Integrating Security Roles into Microsoft Silverlight Applications

Integrating Security Roles into Microsoft Silverlight ApplicationsDEV356Dan WahlinWahlin Consulting

AgendaSilverlight Security OptionsAccessing User Identity InformationAccessing User RolesCreating a SecurityManager class

Silverlight Security OptionsSilverlight Authentication:WindowsFormsCustomSilverlight Authorization:Active Directory GroupsForms RolesCustom Roles

Windows Authentication OptionsOption 1: Secure page hosting Silverlight controlEasiestUser promptedSilverlight app securedOption 2: Secure backend servicesSilverlight application is anonymousCalls to service require credentialsClient HTTP stack can be used

Using the Client HTTP Stack//Set once in App.xaml.csHttpWebRequest.RegisterPrefix("https://", WebRequestCreator.ClientHttp);....WebClientwc = new WebClient();wc.UseDefaultCredentials = false;wc.Credentials = new NetworkCredential("username", "password", "domain");

AgendaSecuring Silverlight ApplicationsAccessing User Identity InformationAccessing User RolesCreating a SecurityManager class

Accessing a User's CredentialsSilverlight does not support accessing the User object directlyUser.Identity.NameOptions for accessing the user name:initParams (be careful!)Use a serviceWCF RIA Services

Passing the User Name with initParamsUser Name can be passed dynamically into Silverlight using initParamsBe Careful!

Using initParams<param name="initParams" value="UserName=<%=User.Identity.Name%>" />…private void Application_Startup(object sender, StartupEventArgs e) {ProcessInitParams(e.InitParams);this.RootVisual = new MainPage();}void ProcessInitParams(IDictionary<string, string> initParams) { if (initParams != null) {foreach (var item in initParams) {this.Resources.Add(item.Key, item.Value); } }}

Creating a User Credentials ServiceCreate a User Credentials WCF/ASMX service:Service handles returning authenticated user's informationNo risk of a spoofed User Name as with initParamsService can return additional information such as rolesWCF RIA Services does this out-of-the-box

Returning a User Name from a Service[OperationContract]public string GetLoggedInUserName() { return new SecurityRepository() .GetUserName(OperationContext.Current);}public class SecurityRepository { public string GetUserName(OperationContextopContext) { return (opContext.ServiceSecurityContext != null && opContext.ServiceSecurityContext.WindowsIdentity != null) ? opContext.ServiceSecurityContext.WindowsIdentity.Name : null; }}

demoAccessing an Authenticated User's User Name

Accessing User RolesOptions:Pass user roles into application using initParamsCreate a security service operation that returns rolesBe Careful!

Returning Roles from a Service[OperationContract]public List<Role> GetRoles(){ return new SecurityRepository().GetRoles(OperationContext.Current);}public class SecurityRepository { public List<Role> GetRoles(OperationContextopContext) {varuserName = GetUserName(opContext); //Get roles from Active Directory, Database, or elsewhere }}

How do you access and manage user names and roles in a Silverlight application?

Creating a SecurityManager ClassSecurityManager class can act as client-side gateway to user credentials:Accesses user credentials asynchronouslyDetermine user role(s)Determine access to viewMVVM compliantAdd to ViewModel base class through aggregation

The SecurityManager Class[Export(typeof(ISecurityManager))][PartCreationPolicy(CreationPolicy.Shared)]public class SecurityManager : ISecurityManager {public event EventHandlerUserSecurityLoaded; public boolIsUserSecurityLoadComplete { get; set; } public ObservableCollection<Role> UserRoles { get; set; } public string UserName { get; set; } public boolIsAdmin { get; } public boolIsInUserRole { get; } public boolIsValidUser { get; } private void GetUserSecurityDetails() {} public boolCheckUserAccessToUri(Uri uri) {} public boolUserIsInRole(string role) {} public boolUserIsInAnyRole(params string[] roles) {}}

Using the SecurityManager Classpublic class ViewModelBase: INotifyPropertyChanged { [Import]public ISecurityManagerSecurityManager { get; set; }}public class MainPageViewModel : ViewModelBase { public MainPageViewModel() {if (!IsDesignTime) SecurityManager.UserSecurityLoaded += SecurityManagerUserSecurityLoaded; } void SecurityManagerUserSecurityLoaded(object sender, EventArgs e) {IsAdmin = SecurityManager.IsAdmin; //Set INPC propertyUserName = SecurityManager.UserName; //Set INPC property }}

demoCreating and using a SecurityManager Class

SummarySilverlight doesn’t provide direct access to user credentialsDifferent techniques can be used to access a user name and roles:Pass into initParams (be careful!)Access data through a security serviceUse WCF RIA Service's WebContext classThe SecurityManager class can simplify the process of working with user credentialsHandles async calls to security service Stores user credentials and provides security logicIntegrates well with MVVM

Contact InfoBloghttp://weblogs.asp.net/dwahlinTwitter@DanWahlinBloghttp://weblogs.asp.net/dwahlinTwitter@DanWahlin

Related ContentRequired SlideSpeakers, please list the Breakout Sessions, Interactive Discussions, Labs, Demo Stations and Certification Exam that relate to your session. Also indicate when they can find you staffing in the TLC.DEV209: From Zero to Silverlight in 75 MinutesDEV210: Microsoft Silverlight, WCF RIA Services and Your Business ObjectsDEV331: A Lap around Microsoft Silverlight 5DEV386HOL: Microsoft Silverlight Data BindingDEV388HOL: Web Services and Microsoft SilverlightDEV390HOL: Using the MVVM Pattern in Microsoft Silverlight Applications

Track ResourcesRequired Slide Track PMs will supply the content for this slide, which will be inserted during the final scrub. Resource 1Resource 2Resource 3Resource 4

ResourcesConnect. Share. Discuss.http://northamerica.msteched.comLearningSessions On-Demand & CommunityMicrosoft Certification & Training Resourceswww.microsoft.com/techedwww.microsoft.com/learningResources for IT ProfessionalsResources for Developershttp://microsoft.com/technethttp://microsoft.com/msdn

Required SlideComplete an evaluation on CommNet and enter to win!

Required Slide Your MS Tag will be inserted here during the final scrub. MS Tag Placeholder Slide

© 2011 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Integrating Security Roles into Microsoft Silverlight Applications

More Related Content

What's hot (20)

Viewers also liked (18)

Similar to Integrating Security Roles into Microsoft Silverlight Applications (20)

Recently uploaded (20)

Integrating Security Roles into Microsoft Silverlight Applications

Editor's Notes