Bob Hansen
|
    |
Location: Wisconsin | Joined: 1/29/2004 | Posts: 9 | Offline
|
|
I am trying to implement role based security for an ASP.NET web site using objects based off the IPrincipal and IIdentity interfaces. I have everything coded and password authentication works fine. My problem is that IIS will not hold on to the custom IPrincipal object and keeps returning back an authenticated IPrincipal object with my windows security set. This confuses me because I have the web.config file set up for forms based authentication and I am assigning the principal using Context.User and also setting the Authorization cookie.
Does anyone know of any good articles on setting up a secure environment using custom IPrincipal and IIdentity objects or have any clue what's going wrong? I can post "some" code if necessary but a lot of what I'm writing is proprietary.
Cheers,
Bob Hansen
|
|
|
  |
Location: Cleveland, OH, USA | Joined: 8/15/2000 | Posts: 813 | Offline
|
|
The problem might be that you're not doing it on every request. That's what it takes, and it happens from global.asax. This very forum does it (source code at POP Forums).
It looks like this:
public virtual void Application_OnAuthenticateRequest(object sender, EventArgs e)
{
if (Request.IsAuthenticated)
{
HttpContext context = HttpContext.Current;
if ((context.Cache["pfuid" + context.User.Identity.Name] == null) || (ConfigurationSettings.AppSettings["PopForumsCacheData"].ToLower() != "true"))
{
// create a new identity, based on the login
GenericIdentity objIdentity = new GenericIdentity(context.User.Identity.Name);
IPopForumsData objData = PopForums.Data.Methods();
// get the roles from the database
ArrayList listRoles = objData.GetPeopleRoles(context.User.Identity.Name);
string[] arrRoles = new string[listRoles.Count];
for (int i=0; i // put the identity and roles in a new principal
GenericPrincipal objPrincipal = new GenericPrincipal(objIdentity,arrRoles);
// cache it
if (ConfigurationSettings.AppSettings["PopForumsCacheData"].ToLower() == "true")
context.Cache.Insert("pfuid" + context.User.Identity.Name, objPrincipal, null, DateTime.Now.AddSeconds(Convert.ToDouble(ConfigurationSettings.AppSettings["PopForumsCacheSeconds"])), new TimeSpan(0));
// bust it live
context.User = objPrincipal;
}
else
{
context.User = (GenericPrincipal)context.Cache["pfuid" + context.User.Identity.Name];
}
}
} In this example I'm caching the database hit, which gives you a pretty good performance boost.
Jeff 'Jones' Putz
POP World Media, LLC
|
CliqueSite® POP Forums Feature UI v7.5.0
©2004, POP World Media, LLC
©2009, POP World Media, LLC. All rights reserved
Legal, privacy, terms of service