Recommended (Microsoft-based) framework for SaS?

I'm investigating technologies to build a commercial SaS site for a shop that predominantly uses Microsoft technologies.

The idea is that the site will have pluggable modules, with features that are either free or paid. Customers will be able to chop & change between features, & have their billing adjusted automagically as they do so.

If I were rolling this myself, I'd use:

• .NET 4 / VS2010 / C# / ReSharper / NUnit / Moq
• NDependencyInjection
• SQL Server
• LINQ to SQL
• ASP.NET MVC 3
• Authorize.net (or possibly billing hand-off to SAP)
• Selenium

... and hand-roll an IOC-based plugin architecture (e.g., there is some good discussion on ASP.NET MVC plugins here and here).

But at this point I'm wondering - has this been done before? I'm imagining some sort of vaguely CMS-like architecture with built-in plug-in, commerce & subscription stuff. All of that, rolled up into an 'off the shelf' solution, either FOSS or commercial.

Can anyone recommend such 开发者_开发问答a solution, or is it simply a 'roll your own' job? I think DotNetNuke might be worth looking at, but would appreciate feedback from people who've used it in production for this sort of task.

Edited to add: DotNetNuke appears set on continuing with WebForms, which is a big turn-off for me at least. As one of the commenters on that post said, it's an evolutionary dead-end.

Edited again: Silverlight is definitely out for this project. We need to support a wide range of devices, including non-Microsoft mobile devices like Android and iOS tablets & phones. We do need a reasonably rich UI but we'll be doing that in Javascript.

For a project which needed plugable modules, I've used MEF (which comes built in to .net 4.0).

By using this great code for compiling views into a dll it was easy to use MEF to load additional views and controllers making extensability easy.

The only other thing i'd do differently to your suggestments is to use Linq to Entites rather than Linq to Sql. The latest code-first version makes it very quick to get things up and running

Martin

I've done a similar solution for a VOIP PBX solution. I've made everything myself using nhibernate, autofac and a couple of own libraries. It's not really different from doing a normal application.

The most important aspect you need to understand is that ALL modules are loaded at ALL time. Theres no way around that if you need a solution that works well (you could jungle with one app domain per customer but that's not very inefficient).

You should instead control authorization using the standard .NET CAS (Code Access Security) solution. You do this by creating your own IPrincipal and IIdentity. The principal should correspond the tenant (organization) while IPrincipal corresponds to the user.

I use a ITenantEntity interface (contains the tenant db id) on all of my classes/entities which should belong to a tenant. It's used to validate that the currently logged on user really have access to the entity requested.

The hardest thing is if your application is multithreading (for instance if you got a background thread or timer doing some maintenance). The reasons is that it's quite easy to forget to switch to the correct IPrincipal which makes all your CAS checks fuck up. The easiest way to go around that is to create a custom Timer and Thread classes which forces you to specify a IPrincipal (or at least makes it easy to switch).

Another common approach is to use the tenantId argument on all service / repository methods. But that isn't a very robust solution imho.

Why would anyone roll these in an 'off the shelf' solution? These parts of the architecture are quite independent and you can substitute for whatever suits your needs.