Print Page | Close Window

AllowAnonymousLogIn

Printed From: IdeaBlade
Category: DevForce
Forum Name: DevForce 2010
Forum Discription: For .NET 4.0
URL: http://www.ideablade.com/forum/forum_posts.asp?TID=2461
Printed Date: 29-Jul-2026 at 5:42pm


Topic: AllowAnonymousLogIn
Posted By: gregweb
Subject: AllowAnonymousLogIn
Date Posted: 22-Jan-2011 at 7:39pm
In my config file, I have these settings.  This works fine.  However, I have a need to have both allowAnonymousLogin to be both true and false.  In other words, I have metadata that I would like to download when the site is first accessed, before the user logs in.  The once logged in, other data is gotten. Is there a way to do both?
 
Thanks,
Greg
 
<objectServer>
      <serverSettings useAspNetSecurityServices="true" loginManagerRequired="true" allowAnonymousLogin="false" />
    </objectServer>
 


Replies:
Posted By: kimj
Date Posted: 24-Jan-2011 at 12:26pm
The AllowAnonymousLogin determines whether "guest" users can login to your application to use DevForce services such as query and save.  It doesn't actually have anything to do with the "Anonymous Authentication" setting within IIS.  So, if your metadata download is not performed by DevForce proper, then you should be able to do this if your IIS authorization/authentication settings allow it.

Posted By: gregweb
Date Posted: 24-Jan-2011 at 6:46pm
Hi Kim,
 
The metadata IS accessed through Dev-Force.  So I need to be able to access data  while the user is a "guest" before he logs in.  But I don't want all data to be exposed to guests, only some of it.
 
I have two different Entity Managers, one for the metadata entities, and another for everything else.  If there was a way to require authentication on one, but not for the other MetaDataEntityManager, that would be ideal.
 
Greg

Posted By: kimj
Date Posted: 26-Jan-2011 at 9:17am
Generally only one IEntityLoginManager is supported within an application, which means that the same authentication is used everywhere, for all EntityManagers.
 
If using your own IEntityLoginManager you can control what it accepts as credentials - so you can write it to accept no credentials (or guest credentials) and then also real credentials.  You can also add Authorization attributes and other authorization checks on server side code to ensure that only the correct type of users perform certain actions.
 
There's also the CompositionContext, which does allow you to have multiple IEntityLoginManager instances, with metadata or filters determining which instance should be used for a given context.   The CompositionContext is an argument to the EntityManager, so different EMs can have their own context.  There's a writeup in the DevForce Resource Center at http://drc.ideablade.com/xwiki/bin/view/Documentation/AdvPersist_CompositionContext - http://drc.ideablade.com/xwiki/bin/view/Documentation/AdvPersist_CompositionContext  which has a better explanation.  (This page will likely move within the next few days, but a search of the DRC for "CompositionContext" should find it.) 

Posted By: gregweb
Date Posted: 26-Jan-2011 at 10:06am
OK, thanks very much.
 
Greg

Posted By: smi-mark
Date Posted: 26-Jan-2011 at 2:04pm
Greg, why not do something like this, setup a guest user, and then use query interceptors to only allow access to certain entities for that user.

Posted By: gregweb
Date Posted: 26-Jan-2011 at 2:20pm
Hmmm, interesting idea.  I hadn't thought of that.
 
Do you mean create a user say "DefaultUser"  and then programatically log the user on when the app first starts up? 
 
By the way, it's good to see another DevForce here in Dallas!
 
Greg
 

Posted By: smi-mark
Date Posted: 26-Jan-2011 at 2:24pm
There are a few approaches you could do.

On your custom User class you could have an IsGuest property, or something similar. When the app starts up, you could log in with null credentials, or some other way of letting the LoginManager know it's a guest user. Then in your query interceptors, you could only allow/deny requests based on the property.

There is a chapter in the manual that explains it a bit better.
http://www.ideablade.com/CommonProductDocs/DevForce2010DevelopersGuide/DevForce2010DevelopersGuide.pdf
Page 307-308

Posted By: gregweb
Date Posted: 26-Jan-2011 at 4:19pm

Well, here is what I came up with that works so far.  Basically, I allow anon access, and then check the entity type as follows:

public class QueryInterceptor : EntityServerQueryInterceptor
    {
        protected override bool AuthorizeQuery()
        {
            if (this.Principal.Identity.IsAuthenticated)
            {
                return true;
            }
            else
            {
                if (this.Query.ElementType == typeof(menuentity))
                {
                    return true;
                }
            }
 
            return false;
 
        }
    }

Posted By: smi-mark
Date Posted: 27-Jan-2011 at 6:39am
Glad to hear that works for you!


Print Page | Close Window