: Developing Windows Azure and Web Services. AzureWebServicesBook This book was written by William Ryan, Wouter de Kort, and Shane Milton.  Its no secret that I am generally not a fan of these books.  I generally find that they’re not particularly well written, boring, the examples arbitrary…but not this book.  I found this book to be a breath of fresh air and actually pleasurable and enjoyable to read.

Each objective on the exam receives equal coverage with helpful realistic exams.  The book is not chatty (which I like) but is in no way robotic (like some Microsoft books I have read in the past).  There are some good insights into the various technologies at a high level, and the authors are clearly very experienced in this field.

You may also want to scrub up on your Entity Framework as well, as this is mentioned in the exam objectives several times.  Probably one of the best Entity Framework books I have ever read was written by Julie Lerman, named Programming Entity Framework.  If you want to become a top Entity Framework developer, I highly recommend that you check it out.  There are also lots of Entity Framework posts on my blog.

Microsoft Virtual Academy (MVA) JumpStart

Microsoft has provided some great FREE training videos on the Microsoft Virtual Academy website, so its only polite that you fully exploit these resources. You will want to start with the Windows Azure Web Sites – Deep Dive Jump Start video series.  Just a note, you will need a free Microsoft account to access the videos.

Microsoft (Windows) Azure Deep Dive

Back in January, Microsoft put on an event in celebration of the awesomeness that is Microsoft (then called Windows) Azure.  This was 5 full days of Microsoft Azure training videos, hosted by the likes of Scott Gu and Scott Hanselman (et al).  I highly recommend that you check it out, but don’t spend too much time watching the videos targeted at DevOps or IT support people.  Just focus on the developer videos.

Pluralsight Training Videos

Pluralsight is a subscription (paid for) site offering training material for developers (and now IT professionals as well) at all levels, and in all stages of their careers.  If you don’t already have a subscription (??) you can get a free 10 day trial (up to 200 minutes) to give you a taste.  The subscription starts at a mere $29 (£17.08 ish) a month. Here are some of the videos I watched whilst preparing for this exam; (Make sure you follow along whilst the presenter is talking!)

My Honest Opinion

Brace yourselves, the truth is coming.  Don’t waste spend too much time studying Microsoft Azure.  But wait, isn’t this a Microsoft Azure exam? Well yes it is, but the questions I was asked about Microsoft Azure were pretty straightforward, and any competent developer could have used their powers of deduction to figure out the answers.  Instead, you should focus more of your efforts on getting hands on with WCF.  I wrote a few blog posts about various WCF topics, I recommend you check them out.

Summary

It is possible to pass Microsoft exams in 30 days, assuming you have some background knowledge in the subject and are prepared to work (very!) hard.  Microsoft make a lot of training resources available to you for free, and there are online training providers that can help you out as well (for a small fee).  There is no “one size fits all” or “silver bullet”, so you’ll want to try a range of resources to find what works best for you.  Don’t resort to cheating or you will be caught and banned for life! In case anybody is wondering, I passed the exam with a score of 93% in April 2014. If you found this article useful, please leave comments below!

download

Migration to WordPress.org

You may (or hopefully, may not) have noticed that JPreeceDev.com has finally been migrated to WordPress.org! This has been planned for quite some time now and really has gone a lot more smoothly that I could ever have hoped for.

What does this mean to you?  It means that I will be able to customize the site a lot more (resulting in a better experience for you), develop the brand a lot more (which will hopefully help me grow the site to new users), and add plugins and extensions to add new functionality.

WordPress.com has served me very well over the last 14 months, and for that I am truly grateful.  The site is now hosted on TSOHost.com, a well known WordPress host.  I see this as a big day and hopefully the start of something special.

Keep an eye out for the changes and let me know your thoughts via Twitter, Facebook or direct using the contact form.

As an aside, if you’re considering developing your own WordPress website, I found this book Create Your Own Website Using WordPress In a Weekend by Alannah Moore an extraordinarily useful book when I was starting out.

How to secure your WCF service and authenticate users

There are several steps involved in making your WCF service secure, and ensure that clients consuming your service are properly authenticated.  WCF uses BasicHttpBinding out-of-the-box, which generates SOAP envelopes (messages) for each request.  BasicHttpBinding works over standard HTTP, which is great for completely open general purpose services, but not good if you are sending sensitive data over the internet (as HTTP traffic can easily be intercepted).

This post discusses how to take a basic WCF service, which uses BasicHttpBinding, and upgrade it to use WsHttpBinding over SSL (with username/password validation). If you want to become a better WCF developer, you may want to check out Learning WCF: A Hands-on Guide by Michele Lerouz Bustamante. This is a very thorough and insightful WCF book with detailed and practical samples and tips.

Here is the basic sequence of steps needed;

  • Generate a self-signed SSL certificate (you would use a real SSL certificate for live) and add this to the TrustedPeople certificate store.
  • Add a UserNamePasswordValidator.
  • Switch our BasicHttpBinding to WsHttpBinding.
  • Change our MEX (Metadata Exchange) endpoint to support SSL.
  • Specify how the client will authenticate, using the ServiceCredentials class.

You may notice that most of the changes are configuration changes.  You can make the same changes in code if you so desire, but I find the process easier and cleaner when done in XML.

 

BasicHttpBinding vs. WsHttpBinding

Before we kick things off, i found myself asking this question (like so many others before me).  What is the difference between BasicHttpBinding and WsHttpBinding?

If you want a very thorough explanation, there is a very detailed explanation written by Shivprasad Koirala on CodeProject.com.  I highly recommend that you check this out.

The TL:DR version is simply this;

  • BasicHttpBinding supports SOAP v1.1 (WsHttpBinding supports SOAP v1.2)
  • BasicHttpBinding does not support Reliable messaging
  • BasicHttpBinding is insecure, WsHttpBinding supports WS-* specifications.
  • WsHttpBinding supports transporting messages with credentials, BasicHttpBinding supports only Windows/Basic/Certificate authentication.

The project structure

You can view and download the full source code for this project via GitHub, see the end of the post for more details.

We have a WCF Service application with a Service Contract as follows;

[ServiceContract]
public interface IPeopleService
{
    [OperationContract]
    Person[] GetPeople();
}

And the implementation of the Service Contract;

public class PeopleService : IPeopleService
{
    public Person[] GetPeople()
    {
        return new[]
                    {
                        new Person { Age = 45, FirstName = "John", LastName = "Smith" }, 
                        new Person { Age = 42, FirstName = "Jane", LastName = "Smith" }
                    };
    }
}

The model class (composite type, if you will) is as follows;

[DataContract]
public class Person
{
    [DataMember]
    public int Age { get; set; }

    [DataMember]
    public string FirstName { get; set; }

    [DataMember]
    public string LastName { get; set; }
}

The initial configuration is as follows’

<system.serviceModel>
  <behaviors>
    <serviceBehaviors>
      <behavior>
        <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
        <serviceDebug includeExceptionDetailInFaults="false"/>
      </behavior>
    </serviceBehaviors>
  </behaviors>
  <protocolMapping>
    <add binding="basicHttpsBinding" scheme="https"/>
  </protocolMapping>
  <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true"/>
</system.serviceModel>

The WCF service can easily be hosted in IIS, simply add a service reference to the WSDL definition file and you’re away.  In the interest of completeness, here is the entire client code;

static void Main(string[] args)
{
    PeopleServiceClient client = new PeopleServiceClient();

    foreach (var person in client.GetPeople())
    {
        Console.WriteLine(person.FirstName);
    }

    Console.ReadLine();
}

Hosting in IIS

As briefly mentioned, you can (and probably always will) host your WCF service using Internet Information Services (IIS).

Generating an SSL certificate

Before doing anything, you need an SSL certificate.  Transport based authentication simply does not work if A) You aren’t on a secure channel and B) Your SSL certificate isn’t trusted.  You don’t have to purchase an SSL certificate at this stage as a self-signed certificate will suffice (with 1 or 2 extra steps).  You will want to purchase a real SSL certificate when you move your service to the production environment.

You can generate a self-signed SSL certificate either 1 of 2 ways.  You can either do it the hard way, using Microsoft’s rather painful MakeCert.exe Certificate Creation Tool or you can download a free tool from PluralSight (of all places), which provides a super simple user interface and can even add the certificate to the certificate store for you.

Once you’ve downloaded the tool, run it as an Administrator;

SelfCert

For the purposes of this tutorial, we will be creating a fake website called peoplesite.local.  We will add an entry into the hosts file for this and set it up in IIS.  Its very important that the X.500 distinguished name matches your domain name (or it will not work!).  You will also want to save the certificate as a PFX file so that it can be imported into IIS and used for the HTTPS binding.

Once done open up IIS, click on the root level node, and double click on Server Certificates.  Click Import (on the right hand side) and point to the PFX file you saved on the desktop.  Click OK to import the certificate.

Import

Next, create a new site in IIS called PeopleService.  Point it to an appropriate folder on your computer and edit the site bindings.  Add a new HTTPS binding and select the SSL certificate you just imported.

EditBinding

Be sure to remove the standard HTTP binding after adding the HTTPS binding as you wont be needing it.

Update the hosts file (C:WindowsSystem32Driversetchosts) with an entry for peoplesite.local as follows;

127.0.0.1            peoplesite.local

Finally, flip back to Visual Studio and create a publish profile (which we will use later once we have finished the configuration).  The publish method screen should look something like this;

Publish

Configuration

Ok we have set up our environment, now its time to get down to the fun stuff…configuration.  Its easier if you delete everything you have between the elements and follow along with me.

Add the following skeleton code between the opening and closing tags, we will fill in each element separately;  (update the Service Name to match that in your project)

<services>
  <service name="PeopleService.Service.PeopleService" behaviorConfiguration="ServiceBehaviour">
    <host>
    </host>
  </service>
</services>
<bindings>
</bindings>
<behaviors>
  <serviceBehaviors>
  </serviceBehaviors>
</behaviors>

Base Address

Start by adding a base address (directly inside the host element) so that we can use relative addresses’;

<baseAddresses>
  <add baseAddress="https://peoplesite.local/" />
</baseAddresses>

Endpoints

Next, add two endpoints (one for the WsHttpBinding and one for MEX);

<endpoint address="" binding="wsHttpBinding" bindingConfiguration="BasicBinding" contract="PeopleService.Service.IPeopleService" name="BasicEndpoint" />
<endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" name="mex" />

Note that we are using mexHttpsBinding because our site does not support standard HTTP binding.  We don’t need to explicitly add a binding for the MEX endpoint as WCF will deal with this automatically for us.  Add a wsHttpBinding as follows;

<wsHttpBinding>
  <binding name="BasicBinding">
    <security mode="TransportWithMessageCredential">
      <message clientCredentialType="UserName" />
    </security>
  </binding>
</wsHttpBinding>

Bindings

This is where we specify what type of security we want to use.  In our case, we want to validate that the user is whom they say they are in the form of a username/password combination.  The TransportWithMessageCredential basic http security mode requires the username/password combination be passed in the message header.  A snoop using a HTTP proxy tool (such as Fiddler) reveals this;

fiddler

Service Behaviours

Finally we need to update our existing service behaviour with a serviceCredentials element as follows;

<behavior name="ServiceBehaviour">
  <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
  <serviceDebug includeExceptionDetailInFaults="true" />
  <serviceCredentials>
    <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="PeopleService.Service.Authenticator, PeopleService.Service" />
    <serviceCertificate findValue="peoplesite.local" storeLocation="LocalMachine" storeName="TrustedPeople" x509FindType="FindBySubjectName" />
  </serviceCredentials>
</behavior>

The two elements of interest are userNameAuthentication and serviceCertificate.

User Name Authentication

This is where we tell WCF about our custom authentication class.  Lets go ahead and create this.  Add a new class to your project called Authenticator.cs and add the following code;

using System.IdentityModel.Selectors;
using System.ServiceModel;

public class Authenticator : UserNamePasswordValidator
{
    public override void Validate(string userName, string password)
    {
        if (userName != "peoplesite" && password != "password")
        {
            throw new FaultException("Invalid user and/or password");
        }
    }
}

Basically, you can add whatever code you want here to do your authentication/authorisation.  Notice that the Validate method returns void.  If you determine that the credentials supplied are invalid, you should throw a FaultException, which will be automatically handled for you by WCF.

You should ensure that the customUserNamePasswordValidatorType attribute in your App.config file is the fully qualified type of your authenticator type.

Service Certificate

This is key, if this isn’t quite right nothing will work.  Basically you are telling WCF where to find your SSL certificate.  Its very important that the findValue is the same as your SSL certificate name, and that you point to the correct certificate store.  Typically you will install the certificate on the LocalMachine in the TrustedPeople certificate store.  I would certainly recommend sticking with the FindBySubjectName search mode, as this avoid issues when you have multiple SSL certificates with similar details.  You may need a little trial and error when starting out to get this right.  If you have been following this tutorial throughout, you should be OK with the default.

Supplying user credentials

We just need one final tweak to our test client to make all this work.  Update the test client code as follows;

PeopleServiceClient client = new PeopleServiceClient();
client.ClientCredentials.UserName.UserName = "peoplesite";
client.ClientCredentials.UserName.Password = "password";

We pass in the client credentials via the, you guessed it, ClientCredentials object on the service client.

If you run the client now, you should get some test data back from the service written out to the console window.  Notice that you will get an exception if the username/password is incorrect, or if the connection is not over SSL.

Troubleshooting

SecurityNegotiationException

As an aside, if you receive a SecurityNegotiationException please ensure that your self-signed certificate is correctly named to match your domain, and that you have imported it into the TrustedPeople certificate store.

SecurityNegotiationException

A handy trick for diagnosing the problem is by updating the service reference, Visual Studio will advise you as to what is wrong with the certificate;

SecurityAlert

Summary

With a few small configuration changes you can easily utilise WS-Security specifications/standards to ensure  that your WCF service is secure.  You can generate a self-signed SSL certificate using a free tool from Pluralsight, and install it to your local certificate store and IIS.  Then you add a UserNamePasswordValidator to take care of your authentication.  Finally, you can troubleshoot and debug your service using Fiddler and Visual Studio.

github4848_thumb.pngThe source code is available on GitHub

Entity Framework – Use a Guid as the primary key

Using a Guid as your tables primary key, when using Entity Framework, requires a little more effort than when using a integer.  The setup process is straightforward, after you’ve read/been shown how to do it.

The process is slightly different for the Code First and Database First approaches.  This post discusses both techniques.

Code First

Using a Guid as the primary key when taking the code first approach is simple.  When creating your entity, add the DatabaseGenerated attribute to your primary key property, as shown below;

[DatabaseGenerated(DatabaseGeneratedOption.Identity)]
public Guid Id { get; set; }

Entity framework will create the column as you would expect, with a primary key and uniqueidentifier data type.

codefirst-defaultvalue
Click to zoom in

Also notice, very important, that the default value on the column has been set to (newsequentialid()).  This generates a new sequential (continuous) Guid for each row.  If you were so inclined, you could change this to newid()), which would result in a completely random Guid for each new row.  This will be cleared each time your database gets dropped and re-created, so this works better when taking the Database First approach.

Database First

The database first approach follows a similar line to the code first approach, but you’ll have to manually edit your model to make it work.

Ensure that you edit the primary key column and add the (newsequentialid()) or (newid()) function as the default value before doing anything.

Next, open you EDMX diagram, select the appropriate property and open the properties window.  Ensure that StoreGeneratedPattern is set to identity.

databasefirst-model
Click the image to zoom in

No need to give your entity an ID in your code, that will be populated for you automatically after the entity has been commited to the database;

    using (ApplicationDbContext context = new ApplicationDbContext())
    {
        var person = new Person
                         {
                             FirstName = "Random",
                             LastName = "Person"
                         };

        context.People.Add(person);
        context.SaveChanges();
        Console.WriteLine(person.Id);
    }

Important Note: Your Guid field MUST be a primary key, or this does not work.  Entity Framework will give you a rather cryptic error message!

Summary

Guid (Globally Unique Identifiers) can easily be used as primary keys in Entity Framework.  A little extra effort is required to do this, depending on which approach you are taking.  When using the code first approach, add the DatabaseGenerated attribute to your key field.  When taking the Database First approach, explicitly set the StoredGeneratedPattern to Identity on your model.