New Posts New Posts RSS Feed: [SOLVED] Security
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

[SOLVED] Security
 Post Reply Post Reply
Author
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
Bill Jensen View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 31-Jul-2007
Location: United States
Posts: 229 		Post Options Post Options   Quote Bill Jensen Quote  Post ReplyReply Direct Link To This Post Topic: [SOLVED] Security
    Posted: 19-Sep-2007 at 12:57pm
Great!
Back to Top
Linguinut View Drop Down
Senior Member
Senior Member
Avatar

Joined: 14-Jun-2007
Location: United States
Posts: 394 		Post Options Post Options   Quote Linguinut Quote  Post ReplyReply Direct Link To This Post Posted: 19-Sep-2007 at 12:28pm
Two issues worked against me:
 
1)  The "acc.Value" from the above code returns an ALL CAPS string.  I just needed to make the ProfileCatalog entries reflect that.
2)  The domain name is included in the group name (or local machine, if a local group), so I needed to remove the domain name from the string.
 
It is working, now.  Clap


Edited by Linguinut - 19-Sep-2007 at 12:29pm
Back to Top
Linguinut View Drop Down
Senior Member
Senior Member
Avatar

Joined: 14-Jun-2007
Location: United States
Posts: 394 		Post Options Post Options   Quote Linguinut Quote  Post ReplyReply Direct Link To This Post Posted: 19-Sep-2007 at 12:06pm

All roles should be retrieved from the Active Directory.

The LoginManager did not have the GetUserRoles method implemented, so I added code to iterate through the WindowsIdentity groups collection and slipped each group name into the string collection that is returned to create the IPrincipal object.
 
This does not work.  Either the LoginManager is not being called (although the LoginManagerRequired property of the ibConfig file is set to true--debugging now), or I implemented the GetUserRoles method improperly, as follows. 

WindowsIdentity wid = WindowsIdentity.GetCurrent(false);
List<string> groups = new List<string>();
IdentityReferenceCollection irc = wid.Groups.Translate(typeof(NTAccount));
foreach (NTAccount acc in irc)
{
groups.Add(acc.Value);
}
return groups.ToArray();
 
Another consideration is the "Applicable to server only" statement.  If I am running this app without BOS (for development purposes), then is the login manager not being used?
 
Thanks,
Bill


Edited by Linguinut - 19-Sep-2007 at 12:11pm
Back to Top
Bill Jensen View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 31-Jul-2007
Location: United States
Posts: 229 		Post Options Post Options   Quote Bill Jensen Quote  Post ReplyReply Direct Link To This Post Posted: 18-Sep-2007 at 1:42pm

How are you authorizing (assigning roles)?  Are roles stored in the your database?  How do they find their way into the Principal for the running application?

See the Login() method at LoginManager (in CabanaCo.Cabana.Model) line 76.
 
Bill J.
Back to Top
Linguinut View Drop Down
Senior Member
Senior Member
Avatar

Joined: 14-Jun-2007
Location: United States
Posts: 394 		Post Options Post Options   Quote Linguinut Quote  Post ReplyReply Direct Link To This Post Posted: 18-Sep-2007 at 12:18pm
Yup.  Essentially.  That is exactly what I expected; however, that is not what is happening.  I made myself a member of the sales group, but the module does not load.  I also added the "Domain Admins" group to the module (which I am already a part of) -- <Role Allow="Domain Admins"/> --, but that did not work, either.  Is there something else I need to "turn on" or "turn off" within the app?
 
I expect this would work on a view level, too, if I utilized the proper attributes and reflection.  Is that right? 
Back to Top
Bill Jensen View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 31-Jul-2007
Location: United States
Posts: 229 		Post Options Post Options   Quote Bill Jensen Quote  Post ReplyReply Direct Link To This Post Posted: 18-Sep-2007 at 11:04am

CAB only loads the Spiratex.Aspire.Sales module if the current Principal responds true to IsInRole("Sales").

Is that the question?
 
Bill J.
Back to Top
Linguinut View Drop Down
Senior Member
Senior Member
Avatar

Joined: 14-Jun-2007
Location: United States
Posts: 394 		Post Options Post Options   Quote Linguinut Quote  Post ReplyReply Direct Link To This Post Posted: 17-Sep-2007 at 10:47am

How does the following actually work?

<Section Name="Sales">
    <Dependencies>
        <Dependency Name="Foundation" />
    </Dependencies>
    <Modules>
        <ModuleInfo AssemblyFile="Spiratex.Aspire.Sales.dll">
            <Roles>
                <Role Allow="Sales"/>
            </Roles>
        </ModuleInfo>
    </Modules>
</Section>

Will this work if I have an AD group called 'Sales'?


Edited by Linguinut - 17-Sep-2007 at 1:50pm
Back to Top
Linguinut View Drop Down
Senior Member
Senior Member
Avatar

Joined: 14-Jun-2007
Location: United States
Posts: 394 		Post Options Post Options   Quote Linguinut Quote  Post ReplyReply Direct Link To This Post Posted: 14-Sep-2007 at 9:37am

Well, for one, I could load/not load modules based on the user's role.  This involves the ProfileCatalog.xml file in some way.  Also, I want to make sure that I am not missing out on taking advantage of IOC/dependency injection.  A service would be a great place to put this kind of thing, I imagine.  That kind of application structure is a bit different.

Nevertheless, I am looking at any documentation, samples and videos that I can lay my hands on.  I am currently reviewing (again) your seminar on Securing Your Application.

Thanks!
Bill
Back to Top
davidklitzke View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 14-Jun-2007
Posts: 715 		Post Options Post Options   Quote davidklitzke Quote  Post ReplyReply Direct Link To This Post Posted: 13-Sep-2007 at 7:01pm

I don't know why you would look at role-based authorizarion in Cabana applications any differently than you would look at role-based authorization in any other kind of IdeaBlade application.  In particular, I encourage you to look at the Advanced Tutorial on Role-based Authorization.
Back to Top
Linguinut View Drop Down
Senior Member
Senior Member
Avatar

Joined: 14-Jun-2007
Location: United States
Posts: 394 		Post Options Post Options   Quote Linguinut Quote  Post ReplyReply Direct Link To This Post Posted: 13-Sep-2007 at 5:23pm
No problem.  I can introduce the security aspect later in the project.
Back to Top
Bill Jensen View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 31-Jul-2007
Location: United States
Posts: 229 		Post Options Post Options   Quote Bill Jensen Quote  Post ReplyReply Direct Link To This Post Posted: 13-Sep-2007 at 5:13pm
This question is a little like asking "In 25 words or less...discuss China".
 
I'm out of the office through Monday.  I'll be happy to address this when I return on Tuesday.
 
Bill J.
Back to Top
Linguinut View Drop Down
Senior Member
Senior Member
Avatar

Joined: 14-Jun-2007
Location: United States
Posts: 394 		Post Options Post Options   Quote Linguinut Quote  Post ReplyReply Direct Link To This Post Posted: 13-Sep-2007 at 1:18pm
What is the best way to handle role-based security in the CAB?
 
Thanks,
Bill


Edited by Linguinut - 19-Sep-2007 at 12:30pm
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down