dev4dxc-coursebook (1)

Episerver Developing for DXC Service January 2019 Product version: Update 247 Course version: 19.01 Episerver

Course title: Episerver – Developing for DXC Service Course code: 770-3020 Course version: 19.01, 16th January 2019 Product version: Update 247, 15th January 2019 Episerver CMS Visual Studio Extension version: 11.5.0.383 (includes EPiServer.CMS 11.10.1) Episerver packages: EPiServer.CMS 11.10.6, EPiServer.Find 13.0.5 Episerver Azure integration package: EPiServer.Azure 9.4.4, 10th August 2018 https://world.episerver.com/releases/ Episerver Copyright © 2019 Episerver. All rights reserved. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without expressed written permission of Episerver AB. We assume no liability or responsibility for any errors or omissions in the content of this document. Episerver is a registered trademark of Episerver AB.

Course Material Disclaimer Important Disclaimer This course material (“Course Material”) has been prepared by Episerver AB, Episerver Inc. and various other subsidiaries (“Episerver”) based on information available from them and third party sources. By retaining this Course Material, you (“the Recipient” or “You”) acknowledge and represent to Episerver that You have read, understood and accepted the terms of this Important Notice. If You do not accept these terms, You should immediately destroy or delete this Course Material. This Course Material does not purport to contain all the information that You or a third-party may require in any connection with any business with Episerver. You shall not use or rely on contents of this Course Material, or any information provided in connection with it, as product or service advice. No representation or warranty is made by Episerver or any of its advisers, agents or employees as to the accuracy, completeness or reasonableness of the information in this Course Material or provided in connection with it. No information contained in this Course Material or any other written or oral communication in connection with it is, or shall be relied upon as, a promise or representation and no representation or warranty is made as to the accuracy or attainability of any estimates, forecasts or projections set out in this Course Material. No liability will attach to Episerver, with respect to any such information, estimates, forecasts or projections. All third-party trademarks used within the Course Material are acknowledged, and used for only reference purposes. Episerver 3 Episerver does not accept responsibility or liability for any loss or damage suffered or incurred by You or any other person or entity however caused (including, without limitation, negligence) relating in any way to this Course Material including, without limitation, the information contained in or provided in connection with it, any errors or omissions from it however caused (including without limitation, where caused by third parties), lack of accuracy, completeness, currency or reliability or You, or any other person or entity, placing any reliance on this Course Material, its accuracy, completeness, currency or reliability. Any liability of Episerver (including advisers, agents and employees) to You or to any other person or entity arising out of this Course Material including any corresponding provision of any territory legislation, or any applicable law is, to the maximum extent permitted by law, expressly disclaimed and excluded. You agree not to reproduce, print, re-transmit, copy, distribute, publish or sell any of the contents of this Course Material without the prior written consent of Episerver. Reproduction of part or all of the contents of this Course Material in any form is expressly prohibited and may not be recopied and/or shared with a third party. The permission to recopy by an individual does not allow for incorporation of material or any part of it in any work or publication, whether in hard copy, electronic, or any other form. Copyright © 2019 Episerver. All rights reserved. Copyright © 2019 Episerver. All rights reserved. Page 3

Episerver – Developing for DXC Service Introduction In this module, you will learn about the Episerver – Developing for DXC Service course and you will establish an Integration environment to use during the exercises. Prerequisites are attendance on Episerver CMS – Development Fundamentals or equivalent experience. Episerver Copyright © 2019 Episerver. All rights reserved. Page 7

Episerver – Developing for DXC Service Introduction • Exercises for Introduction Module agenda • Exercise I1 – Creating the Alloy site • About the course • Exercise I2 – Preparing your Integration • Tools environment • Azure resources • Getting more information • Exercise I3 – Optional: Templating the Integration environment Episerver Copyright © 2019 Episerver. All rights reserved. Page 8

Episerver – Developing for DXC Service About the course Personalization Find for Development Developers (1 day) Fundamentals (1 day) Developing for Course tracks for developers DXC Service (1 day) CMS Development Commerce Development CMS Development Fundamentals (3 days) Fundamentals (3 days) Fundamentals (3 days) CMS Advanced Commerce Advanced Commerce Development Development (3 days) Development (3 days) Fundamentals (3 days) CMS Developer Commerce Developer CMS & Commerce Boot Camp (5 days) Boot Camp (5 days) Fundamentals (5 days) CMS Masterclass https://education.episerver.com/collections/developers + exam (2 days) Episerver Episerver CMS – Development Fundamentals This step-by-step guide-style training course focuses on developing core functionality for Episerver CMS solutions, including defining custom content types and templates, handling media, reusing shared content, implementing navigation and indexed search, and optimizing, securing, and deploying websites, both on- premise and in the cloud. Episerver CMS – Advanced Development This cookbook-style training course is a deep dive into development with Episerver CMS with focus on reviewing the fundamentals and then customizing and extending the Episerver platform following recommended good practice. You will learn how to use APIs for taking control of content approvals, user notifications, and key performance indicators, you will integrate data with partial routers and a combination of scheduled jobs and system-level content events, and you will integrate Episerver Find and Episerver Social microservices to build advanced features into your websites. Episerver CMS – Developer Boot Camp Get up to speed with Episerver CMS development – fast! Join our Developer Boot Camp and get set to both take on real world projects with Episerver CMS and prepare to test your competence with the Episerver Certified Developer for Episerver CMS 11 exam. This course includes all the content from our Development Fundamentals and Advanced Development training courses in an accelerated format. Developing for DXC Service Learn how to successfully develop Episerver solutions for the cloud, taking into account development, deployment, and security considerations, so that you avoid the common traps and have a smooth productive experience with Episerver’s DXC Service. Episerver Find for Developers Learn all about the magic behind Episerver Find. With this course you will get the skills necessary to build a powerful search function, including automatic landing pages and dynamic navigation. Copyright © 2019 Episerver. All rights reserved. Page 11

Episerver – Developing for DXC Service Introduction – About the course Course agenda Duration Module Description 30 minutes 45 minutes Introduction About the course. 45 minutes Exercises Prepare an Alloy (MVC) site and your Integration environment. 60 minutes Module A: About DXC What is DXC Service? Package choices. Microsoft Azure services we 120 minutes Service use. Security features. 90 minutes Module B: Deploying to Deployment environments and technologies. Web.config 120 minutes DXC Service transformations. Continuous integration. Episerver Exercises Manual and automated deployments, remote debugging, logging. Module C: Development Multi-sites. Caching. Controlling the environment. Transient fault Considerations handling. Queue design patterns. Exercises Implementing asynchronous operations, caching, transient fault handling, queuing. Copyright © 2019 Episerver. All rights reserved. Page 12

Episerver – Developing for DXC Service Introduction – About the course About the course content 50% 50% This is a fast-paced guided tour of DXC Service and how developers need to change coding and deployment practices to work well in the cloud and DXC Service-specific topics specifically with DXC Service. General cloud topics • Half of the course topics are specific to DXC Service. For example, developer considerations for using the multi-site feature, and understanding the three environments we provide for deployment. • Half of the course topics are general guidelines for developing and deploying for the cloud. For example, developer considerations for transient fault handling, and using continuous integration tool sets like Azure DevOps Services or TeamCity and Octopus Deploy. These topics are useful both for DXC Service, or if you choose to manage (and pay the cost) to deploy to Microsoft Azure, Amazon Web Services (AWS), or another cloud provider. Episerver Copyright © 2019 Episerver. All rights reserved. Page 14

Episerver – Developing for DXC Service Introduction – About the course About the course exercises Using the actual DXC Service to do course exercises is dev4dxc-exercisefiles.zip contains files that practically impossible during a one-day training course you can copy and paste instead of copying because the on-boarding process, initial set up, and poorly formatted text from the PDFs. deployment to environments cannot be performed in just a few hours. Some exercises have been designed so that they can be completed on your local computer in an emulated environment by using Visual Studio and the Azure SDK. But some of the exercises require an Azure account (and an Internet connection!) • You should have registered a new Azure account, or obtained access to an existing Azure account, in which you created a resource group and resources, before attending the course. Completing the Azure Resources Set Up exercise will provide you with a similar experience to using DXC Service’s Integration environment that you can then use for the rest of the course exercises. Episerver Exercise dependencies Azure Resources Set Up I2 Integration I3 Exploring ARM B2 Publishing B3 Remote environment templates B4 CI debugging, C1 Asynchronous monitoring, and operations B1 Transforming C2 Caching configurations logging I1 Alloy site C3 Transient faults C4 Queuing pattern These exercises require an Internet connection and an Azure account. These exercises require the Azure SDK installed on a local computer. Copyright © 2019 Episerver. All rights reserved. Page 15

Episerver – Developing for DXC Service Introduction – Tools Software requirements • Microsoft Visual Studio 2015 or 2017 • Episerver CMS Visual Studio Extension • Microsoft Azure SDK • Microsoft Azure account Episerver Copyright © 2019 Episerver. All rights reserved. Page 18

Episerver – Developing for DXC Service Introduction – Tools Microsoft Visual Studio tools Cloud Explorer • Networking Server Explorer • SQL Servers and • App Service (Web Databases Apps) • Storage (ASM and ARM) • Cloud Services (Web • Virtual Machines Role, Worker Role) Warning! • Mobile Services Only Cloud Explorer can • Service Bus manage Storage Accounts • SQL Databases created with ARM. • Storage (ASM-only) • Virtual Machines Episerver Azure deployment models • Azure Service Management (ASM) aka “Azure 1.0” aka “Classic” • Azure Resource Manager (ARM) aka “Azure 2.0” Azure Resource Manager vs. classic deployment: Understand deployment models and the state of your resources https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-deployment-model Copyright © 2019 Episerver. All rights reserved. Page 19

Episerver – Developing for DXC Service Introduction – Tools Azure portal Microsoft Azure portal https://portal.azure.com/ The Developer’s Guide to Microsoft Azure https://aka.ms/azuredevebook Episerver Overview of Azure PowerShell https://docs.microsoft.com/en-us/powershell/azure/overview Azure speed test tool. Test your network latency and speed to Azure datacenters around the world. http://www.azurespeed.com/ Install Azure PowerShell with PowerShellGet The preferred way to install Azure PowerShell is using PowerShellGet. The following commands show how to: 1. Install Azure PowerShell 2. Load its module before use 3. Check the versions installed Install-Module -Name AzureRM –AllowClobber Import-Module -Name AzureRM Get-Module AzureRM -ListAvailable | Select-Object -Property Name,Version,Path https://docs.microsoft.com/en-us/powershell/azure/install-azurerm-ps Copyright © 2019 Episerver. All rights reserved. Page 20

Episerver – Developing for DXC Service Introduction – Tools You will use Azure Storage Explorer in the exercises to upload media assets into a Blob container. Azure Storage Explorer and AzCopy Microsoft Azure Storage Explorer is a standalone app from Microsoft that allows you to easily work with Azure Storage data on Windows, macOS, and Linux. http://storageexplorer.com/ A command line tool that is useful is AzCopy. https://docs.microsoft.com/en- us/azure/storage/storage-use-azcopy Episerver Copyright © 2019 Episerver. All rights reserved. Page 21

Episerver – Developing for DXC Service Introduction – Azure resources Recommended naming conventions for Azure resources The choice of a name for any resource in Microsoft Azure is important because it is difficult to change a name at a later time and names must meet the requirements of their specific resource type. https://docs.microsoft.com/en-gb/azure/architecture/best-practices/naming-conventions Resource Suggested name Resource group for DXC Alloy project in Integration environment in West Europe dxcalloy-we-inte-rg Storage account inside the resource group (non-alphanumeric NOT allowed) dxcalloystore001 * One of many queues in the storage account dxcalloy-inte-orders-queue-001 App service plan for Integration environment at S1 pricing tier dxcalloy-inte-plan-s1 App service: Web App (you would assign a custom domain for the public site) dxcalloy-inte-app * * These names must be globally unique because they are part of public URLs. Episerver Copyright © 2019 Episerver. All rights reserved. Page 23

Episerver – Developing for DXC Service Introduction – Azure resources Azure Resource Manager (ARM) templates A modern alternative to writing long scripts of cmdlets is to use Azure Resource Manager (ARM) templates. These are JSON files that describe a resource group and all the resources within it. You can use a graphical explorer for learning HTTP APIs and PowerShell commands for all your resources at this link: https://resources.azure.com/ Episerver Copyright © 2019 Episerver. All rights reserved. Page 24

Episerver – Developing for DXC Service Introduction – Azure resources Episerver cloud accounts You need an Episerver cloud account to use the self-services for Episerver DXC Service. • DXC Service Management Portal for deployment and DXC Service Dashboard for usage information • Read access to see information or Contributor access to modify the Integration environment Log in to Azure and select EPiServer Managed Services to switch to the directory with your DXC Service-related subscriptions. Creating an Episerver cloud account https://world.episerver.com/digital-experience-cloud-service/creating-an-episerver-cloud-account/ Episerver Cloud developer license When using your actual DXC Service environments, they will already include a valid license file. If you want to experiment before you have a DXC Service Integration environment, then you can order a cloud developer license to remove the warning message that you will see when deploying to Azure resources that you create yourself, like the ones you will create during this course. https://license.episerver.com/ Copyright © 2019 Episerver. All rights reserved. Page 25

Episerver – Developing for DXC Service Introduction – Getting more information Knowing where to get help Episerver CMS 11.1 is the oldest supported version for new customers on DXC Service. Episerver World is where you go to read the documentation for CMS developers: Episerver CMS 11.1 or later requires • Commerce 11.5 or later • http://world.episerver.com/cms • A/B testing 2.5 or later • Forms 4.9 or later You can ask questions and make feature • Find 12.7 or later requests in the forums: • Social Reach 2.3 or later • Google Analytics 2.0 or later • http://world.episerver.com/forum • Languages 3.1 or later • http://world.episerver.com/forum/developer-forum/Feature-requests/ You can record a support ticket: • http://world.episerver.com/support You can find a list of fixed bugs and new features about a specific release: • http://world.episerver.com/releases and http://world.episerver.com/documentation/Release-Notes/ Episerver Copyright © 2019 Episerver. All rights reserved. Page 27

Episerver – Developing for DXC Service Introduction – Getting more information Episerver product team blogs The Cloud Team blog http://world.episerver.com/product-blogs/the-cloud-blog/ The CMS Team blog http://world.episerver.com/product-blogs/the-cms-blog/ The Commerce Team blog http://world.episerver.com/product-blogs/the-commerce-blog/ The Find Team blog http://world.episerver.com/product-blogs/the-find-blog/ The Campaign Team blog http://world.episerver.com/product-blogs/the-campaign-blog/ The Social Team blog http://world.episerver.com/product-blogs/the-social-blog/ The Personalization Team blog http://world.episerver.com/product-blogs/the-personalization-blog/ Episerver Copyright © 2019 Episerver. All rights reserved. Page 28

Episerver – Developing for DXC Service Introduction – Getting more information DXC Service documentation https://world.episerver.com/digital-experience-cloud-service/ Episerver Copyright © 2019 Episerver. All rights reserved. Page 29

Episerver – Developing for DXC Service Introduction – Getting more information Troubleshooting tips for Visual Studio Try closing and re-opening views (.cshtml) Sometimes Visual Studio mistakenly shows errors in views even after the error has been fixed. Try closing and re-starting Visual Studio Sometimes Visual Studio gets confused. Exiting and re-starting sometimes fixes it. Disable ASP.NET’s optimized compilations If you get ASP.NET dynamic compilation errors, disable optimizeCompilations in the root Web.config: <system.web> <compilation debug=\"true\" targetFramework=\"4.6.1\" optimizeCompilations=\"false\" /> Once it’s working again, reset back to true for faster performance. ☺ Episerver Disable Visual Studio’s Browser Link If the browser seems to hang while drawing the Episerver UI, it may be Visual Studio’s Browser Link feature interfering with our Dojo library: disable Browser Link to prevent the JavaScript error. Reset IIS or IIS Express Use the iisreset command line to stop and restart IIS or use the Taskbar tray icon for IIS Express, as shown in the following screenshot: Empty ASP.NET Temporary Files folder By default, the dynamic compilation of views stores the assemblies (*.dll) in a temporary folder. Stop the site, shut down Visual Studio, and clear the folder sometimes fixes issues. Disable Web Sockets on Windows 7 (to hide error messages about no real-time communication) <add key=\"Epi.WebSockets.Enabled\" value=\"false\" /> http://world.episerver.com/documentation/developer-guides/CMS/user-interface/websocket-support/ Copyright © 2019 Episerver. All rights reserved. Page 30

Episerver – Developing for DXC Service Introduction – Developing for DXC Service Exercises for Introduction *To save time, instead of using your Alloy (MVC) site’s database and media assets, you can use • Creating the Alloy site: create an Episerver site the files provided in the Exercise Files ZIP. by using the Alloy (MVC) sample site, and prepare it for deployment to Azure. • Preparing your Integration environment: upload your Alloy site’s database* and media assets* to your Integration environment. • Optional: Templating the Integration environment: explore ARM templates. https://docs.microsoft.com/en-us/azure/azure-resource- manager/vs-azure-tools-resource-groups-deployment-projects- create-deploy Episerver Copyright © 2019 Episerver. All rights reserved. Page 31

Episerver – Developing for DXC Service Module A – About DXC Service Module A About DXC Service In this module, you will learn about DXC Service, how it is different from Episerver’s DXC License, how it is built on Microsoft Azure services, and how it is secured against attacks. Episerver Copyright © 2019 Episerver. All rights reserved. Page 32

Episerver – Developing for DXC Service Module A – About DXC Service • Exercises A1 and A2 • Exercise A1 – DXC Service quiz Module agenda • Exercise A2 – Penetration Test application • Technology • Packages • Add-Ons • Management • Failover • Security Episerver Copyright © 2019 Episerver. All rights reserved. Page 33

Episerver – Developing for DXC Service Module A – About DXC Service Understanding Episerver product names Some people use just “DXC” to refer to DXC Service. • Digital Experience Cloud (DXC): an umbrella term for all Episerver products and services, even when not hosted in the “cloud”. • DXC License: our products charged per server or server instance. DXC License Server (tied to MAC address) Instance (“phones home” to check license) Perpetual On-premise In cloud (AWS, Azure, and so on) Term-Limited On-premise In cloud (AWS, Azure, and so on) • DXC Service: our products charged per consumption rates. All underlying services used by DXC Service are included. Page views and SKUs in excess of the agreed amount will be billed at the contracted overage rate. Prepaid excess consumption is discounted. • This training course is about DXC Service, Episerver Digital Experience Cloud Service Description: http://www.episerver.com/legal/episerver-dxc-service-description/ Episerver Copyright © 2019 Episerver. All rights reserved. Page 34

Episerver – Developing for DXC Service Module A – About DXC Service – Technology Episerver’s DXC Service What are On-Prem, IaaS, PaaS, and SaaS? Developers Admins / Editors / view Visitors view IaaS Google, Microsoft, Amazon all offer custom VMs. PaaS Microsoft Azure App Service, Google AppEngine. SaaS Google Gmail & Docs, Salesforce. Episerver Copyright © 2019 Episerver. All rights reserved. Page 36

Episerver – Developing for DXC Service Module A – About DXC Service – Technology DXC Service architecture DXC-S Digital Commerce package includes everything in this diagram. DXC-S Digital Marketing package is the same but without the Commerce Manager instances. Specific technologies can be replaced with better alternatives in the future. Your code should target Episerver APIs, not a specific platform-as-a- service like Microsoft Azure Service Bus. http://world.episerver.com/digital-experience-cloud- service/introduction/ Episerver DXC Service is a platform built on top of other platforms There are many platform(s)-as-a-service, provided by Microsoft and others, for example: • Microsoft Azure App Service (including Web Apps) is a Web Server-as-a-Service • Microsoft Azure SQL Database is an RDBMS-as-a-Service • Microsoft Azure Service Bus is Communication-as-a-service (relays, queues, and so on) • SendGrid is Transactional Email-as-a-service • CloudFlare is Caching and Firewall-as-a-service • Application Insights is Application Monitoring-as-a-service You don’t need to know or configure what DXC Service is built on: Episerver makes sure it meets requirements, and we might replace the platforms that we currently use with better options in the future. Copyright © 2019 Episerver. All rights reserved. Page 37

Episerver – Developing for DXC Service Module A – About DXC Service – Technology Azure resources used by DXC Service Episerver does not allow any Azure components to be provisioned out of the standard architecture. For example, although DXC Service uses Azure Storage Blobs and Azure Service Bus resources, you should not create your own resources in the same account. Any such resources could be deleted when Episerver clean up scripts run. However, you can: • Use the Azure resources via the Episerver APIs, e.g. the Events API that uses Service Bus. • Create your own account and then you would be responsible for their management and cost. Your applications should make no assumptions about factors such as, “how much memory does the virtual machine have?” because the VMs can scale up (have more memory and CPU) or scale out (more instances) dynamically. These factors also depend on your package choice, and decisions that Episerver makes in the future. App Service and SQL Database instances are typically S1 or higher, including Premium instances, but will auto-scale and will handle whatever SLA you’ve paid for. Episerver Azure services that we use in DXC DXC is built on top of Microsoft Azure services such as the App service, SQL database, Blob storage, and Service bus, but you don’t need to know how to work with them directly. Episerver CMS and Commerce databases use SQL servers and SQL databases, using SQL elastic pools for efficiency. Episerver media assets (images, videos, PDFs, and so on) are stored in Storage accounts as BLOBs. Both use the most premium tiers to provide geo-redundancy and other advanced features. Episerver web sites and services are hosted in App Services managed by App Service plans that define the VM size and auto-scaling configuration. Messaging between web sites, for example, to control caching of content objects in load balanced scenarios, is provided by Service Bus topics. Copyright © 2019 Episerver. All rights reserved. Page 38

Episerver – Developing for DXC Service Module A – About DXC Service – Technology Requirements Minimum Episerver product versions for new solutions onboarding DXC Service: • EPiServer.CMS.UI.Core 11.1.0, EPiServer.CMS.Core 11.2.1, EPiServer.Find 13.0.3, EPiServer.Commerce 11.5.0 Features not compatible with DXC Service: • Episerver CMS Mirroring, Windows Workflow Foundation, Episerver Search (uninstall the NuGet package to remove it from your solution prior to deployment), Solr Search Provider Add-ons not compatible with DXC Service: • Episerver CMO, Episerver Mail, Episerver Relate http://world.episerver.com/digital-experience-cloud-service/requirements/ Episerver Copyright © 2019 Episerver. All rights reserved. Page 39

Episerver – Developing for DXC Service Module A – About DXC Service – Packages Understanding the Master Package and Additional Packages With DXC-S, you pay for a Master Package and one or more Additional Packages and Add-Ons. A Master Package includes the following: • A number of page views per year (so that you don’t overpay for seasonal peak traffic). • A number of SKUs per environment that are managed and indexed for search. • A number of transactional emails per month. • An advanced firewall for attack prevention. • A Content Delivery Network (CDN) for caching, improving scalability and responsiveness. • A multi-domain SSL certificate. Additional Packages can be added for a fraction of a Master Package cost. Additional numbers of page views and SKUs are merged into a single “bucket”. Prepay and overage charges are per 25k page views and 20k SKUs. Prepay is half the cost of overage. Episerver Each Master Package and Additional Package is associated with a code base i.e. Visual Studio Web Application project. You have two choices for multiple sites: • A Master Package with a single code base using Episerver’s multi-site capability, or • A Master Package with Additional Package(s) for each additional code base. If you purchase Additional Packages, the number of page views and SKUs consumed aggregate towards the same total available for the Master Package, however the Additional Package has its own set of environments because it has its own code base. Copyright © 2019 Episerver. All rights reserved. Page 41

Episerver – Developing for DXC Service Module A – About DXC Service – Packages More page views, emails, languages, DXH connectors, additional application and DXC packages – Digital Marketing (CMS + Find) deployment packages, and SLA upgrades can be added at additional cost. Package Page Views Emails SLA Incident Languages2 DXH3 per year1 per month response /Indexes Connectors Group Corporate 2.4m 10k 99.7% 60 minutes, 10 / 1 per 0 12m Enterprise 100k business days environment 60m 250k 99.9% 30 minutes, All2 / 1 per 2 24/7/365 environment 1 Page views are calculated over the whole year so you don’t have to worry about seasonal peaks. 2 Included languages for Enterprise Search (aka Find). Find implements 33 languages. Find actually allows hundreds of languages, but 33 have full implementations of features like word stemming. 3 Included Digital Experience Hub (DXH) Connectors for marketing and productivity services. Google Analytics is a free add-on and is not considered a DXH connector. Episerver Understanding page views per year Month Page views Jan 4,000,000 For measurement purposes, the definition of a page view is the same as Feb 1,000,000 Google’s: Mar 1,000,000 Apr 1,000,000 • A view of a page on a customer site that is being provided by DXC. May 1,000,000 • If a user clicks reload, this is counted as an additional page view. Jun 1,000,000 • If a user navigates to a different page and then returns to the original page, a Jul 1,000,000 Aug 1,000,000 second page view is recorded. Sep 1,000,000 Oct 1,000,000 As developers, you can reduce page views by setting how long a response will be Nov 15,000,000 stored in the browsers cache: Dec 7,000,000 Total 35,000,000 • Configure Episerver’s output cache and apply [ContentOutputCache] action filter attribute, or • Directly set cache control via the Response intrinsic object. 20,000,000 15,000,000 10,000,000 5,000,000 0 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Copyright © 2019 Episerver. All rights reserved. Page 42

Episerver – Developing for DXC Service Module A – About DXC Service – Packages DXC packages – Digital Commerce (CMS + Find + Commerce) Package Page Views SKUs Emails SLA Incident Languages DXH per year per month response /Indexes Connectors Group Catalog Group 2.4m 50k 10k 99.7% 60 minutes, 10 / 1 per 0 Corporate 12m 200k 60m 1m 100k business days environment Enterprise 250k 99.9% 30 minutes, All / 1 per 2 24/7/365 environment The main difference between the Digital Marketing and Digital Commerce packages is the inclusion of a license for our Commerce product, count limits on SKUs, and a package named Group Catalog that is for catalog sites, i.e. a read-only commerce site that does not enable transactional shopping carts and check out or customer service. Episerver Digital Experience Hub for pre-built integrations Some DXC Service packages include two DXH connectors: 1. SharePoint connector 2. One of these connectors: Eloqua, ExactTarget, HubSpot, Marketo, Microsoft Dynamics CRM, Pardot, Salesforce, Silverpop. Only one Marketing Automation (or CRM) connector and SharePoint will work in combination today. A partner could build a secondary custom connector (using the APIs). http://world.episerver.com/add-ons/connect-for-marketing-automation/digital-experience-hub/ Copyright © 2019 Episerver. All rights reserved. Page 43

Episerver – Developing for DXC Service Module A – About DXC Service – Packages Understanding the Service Level Agreement (SLA) Although the SLA applies to your application If your solution calls external components and code, it only applies when your application services not managed by Episerver, like Twitter, code calls Episerver APIs. and that component or service takes down your site, then the SLA will not apply. DXC Service Enterprise package has an SLA of 99.9% External service (98%) Your application code External service (99.5%) Episerver APIs 99.9% x 98% x 99.5% = 97.4% Episerver Website Availability Initiation Time Target Actual (average over 39 sites*) Incident Management Resolution Time 99.9% 99.98% Initiation Time 30 minutes 24 minutes Change Management Completion Time 2 hours 33 minutes 8 hours 7.15 hours 48 hours 26.45 hours *Based on similar customers in 2015 with application level SLA of 99.9% We are shifting customers to a better CDN and WAF, and we want to wait until we have enough customers on it to share the recent improved SLAs in 2016 and 2017. As best as we can tell, 2017 Website Availability across 310 sites is 99.75%. https://www.episerver.com/legal/episerver-service-level-agreement-2018 https://www.episerver.com/legal/episerver-support/standard-support-agreement https://www.episerver.com/legal/episerver-support/premium-support-options Copyright © 2019 Episerver. All rights reserved. Page 44

Episerver – Developing for DXC Service Module A – About DXC Service – Add-Ons Cloud accelerator package Ensures successful launch for client, partner and customer. • Technical overview of configuration within the cloud • Cloud implementation support • Setup and configuration of Azure Web Apps specific to DXC Service • Overview of code deployment, authentication, DXH, web services and 3rd party connectors • Pre-launch certification checklist • Establish consistent development and deployment processes aligned with platform capabilities and operational structure Episerver Copyright © 2019 Episerver. All rights reserved. Page 46

Episerver – Developing for DXC Service Module A – About DXC Service – Add-Ons ImageVault Enhanced media asset management for DXC Service: • Cloud service built for Microsoft Azure • Available directly from Meriworks • Different packages compatible with Group, Corporate, and Enterprise https://www.imagevault.se/en/plugins/episerver/ Episerver Copyright © 2019 Episerver. All rights reserved. Page 47

Episerver – Developing for DXC Service Module A – About DXC Service – Add-Ons LivePerson – LiveEngage chat Facebook 18,000 businesses 25 million chats a month Add chat to any Episerver website • Quickly integrate via tagging SMS system • Secure Agent Dashboard • Sentiment analysis • Ratings/scores • App interfaces (e.g. Facebook) • Hosted service managed by LivePerson Episerver Copyright © 2019 Episerver. All rights reserved. Page 48

Episerver – Developing for DXC Service Module A – About DXC Service – Management PaaS, DevOps, and DXC Service Operations (Ops) is commonly 50% of total IT spend. If you choose to manage your own cloud resources, the developer often has to take on the unfamiliar Ops role and manage tasks such as configuring networking, security, scaling, monitoring, and so on. This role is known as DevOps. With DXC Service, Episerver performs the Ops role for you through Managed Services, included in our price for DXC. You get the best of both worlds: 1. Developers focus on writing code and testing its functionality in the Integration environment, or in additional deployment environments. 2. Managed Services then takes care of deployment to the Preproduction and Production environments, configuring security, and managing scaling, monitoring, and availability. Just pick a package based on the number of SKUs and page views that you need and we handle the rest. Episerver Managed Services The MSD team is responsible for the availability of Production environments and to ensure the environments are delivered in a secure best practice configuration. For governance, there is a comprehensive suite of Service Management processes based on Information Technology Infrastructure Library (ITIL). If a problem arises, it is handled by a MSD team member who initially creates a ticket with a unique number in our ticketing system. Technical support staff then ensures that the ticket is kept active and updated as the ticket moves towards resolution. Copyright © 2019 Episerver. All rights reserved. Page 50

Episerver – Developing for DXC Service Module A – About DXC Service – Management Checking Azure compliance https://www.microsoft.com/en-us/TrustCenter/Compliance/default.aspx Microsoft’s cloud infrastructure and services are audited once a year for ISO 27001 compliance by the British Standards Institution (BSI), an accredited certification body, providing independent validation that Microsoft has implemented security controls end to end. Episerver achieved ISO 27001 compliance worldwide for the Digital Experience Cloud service on 26th July 2018. Episerver Copyright © 2019 Episerver. All rights reserved. Page 51

Episerver – Developing for DXC Service Module A – About DXC Service – Management Checking DXC status and Episerver Trust Center http://status.episerver.com/ http://www.episerver.com/about/privacy/trust-center/ Episerver Checking Azure status https://azure.microsoft.com/en-gb/status/ Copyright © 2019 Episerver. All rights reserved. Page 52

Episerver – Developing for DXC Service Module A – About DXC Service – Management Backup and retention DXC-S performs backups of the application and database using Microsoft Azure’s backup service: https://azure.microsoft.com/en-us/documentation/articles/web-sites-backup/ • The Web App’s file content and configuration is backed up to the Episerver-managed Azure storage account every twenty-four (24) hours. • The SQL Database creates a full backup of every active database hourly and transaction log back-up every five (5) minutes. The backups are replicated to a geo-redundant data center to ensure availability of the backups in the event of disaster. Episerver retains backup copies for thirty-five (35) days. Assets (media and files) are not backed up as a part of this process because Azure Blob Storage is disaster resilient. Assets are replicated both within the data center and to a geo-redundant location. However, this does not account for user error if an editor mistakenly deletes an asset and then after 30 days in the Trash it is permanently deleted. Episerver Copyright © 2019 Episerver. All rights reserved. Page 53

Episerver – Developing for DXC Service Module A – About DXC Service – Management Reporting DXC-S generates an all-in-one monthly report, which compiles service information from both the service desk and our application performance monitoring. Performance metrics are benchmarked against the previous month to determine whether there is an improvement or degradation to your service. Metrics include: • Average page load time • Page views • Availability • Events • Average response time Episerver Copyright © 2019 Episerver. All rights reserved. Page 54

Episerver – Developing for DXC Service Module A – About DXC Service – Management Additional Packages can be deployed to a different region to the Master Package. DXC Service paired regions DXC Service customers can choose from one of the following regions so that Episerver can provide automatic geo-replication and failover within that region: • West US • East US Other locations such as UK • Canada and China are being evaluated • Europe based on market feedback. • APAC renamed Pacific • Asia, Japan, and South America coming soon Episerver’s Digital Experience Cloud™ Automatic Failover Solution Episerver http://world.episerver.com/blogs/daniel-browne/dates/2017/10/automatic-failover/ 56 Azure regions Azure is generally available in 36 regions around the world, and has announced plans for 6 additional regions: https://azure.microsoft.com/en-us/regions/ Not all Azure services are available in all regions. Check service availability in your region: https://azure.microsoft.com/en-gb/regions/services/ Copyright © 2019 Episerver. All rights reserved. Page 56

Episerver – Developing for DXC Service Module A – About DXC Service – Management Failover replication process While failed-over, logging is not available because blobs are Primary region Code distribution through Episerver development process readonly in the failover region. Write Mode Failover region Read-only Web App Web App Azure SQL Service Bus Storage blob Azure SQL Service Bus Storage blob database database Azure Geo-Replicated Storage Service Bus does not have active geo-replication. Be aware of this if SQL Azure Database Active Geo-Replication you use Episerver Events API. Failover is an optional, additional cost, component. Ehpitsetrvpesr ://world.episerver.com/digital-experience-cloud-service/failover/ Aggressive autoscaling The site must be able to handle aggressive autoscaling, that is when a number of instances to meet maximum load are started before that load is expected, to get the failover environment quickly up and running. This may be an issue for sites where many calls are made to external systems during application startup. Readonly mode Ensure that you configure warnings in your solution to handle read-only mode, for example by using application state. For database transactions features, such as saving a posted form, or storage transaction features like image resizing, these features must be aware that the application is in read-only mode, to not throw write exceptions. Copyright © 2019 Episerver. All rights reserved. Page 57

Episerver – Developing for DXC Service Module A – About DXC Service – Management End user traffic Internet Failover replication process Content Delivery Network (CDN) Continuous monitoring of endpoint health Endpoint Problem Traffic Manager Primary region FParilmovaeryr region Write Mode Read-only Web App Web App Azure SQL Service Bus Storage blob Azure SQL Service Bus Storage blob database database Episerver Failover considerations The main consideration is to ensure your site enables read-only mode. CMS and Commerce versions on your site must work with read-only mode (CMS 9.7.0 and Commerce 9.9.0 or higher). Add-ons on the site must also work with read-only mode. Ensure that you configure warnings in your solution to handle read-only mode, for example by using application state. For database transactions features, such as saving a posted form, or storage transaction features like image resizing, these features must be aware that the application is in read-only mode, to not throw write exceptions. https://world.episerver.com/documentation/developer-guides/CMS/Deployment/database-mode/ Optionally, you can configure if you want to display an information message to end-users on the failover site when in read-only mode during a failure. Set the episerver:ReadOnlyInfoUrl in appSettings to override the default of ~/Util/ReadOnly.aspx: <appSettings> <add key=\"episerver:ReadOnlyInfoUrl\" value=\"~/OurCustomReadOnlyPage.html\" /> Copyright © 2019 Episerver. All rights reserved. Page 58

Episerver – Developing for DXC Service Module A – About DXC Service – Security Azure platform security • Azure App Service doesn’t use an ordinary version of Microsoft Windows, it uses a purpose built version with a smaller attack surface and reduced vulnerability, with continuously updated patches. • Microsoft's Azure antimalware provides real-time protection and content scanning. • Microsoft and their Red Team regularly pen test the underlying infrastructure. • The Episerver platform is subject to regular pen tests conducted by customers and partners. • DXC Service enables encryption for data-at-rest using Azure platform features. • However, any implementation on top of the Episerver platform could unexpectedly introduce a security hole, therefore you need to ensure that your solution is tested. While coding, developers should log into the site(s) with an account that has the same permissions that a content editor would have. This will ensure that developers spot permission-related problems before content editors do user acceptance testing (UAT). Developers should never log in to a site with an admin account except when working on a feature that requires those permissions. Episerver Episerver platform is tested against • Injection attacks • Cross-site scripting (XSS) • Broken authentication and session management • Insecure direct object references • Cross-site request forgery (CSRF) • Security misconfiguration • Insecure cryptographic storage • Failure to restrict URL access • Insufficient transport layer protection • Unvalidated redirects and forwards Copyright © 2019 Episerver. All rights reserved. Page 60

Episerver – Developing for DXC Service Module A – About DXC Service – Security Perform web vulnerability scanning on your solution Episerver offers a Web Vulnerability Scan service that is currently provided by Detectify. Vulnerability scans protect against attacks on the website. Penetration testing thwarts hacking and attacks on routers, firewalls, and so on. Your website is analysed from a hacker’s perspective, including: • Tests for over 500 vulnerabilities, including OWASP Top 10. • Active and passive security tests that are continuously updated by a top-ranked security team of white hat hackers. You set the desired target: either the entire domain, or a smaller subset such as a page. Episerver Perform penetration testing on your solution It is important to understand that the partner or customer delivers a custom solution on top of our platform which, at any stage, could unexpectedly introduce a security hole. Therefore, testing the final customer solution is critical. You can engage with Expert Services to arrange a Penetration and Security Validation. If your plan to perform your own pen test, you must notify us at least 10 days in advanced so that we can warn Microsoft! The Episerver platform is subject to several penetration tests every year conducted by customers and partners. Many either perform penetration tests on their own (that is, using HP Fortify) or have had third-party firms perform these tests for them. The most critical component to be tested is the final solution to ensure no issues were introduced during the project development phase. Numerous Episerver customers have high- security installations including the Swedish Police, Armed Forces of Sweden, the National Banks of Sweden and Norway, the Parliaments of the UK, Sweden and Norway. Copyright © 2019 Episerver. All rights reserved. Page 61

Episerver – Developing for DXC Service Module A – About DXC Service – Security Web Application Firewall (WAF) DXC Service’s WAF stops attacks at the network edge, protecting your website from common web threats and specialized attacks before they reach your servers. WAF is always enabled, constantly monitoring the website traffic. DXC WAF uses a ruleset to block common attacks, like cross-site scripting (XSS), DDoS, and SQL injections. Episerver can update this ruleset at any time to keep DXC WAF up-to-date with evolving trends in attacks to automatically protect customers against these potential vulnerabilities. New rules typically take effect globally in under 30 seconds. DXC WAF runs the OWASP ModSecurity Core Ruleset by default, making sure you are protected against the OWASP Top 10 common vulnerabilities. Customers cannot change the ruleset or provide their own. DXC WAF ruleset is optimized for Episerver applications and based on best practices. OWASP ModSecurity Core Rule Set (CRS) https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project Episerver WAF protects against Distributed Denial of Service (DDoS) attacks DDoS attacks are common and complex, and traditional on premise solutions cannot handle these. DXC WAF offers advanced protection at the network edge through its CDN provider including UDP and ICMP protocols, DNS amplification, Layer 7 and 3/4, SYN/ACK, and SMURF (refer to information on the net for this terminology). DXC WAF allows blocking traffic by country and we will enable this for a customer on request. Microsoft Azure also protects against attacks generated from outside and inside the platform. WAF for Digital Commerce If you are a merchant who handles consumer credit card information, the WAF meets the PCI DSS 2.0 and 3.0 Requirement 6.6 if you conduct application vulnerability security reviews of all of your in-scope web applications. Copyright © 2019 Episerver. All rights reserved. Page 62

Episerver – Developing for DXC Service Module A – About DXC Service – Security Secure communication and authentication Secure Sockets Layer (SSL) is commonly used for encrypted integration and communication with other services through REST and Web Service APIs. • All domains in DXC service are protected by SSL by default. • SSL termination is at the CDN for Edit and Admin views as well as the public website. A Virtual Private Network (VPN) may be used to allow a secure connection to a corporate resource. • Communication is one-way to the on premise system, so external systems cannot establish a connection to DXC service. • One (1) VPN connection is included. Additional VPN connections can be added for an additional cost. You can use OpenID Connect to integrate with Azure Active Directory: https://world.episerver.com/documentation/developer-guides/CMS/security/integrate-azure-ad-using-openid-connect/ Episerver About VPN Gateway https://azure.microsoft.com/en-us/documentation/articles/vpn-gateway-about-vpngateways/ Copyright © 2019 Episerver. All rights reserved. Page 63

Episerver – Developing for DXC Service Module A – About DXC Service Exercises for Module A (15 mins) 1. DXC Service quiz (10 mins): answer multiple choice questions about DXC Service. 2. Penetration Test application (5 mins): review Microsoft’s application form to perform a pen test. Episerver Copyright © 2019 Episerver. All rights reserved. Page 64

Episerver – Developing for DXC Service Module B – Deploying to DXC Service Module B Deploying to DXC Service In this module, you will learn about DXC Service environments, Web.config transformations, the deployment process, how to implement continuous integration, and how to perform logging and troubleshooting. Episerver Copyright © 2019 Episerver. All rights reserved. Page 65

Episerver – Developing for DXC Service Module B – Deploying to DXC Service Module agenda Hosting your site in DXC Service, or any cloud environment, requires new deployment strategies. Follow these recommendations to ensure a smooth predictable deployment experience. • Deployment environments • Exercises B1 to B4 • Deployment process • PaaS portal • Exercise B1 – Transforming Web.config • Building and deploying manually • Exercise B2 – Manually deploying with Visual Studio Publish • Continuous integration (CI) and delivery (CD) • Exercise B3 – Debugging remotely and • Web.config transformations monitoring with Application Insights • Troubleshooting • Exercise B4 – Continuous integration and delivery Episerver Copyright © 2019 Episerver. All rights reserved. Page 66