barcode library c# Customized Authentication and Role-Based Security in Font

Draw Code-39 in Font Customized Authentication and Role-Based Security

Forms authentication is great, but it doesn t use the role-based features we talked about at the beginning of the chapter. As you saw, it will simply create an empty GenericPrincipal object, containing only the initialized FormsIdentity object. If we were to build an administration section in our application, and we wanted to restrict access only to administrator users, we would need to deny access to everyone, and then add the administrator users one by one. To take advantage of role-based authentication, you need to customize the process. In the The ASP .NET Security Infrastructure section earlier in this chapter, you saw that the various authentication modules actually hook into the same events that you can use, particularly AuthenticateRequest, an event to which you can attach a handler in your Global.asax file.

You also learned that the infrastructure is prepared to work with any role-based scheme, as long as it works around the concepts of principal and identity (represented by the IPrincipal and IIdentity interfaces). So far, however, you ve let the default modules take charge. Your only intervention in Forms authentication was to check a user name and password in the login form. You didn t need to bother about the cookies, encryption/decryption (yes, the cookie is encrypted), creation of the Principal and Identity objects, or anything else. Some things are going to have to change.

For our implementation of custom authentication, we will start by using the GenericPrincipal and GenericIdentity objects, which provide a reasonable and simple implementation. In case they are not enough, we can always inherit and extend them, or even implement IPrincipal and IIdentity directly in a custom class. You already know the processing that takes place in order to make the default modules work. You can now apply that knowledge to build custom authentication. As we stated, the key event to handle in the process is AuthenticateRequest. During the handler for this event, you can perform some actions, and then set the Context.User property to your custom Principal and Identity objects. As with any other authentication scheme, this security context will follow the user through pages, user controls, code-behind pages, and so on. You ll be able to access these objects from any point in running code. To customize authentication, you need to intercept the process at some point. In this instance, we ll leave the code as it is in the Login.aspx page, and let the Forms authentication module perform all the work it has been doing so far, until a certain point. Let s look again at the steps for a typical request in our application, and see where to override the default behavior: 1. User requests Default.aspx (this is the initial request to enter the application). 2. The Application_AuthenticateRequest event is fired; IsAuthenticated = false, so Forms module redirects to Login.aspx ReturnUrl=.... 3. The redirect causes a new request to another page (namely Login.aspx). 4. The Application_AuthenticateRequest event is fired again, this time by the access to Login.aspx. The module realizes that this is the login page, so it doesn t redirect to itself again. 5. The user enters credentials and submits. Posting the form to itself is actually another new request. 6. The code checks against database and returns OK. The module saves UserID with the authentication cookie, and performs a redirect to ReturnUrl (Default.aspx). 7. As a result of the redirect, a new request is made for Default.aspx. This time, the authentication cookie is set. 8. The Application_AuthenticateRequest event fires; this is the first time you get IsAuthenticated = true. The application picks up processing from here, and rebuilds customized versions of GenericPrincipal and GenericIdentity, based on the information retrieved from the database using the UserID attached to the authentication cookie. It replaces the Context.User with the new complete Principal.