Microsoft Technology Licensing, LLC

Bilal Alam

Madhur Joshi

Jaroslav Dunajsky

Clea H Allington

Fabio A Yeon

Carlos Aguilar Mares

Nina Tang

Vijay Sen

Dmitry Robsman

Anil K Ruia

Michael Courage

Manu Vasandani

Kanwaljeet Singla

Saad Ladki

Murali R Krishnan

Charles Lamanna

Erik B Olson

Wade Hilmo

Michael D Volodarsky

David Wang

Asim Mitra

Nitasha Verma

J Michael Stall

Robert J Lucero

Brian Delahunty

Galin Iliev

Clea (Faith) Allington

Thomas Deml

Techniques are described herein that are capable of dynamically activating web applications. For instance, such applications may not be configured on a machine until requests for those applications are received by the machine. For example, upon receipt of such a request, the machine may automatically configure an application that is identified by the request on the machine. The machine may then forward the request to the application for processing. In another example, the machine may run an application-agnostic worker process (AAWP), which configures an application on the machine upon receipt of a request for the application. An AAWP is a worker process that is capable of processing requests for web application(s) that are not previously associated with the AAWP. The AAWP may cause a specified worker process to run on the machine, so that the specified worker process may process the request and/or subsequent requests for the application.

Dynamic activation of web applications

Embodiments are directed to a system for controlling access to remote services, comprising an application programming interface (API) hub configured to provide an interface between a client application and one or more remote services. The client application accesses the API hub using a common data protocol, such as OData, that is not associated with the remote services. The API hub selects a connectors based upon the targeted remote service and maps a user context associated with messages received from the client application to remote service credentials associated with the targeted remote service.

Application programming interface (API) hub

An installation package may have metadata concerning optional parameters for a software package to be installed. The metadata may be read by an installation system, and a user interface presented to a user for input on the parameters values. The installation system may store the parameters for later replication of the installation. The installation system may perform the installation on a local device or a remote device, and may further be capable of presenting the user interface on another device. In some embodiments, the metadata may be available to the installation system without having to open the installation package.

Parameterized installation packages

Described is a technology in which a destination machine (e.g., a server) is synchronized with source data via an API, including to configure the destination machine. The API includes functions for specifying the source data, the destination machine, and the deployment/synchronization type, along with a function for synchronizing the source data to the destination machine. The API allows combining content, configuration data and/or database data into a single unit (object). The API handles communication with a service/agent on the destination machine that configures that destination machine based on the source data. The API may include functions for packaging web applications, deploying web applications, synchronizing websites, deploying archive data, and/or deploying manifest data. In this manner, deployment/synchronization (including backup operations) may be performed against a group of objects using an API.

Web deployment functions and interfaces

Described is a technology in which a non-administrator computer/web user is allowed to perform an administrative-level task within a certain context and/or scope. An authorization store is queried based on information (e.g., a provider, a username, and a path) provided with an authorization request, e.g., from an application via an API. The information in the authorization store, set up by an administrator, determines the administrative action is allowed. If so, a credential store provides credentials that allow the action to be runs before reverting the user to the prior set of credentials. Also described is a pluggable provider model through which the authorization store and/or delegation store are accessed, whereby the data maintained therein can be any format and/or at any location known to the associated provider.

Web management authorization and delegation framework

Secure and stateless data transfer between a source agent at a first computer system and a destination agent at a second computer system is provided. A first list of labels of content structures is generated at the first computer system. During a first data transfer session, the first list, authentication information, at least one object included in the content structures, and file identifiers for one or more files included in the content structures are transferred from the first computer system to the second computer system. A second list is generated at the second computer system and received at the first computer system. The second list lists at least one requested file identified by the transmitted file identifier(s). During a second data transfer session, authentication information, the first list, the at least one object, and the requested file(s) are transferred from the first computer system to the second computer system.

Stateless agent

Methods are provided for utilizing a modular server architecture for processing requests for services, such as authorization and authentication, in a web server. The modular server architecture includes self-contained modular components that can be plugged in and out of the web server, as needed, to provide requested web services. The modular server architecture is also extensible in that it provides set of server APIs for processing requests for supporting built-in server functionality as well as functionality provided by third party modular components. The modular server architecture also supports the integration of request processing tasks for both native and managed modular components, such as ASP.NET modules, by virtue of a managed module host component. The modular server architecture also optimizes server performance by only providing modular component functionality when needed. By utilizing the modular server architecture, server functionality is extended, duplication of request processing tasks is eliminated and performance administrative overhead is reduced.

Modular server architecture for multi-environment HTTP request processing

A web server arrangement includes user-mode web application logic that is configured to receive a web request and process the web request and generate a web request response. Vector send logic is then employed to identify a location of content of the web request response using a vector array. Kernel-mode vector receive logic then assembles the web request response in a contiguous section of kernel-mode or other like memory based on the vector array. Kernel mode universal listener logic then sends the assembled web request response to the requesting client application logic.

Vector-based sending of web content

A method, system, and article of manufacture for providing an authentication and authorization pipeline for use in a web server to grant access to web resources to users. The server creates an entry within an userID to roles database for each user who may access resources present on the web server and creates an entry within the roles to resource database for each resource that may be accessed on the web server. The server then authenticates the identify of each user accessing a resource on the web server using a userID, one or more authentication parameters, and a resource access request, creates a data object having an authenticated userID and one or more roles corresponding to the authenticated userID obtained from the userID to roles database, and authorizes access to a resource identified within the resource access request if one or more roles within the data object correspond to an access role corresponding to the roles listed within the roles to resource database for the identified resource.

Authentication and authorization pipeline architecture for use in a server

Methods and apparatuses are provided for use in servers or other like devices that output content data based on requests. Activity and/or other like information, e.g., in the form of Metadata, is gathered/maintained for each handled request and used to determine if the corresponding content data should be cached in memory to speed up subsequent similar requests for the content data, or conversely removed from the memory cache. The activity and/or other like information can be considered in light of one or more activity or other useful parameters that define the operation of the resulting content data cache(s).

System for selectively caching content data in a server based on gathered information and type of memory in the server

A way of reducing the impact of denial of service attacks is presented. For each connection request received by a server, the server attempts to establish a connection to accommodate the corresponding request. For each connection request that the server cannot currently handle, the connection request is placed in a backlog queue for future handling. If one or more of the backlog queues have entries, connection sockets that have connections but no received request data are identified and disconnected. Such connection sockets would be highly suspect of being generated as a result of denial of service attacks. Upon disconnection, resources are freed for legitimate requests thereby improving server performance even during denial of service attacks.

Growing community of inventors

Sammamish, WA, United States of America

Bilal Alam